From elevyabe@cisco.com Wed Jul 1 08:58:43 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 03FE23A6A04 for ; Wed, 1 Jul 2009 08:58:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.311 X-Spam-Level: X-Spam-Status: No, score=-10.311 tagged_above=-999 required=5 tests=[AWL=0.288, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Nld3i0pvgssA for ; Wed, 1 Jul 2009 08:58:41 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 73FCC3A6F3B for ; Wed, 1 Jul 2009 08:58:41 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,325,1243814400"; d="scan'208";a="44134388" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 01 Jul 2009 15:58:43 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n61Fwh27030148; Wed, 1 Jul 2009 17:58:43 +0200 Received: from xbh-ams-332.emea.cisco.com (xbh-ams-332.cisco.com [144.254.231.87]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n61FwhWW022590; Wed, 1 Jul 2009 15:58:43 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-332.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 1 Jul 2009 17:58:43 +0200 Received: from [144.254.53.107] ([144.254.53.107]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Wed, 1 Jul 2009 17:58:42 +0200 Message-ID: <4A4B87B2.1030105@cisco.com> Date: Wed, 01 Jul 2009 17:58:42 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> In-Reply-To: <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 01 Jul 2009 15:58:43.0041 (UTC) FILETIME=[CED37D10:01C9FA64] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3177; t=1246463923; x=1247327923; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20A=20different=20trade=20off=20 for=20SAVI |Sender:=20; bh=ozC5AJyMirc7ARF2qg/YB5jC4Q5KAG66dOEQDTBFQJA=; b=BCJ9f4GeasFW12uR7ngaVftu3RmU0EWB0RN3CnuoedwQaEKaaz0x9ALP8T HAftjEJpip9FNEe3SB/dLCp02XFJef7irVK0fZLgScBIVmWhuBLuaGKhdtfL EyBJzBNb/e; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 01 Jul 2009 15:58:43 -0000 Christian, Christian Vogt a écrit : > > Eric - > > Thanks for clarifying. Yet what I think you need to clarify even > further is why the benefits of snooping ND packets, which you identify > in your email below, cannot already be obtained with the current SAVI > solution, which snoops all packets. Could you do this? > A few reasons: 1) The most obvious reason was mentionned previously: DAD packets can get lost (low probability), not being sent (higher probability), or simply not seen in multiple switch scenario. The latter may have not been discussed, but a very common situation is a switch (make it savi) connected to a bunch of Access Points (you can see them as dumb L2 switches). APs comes up, end-nodes comes up, then the savi-switch comes up. All DAD are missed. Snooping at other NDP packets will increase the chances to discover end-nodes. It's not guaranteed, but it is better. 2) Another benefit of looking at other packets would be the capability to keep a "reachabilty" state of end-nodes. In fcfs, it is proposed to "ND ping" the binding owner to verify wether it is still there (or rather, that is is gone) when receiving a binding from a different port. I see some issues with that, including a potential attack. If we can have a more accurate state of the binding entry, based on information snooped in other ND packets (DAD only happens once, at the beginning), we can save or at least reduce the need for these ping messages. 3) Last but not least, other NDP messages carry LLA options. I like to think that the mac used in binding records should come from there, rather than from the L2, and that is is an option to verify that the two match. I feel like we might be in trouble otherwise, in scenarios where someone announces a binding on behalf of someone else. I know pieces of software that do that. If we consider this possibility, then the DAD NS is pretty much the only packet that will not carry the LLA, hence the benefit at looking at other packets. Eric > - Christian > > > > On Jun 30, 2009, Eric Levy-Abegnoli wrote: > >> Christian, >> >> there are several alleys where I am proposing something "different", >> hence the confusion that I may have created in the thread. Apologies to >> the wg for that. "Unfortunately", these differences are tight up >> together to some extend, and it's hard for me to extract one piece and >> describe the benefit as if it was standalone (hopefully, if I get a >> chance to present the proposal at ietf75, maybe it become clearer). >> >> To this sepcific point, the reasons why I was proposing to look at other >> ND packets are of two folds: >> >> - use them to maintain most accurate/up-to-date "state" of the binding >> entries, to make more accurate decisions (in case DAD was not seen, for >> movement, to poll entry owners, etc.) >> >> - to exploit the content of the binding information provided in these ND >> packets, in particular the LLA. >> >> From a switch standpoint, I don't see much extra difficulty or burden to >> look at all NDP packets rather than "just" the DAD. >> >> Eric > > > > From christian.vogt@ericsson.com Wed Jul 1 17:29:13 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1CCB53A691B for ; Wed, 1 Jul 2009 17:29:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.545 X-Spam-Level: X-Spam-Status: No, score=-6.545 tagged_above=-999 required=5 tests=[AWL=0.054, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3EiLRpbFYzkl for ; Wed, 1 Jul 2009 17:29:12 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id 040A928C0D9 for ; Wed, 1 Jul 2009 17:29:09 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n620TUpG008908; Wed, 1 Jul 2009 19:29:30 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.53]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 1 Jul 2009 19:28:38 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 1 Jul 2009 19:28:37 -0500 Message-Id: <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> From: Christian Vogt To: Eric Levy-Abegnoli In-Reply-To: <4A4B87B2.1030105@cisco.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 1 Jul 2009 17:28:40 -0700 References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 02 Jul 2009 00:28:37.0966 (UTC) FILETIME=[0AD28EE0:01C9FAAC] Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 00:29:13 -0000 Hi Eric - Thank you for the detailed response. And yet, I am still unconvinced of the usefulness of snooping all ND packets, but no data packets, compared to snooping all packets, including data packets. In particular, I don't see why the extra information in the payload of ND packets may be of use for SAVI. > 1) The most obvious reason was mentionned previously: DAD packets can > get lost (low probability), not being sent (higher probability), or > simply not seen in multiple switch scenario. The latter may have not > been discussed, but a very common situation is a switch (make it savi) > connected to a bunch of Access Points (you can see them as dumb L2 > switches). APs comes up, end-nodes comes up, then the savi-switch > comes > up. All DAD are missed. Snooping at other NDP packets will increase > the > chances to discover end-nodes. It's not guaranteed, but it is better. Sure, but snooping all packets, including data packets, achieves the same, doesn't it? > 2) Another benefit of looking at other packets would be the > capability > to keep a "reachabilty" state of end-nodes. In fcfs, it is proposed > to > "ND ping" the binding owner to verify wether it is still there (or > rather, that is is gone) when receiving a binding from a different > port. > I see some issues with that, including a potential attack. If we can > have a more accurate state of the binding entry, based on information > snooped in other ND packets (DAD only happens once, at the beginning), > we can save or at least reduce the need for these ping messages. You are saying that snooping all ND packets would indicate binding liveness in a manner (a) more frequent and (b) more secure than just snooping DAD packets. I agree with (a). But (a) is also achieved by snooping all packets, including data packets. (b), in turn, requires further explanation. I don't see why snooping ND packets would, in the general case, be more secure than snooping all packets. Or are you perhaps referring to the specific case where SAVI is used in SEND-enabled networks? > 3) Last but not least, other NDP messages carry LLA options. I like to > think that the mac used in binding records should come from there, > rather than from the L2, and that is is an option to verify that the > two > match. I feel like we might be in trouble otherwise, in scenarios > where > someone announces a binding on behalf of someone else. I know pieces > of > software that do that. If we consider this possibility, then the DAD > NS > is pretty much the only packet that will not carry the LLA, hence the > benefit at looking at other packets. I see only one advantage of the Link Layer Address option in ND packets, and this advantage does not apply to SAVI. The Link Layer Address option was introduced to ND as a link-layer-independent means to communicate addresses of different link layers. However, in the case of SAVI, link layer independence is of limited usefulness. After all, SAVI will be implemented in link layer devices, for use with only a single type of link layer. Do you agree? - Christian From jmh@joelhalpern.com Wed Jul 1 18:16:08 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A92D03A6824 for ; Wed, 1 Jul 2009 18:16:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.518 X-Spam-Level: X-Spam-Status: No, score=-3.518 tagged_above=-999 required=5 tests=[AWL=0.081, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wjC0va1Q-YKy for ; Wed, 1 Jul 2009 18:16:07 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id B9DE33A67A3 for ; Wed, 1 Jul 2009 18:16:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 12D1B4305DE; Wed, 1 Jul 2009 18:16:30 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-172.clppva.btas.verizon.net [71.161.52.172]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id DEB684305D2; Wed, 1 Jul 2009 18:16:28 -0700 (PDT) Message-ID: <4A4C0A68.4020504@joelhalpern.com> Date: Wed, 01 Jul 2009 21:16:24 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> In-Reply-To: <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 01:16:08 -0000 It depends upon what one assumes, I think. For example, I have tended to pick on SEND. If one assumes SEND, DAD packets may still be lost. But secured Neighbor Solicitation Request / Responses must occur. So snooping those would give you a reliable method of establishing appropriate bindings. If the switches enforced that the MAC / IP address pair appeared only on the correct port, based on this observation, we would have achieved a goal that some people consider important. In some sense, this is very similar to snooping the DHCP packets, which is another mechanisms for getting these things. Of course, whether this is useful by itself depends upon what threat we are interested in. If we are only interested in preventing imposture, that may be sufficient. On the other hand, some folks have asked for accountability, so that any packet stream on the Internet can be correctly associated with the machine that sourced it. That probably requires additional mechanisms, such as syslog recording or DHCP logs. Some folks find those mechanisms to be onnerous, while others consider them reasonable and necessary. Whether we need them depends upon what threat we want to counter. Yours, Joel M. Halpern Christian Vogt wrote: > Hi Eric - > > Thank you for the detailed response. And yet, I am still unconvinced of > the usefulness of snooping all ND packets, but no data packets, compared > to snooping all packets, including data packets. In particular, I don't > see why the extra information in the payload of ND packets may be of use > for SAVI. > >> 1) The most obvious reason was mentionned previously: DAD packets can >> get lost (low probability), not being sent (higher probability), or >> simply not seen in multiple switch scenario. The latter may have not >> been discussed, but a very common situation is a switch (make it savi) >> connected to a bunch of Access Points (you can see them as dumb L2 >> switches). APs comes up, end-nodes comes up, then the savi-switch comes >> up. All DAD are missed. Snooping at other NDP packets will increase the >> chances to discover end-nodes. It's not guaranteed, but it is better. > > Sure, but snooping all packets, including data packets, achieves the > same, doesn't it? > >> 2) Another benefit of looking at other packets would be the capability >> to keep a "reachabilty" state of end-nodes. In fcfs, it is proposed to >> "ND ping" the binding owner to verify wether it is still there (or >> rather, that is is gone) when receiving a binding from a different port. >> I see some issues with that, including a potential attack. If we can >> have a more accurate state of the binding entry, based on information >> snooped in other ND packets (DAD only happens once, at the beginning), >> we can save or at least reduce the need for these ping messages. > > You are saying that snooping all ND packets would indicate binding > liveness in a manner (a) more frequent and (b) more secure than just > snooping DAD packets. I agree with (a). But (a) is also achieved by > snooping all packets, including data packets. (b), in turn, requires > further explanation. I don't see why snooping ND packets would, in the > general case, be more secure than snooping all packets. Or are you > perhaps referring to the specific case where SAVI is used in > SEND-enabled networks? > >> 3) Last but not least, other NDP messages carry LLA options. I like to >> think that the mac used in binding records should come from there, >> rather than from the L2, and that is is an option to verify that the two >> match. I feel like we might be in trouble otherwise, in scenarios where >> someone announces a binding on behalf of someone else. I know pieces of >> software that do that. If we consider this possibility, then the DAD NS >> is pretty much the only packet that will not carry the LLA, hence the >> benefit at looking at other packets. > > I see only one advantage of the Link Layer Address option in ND packets, > and this advantage does not apply to SAVI. The Link Layer Address > option was introduced to ND as a link-layer-independent means to > communicate addresses of different link layers. However, in the case of > SAVI, link layer independence is of limited usefulness. After all, SAVI > will be implemented in link layer devices, for use with only a single > type of link layer. Do you agree? > > - Christian > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From christian.vogt@ericsson.com Wed Jul 1 19:23:22 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 47CDB3A68AF for ; Wed, 1 Jul 2009 19:23:22 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.546 X-Spam-Level: X-Spam-Status: No, score=-6.546 tagged_above=-999 required=5 tests=[AWL=0.053, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dSFnx90BdIU8 for ; Wed, 1 Jul 2009 19:23:21 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id 5DCE83A67A3 for ; Wed, 1 Jul 2009 19:23:21 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n622NTDI016561; Wed, 1 Jul 2009 21:23:42 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.53]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 1 Jul 2009 21:22:27 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 1 Jul 2009 21:22:27 -0500 Message-Id: From: Christian Vogt To: "Joel M. Halpern" In-Reply-To: <4A4C0A68.4020504@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 1 Jul 2009 19:22:29 -0700 References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 02 Jul 2009 02:22:27.0113 (UTC) FILETIME=[F14FB190:01C9FABB] Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 02:23:22 -0000 Joel - > It depends upon what one assumes, I think. For example, I have > tended to > pick on SEND. If one assumes SEND, DAD packets may still be lost. But > secured Neighbor Solicitation Request / Responses must occur. So > snooping those would give you a reliable method of establishing > appropriate bindings. If the switches enforced that the MAC/IP > address > pair appeared only on the correct port, based on this observation, we > would have achieved a goal that some people consider important. Yes, in networks that use SEND, monitoring or using ND packets other than DAD packets may be useful. Hence my question to Eric whether he considers his ideas to be specific to SEND-capable networks. In that case, though, one would have to evaluate how much room for improvement there is for our existing SEND-based SAVI solution. Our existing SEND-based SAVI solution already makes extended use of ND packets. > On the other hand, some folks have asked for accountability, so that > any > packet stream on the Internet can be correctly associated with the > machine that sourced it. That probably requires additional > mechanisms, > such as syslog recording or DHCP logs. Some folks find those > mechanisms > to be onnerous, while others consider them reasonable and necessary. > Whether we need them depends upon what threat we want to counter. Our current discussion on the protection of unused addresses is based on the underlying question of whether we want to, and can with reasonable complexity, prevent attackers from hiding their identity or location. Hiding one's identity or location is a common motivation for attackers to spoof their IP source address, by hijacking an address that may be unused. Would you say that logging potential attempts to hijack an unused address would be useful in combatting those attackers? If we could agree to log, but not discard, packets with unknown source addresses in scenarios where (non-SEND) SLAAC is in use, and to discard those packets in SEND-capable or DHCP-only networks, then we would be a big step further: Such an agreement would be in line with the previous observation [1] that the benefit/cost ratio for discarding those packets is significantly lower in networks that use SLAAC than it is in SEND-capable or DHCP-only networks. - Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From jmh@joelhalpern.com Wed Jul 1 19:42:11 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A7133A69E8 for ; Wed, 1 Jul 2009 19:42:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.52 X-Spam-Level: X-Spam-Status: No, score=-3.52 tagged_above=-999 required=5 tests=[AWL=0.079, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id St0JQzw8ujaZ for ; Wed, 1 Jul 2009 19:42:10 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id A30443A6828 for ; Wed, 1 Jul 2009 19:42:10 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 4630F4305EB; Wed, 1 Jul 2009 19:42:33 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-172.clppva.btas.verizon.net [71.161.52.172]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 3F1754305E8; Wed, 1 Jul 2009 19:42:32 -0700 (PDT) Message-ID: <4A4C1E94.8020104@joelhalpern.com> Date: Wed, 01 Jul 2009 22:42:28 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 02:42:11 -0000 Comments on the unused address issue below. I will take it as given for this discussion that we are trying to investigate the possibility of protecting unused addresses without SEND and without DHCP. (If you have either one, you permit only packets with assigned addresses, and some system logs the bindings.) I will also assume that the goal is to correctly attribute Internet problems to the machine which sent caused them. Christian Vogt wrote: ... > Our current discussion on the protection of unused addresses is based on > the underlying question of whether we want to, and can with reasonable > complexity, prevent attackers from hiding their identity or location. > Hiding one's identity or location is a common motivation for attackers > to spoof their IP source address, by hijacking an address that may be > unused. Would you say that logging potential attempts to hijack an > unused address would be useful in combatting those attackers? > > If we could agree to log, but not discard, packets with unknown source > addresses in scenarios where (non-SEND) SLAAC is in use, and to discard > those packets in SEND-capable or DHCP-only networks, then we would be a > big step further: Such an agreement would be in line with the previous > observation [1] that the benefit/cost ratio for discarding those packets > is significantly lower in networks that use SLAAC than it is in > SEND-capable or DHCP-only networks. Whether such "logging" is sufficient probably depends upon both what threat we want to deal with, in what topology, and what degree of logging we are prepared to require. First, we have to assume no wireless, since otherwise we have no idea what machine is actually using the SLAAC. Then, while I have no trouble with the notion of DHCP servers or routers generating syslog entries to syslog servers to record binding creations, it seems that this would require more extensive logging. The immediate port which is connected to the single machine would need to create log entries every time that machine used a new IP address. (This is why I assumed no wireless.) If we are willing to require a topology where there are Savi-sensitive switches at every leaf, and that they have that kind of logging, then we would have a proposal to evaluate. (Thus, the question of "logging" depends very heavily upon the questions of "who" and "where", coupled to "in what sort of network?") (Rant about other threats removed, as this was a specific question.) Yours, Joel From marcelo@it.uc3m.es Thu Jul 2 01:24:16 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E21F13A6D29 for ; Thu, 2 Jul 2009 01:24:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.533 X-Spam-Level: X-Spam-Status: No, score=-6.533 tagged_above=-999 required=5 tests=[AWL=0.066, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fyasi54+-mgd for ; Thu, 2 Jul 2009 01:24:16 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id BF4833A6A9D for ; Thu, 2 Jul 2009 01:24:15 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp01.uc3m.es (Postfix) with ESMTP id 7676CBA4A59; Thu, 2 Jul 2009 10:24:35 +0200 (CEST) Message-ID: <4A4C6EC3.4070906@it.uc3m.es> Date: Thu, 02 Jul 2009 10:24:35 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> In-Reply-To: <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16738.004 Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 08:24:17 -0000 catching up... Christian Vogt escribió: > On Jun 15, 2009, Guang and Marcelo wrote: > >>> Local bindings always are part of all the bindings in the network, >>> because bindings are set up through DAD snooping, and DAD NS is a group >>> cast message, not broad cast. Thus, attackers can still spoof the >>> address of another host as long as it is not bound on the savi device >>> along the packet path. >> >> right, but we can change that. I mean, we could simply require that SAVI >> devices snoop all MLD messages and that DAD packets are forwarded to all >> SAVI devices irrespectively whether there any host subscribed tot he >> particular solicited node mcast group on that particular SAVI device. >> That would essentially imply that all SAVI devices receive all DAD msgs. >> Would that solve the problem? > > > Do we really have to forward all DAD solicitations to solve the problem? > Is there a problem to begin with? I don't see why lack of a binding in > a SAVI device would help an attacker hijacking an address. > > After all, a SAVI binding can only be created with a DAD solicitation > that receives no response. So even if a SAVI device did not see the DAD > solicitation of the legitimate address owner, it will see the DAD > response of the legitimate address owner in case an attacker is trying to > hijack that owner's address. > but, the problem is that if the DAD is not seen by all SAVI devices and we are only filtering those addresses that do have a binding, then the solution is more weak. I mean, suppose that we have a host A connected to SAVI device SA. host A performs DAD and the DAD NSOL only reaches SAVI device SA and does not reach SB. this implies that any node connected to savi device SB can send packets with the source address of host A and this is really not so great So, i think that in order for a solution that only drops packets where a binding exists, then we need to make sure that the binding exists in most of the cases. I would be ok to let pass packets in case the DAD msg was lost, but if by design the DAD will not reach all SAVI devices, i think the solution is not providing much protection So bottom line. In order for me, a solution that may be acceptable is one that: - creates binding based on DAD - distributes the DAD msg to all SAVI devices - in case there is binding and the source address of the packet does not match the L2 anchor, drops the pakcet - in case there is no binding for a data packet, it lets the packet through Of course, the crux of the problem is how to make sure that the DAD msg is delivered to all SAVI devices and this is far from granted. Regards, marcelo > - Christian > > > > From marcelo@it.uc3m.es Thu Jul 2 01:33:36 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04B573A69B1 for ; Thu, 2 Jul 2009 01:33:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.535 X-Spam-Level: X-Spam-Status: No, score=-6.535 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4WcXQyBpCxvA for ; Thu, 2 Jul 2009 01:33:35 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 4595A3A69EA for ; Thu, 2 Jul 2009 01:33:32 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp01.uc3m.es (Postfix) with ESMTP id 25EA7BA4B15; Thu, 2 Jul 2009 10:33:52 +0200 (CEST) Message-ID: <4A4C70EF.7010501@it.uc3m.es> Date: Thu, 02 Jul 2009 10:33:51 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Fred Baker References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <2EC11997-A958-4639-A661-79FFA977ABC1@cisco.com> In-Reply-To: <2EC11997-A958-4639-A661-79FFA977ABC1@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16738.004 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 08:33:36 -0000 catching up... Fred Baker escribió: > I remain of the opinion that a switch is able to prevent its own > clients from using addresses they have not been assigned, the problem here is how to define that the address has been assigned to a host. It is clear in the case of DHCP, but it is far from obvious in the case of stateless address autoconf. Basically, i don't think you can assume that if the SAVI has not seen the DAD packet, then the source address has not been legitimate assigned to the host. DAD is inherently not reliable and if the DAD packet is lost, the DAD procedure is succesful from the host perspective (As opposed to the dhcp case, where, the protocol is reliable and if the packet is lost, the assignment is not succesful from the host perspective) So, i don't think it is acceptable for SAVI to block a host that is using a source address for which the DAD msg was lost. > and that this is sufficient for a network of SAVI devices. The costs > of a switch escalate if it has to have memory for devices that are not > its clients, meaning that SAVI is unlikely to get market traction in > this very cost-sensitive market if we force the switches to have large > memories. so, what do you think is a reasonable size of the memory? > > the primary argument for a binding protocol is that there might be > some non-savi devices in the network. there are several reasons why you may end up needed one. I think one reason is that this one way of dealing with packets that contain a legitmate source address and the DAD packet was lost. There maybe other ways of dealing with this > I think the simpler solution is to tell people that they don't get the > benefits of SAVI in that environment. so, what type of topology constraints do you suggest? regards, marcelo > > On Jun 23, 2009, at 4:44 PM, Christian Vogt wrote: > >> On Jun 15, 2009, Guang and Marcelo wrote: >> >>>> Local bindings always are part of all the bindings in the network, >>>> because bindings are set up through DAD snooping, and DAD NS is a >>>> group >>>> cast message, not broad cast. Thus, attackers can still spoof the >>>> address of another host as long as it is not bound on the savi device >>>> along the packet path. >>> >>> right, but we can change that. I mean, we could simply require that >>> SAVI >>> devices snoop all MLD messages and that DAD packets are forwarded to >>> all >>> SAVI devices irrespectively whether there any host subscribed tot he >>> particular solicited node mcast group on that particular SAVI device. >>> That would essentially imply that all SAVI devices receive all DAD >>> msgs. >>> Would that solve the problem? >> >> >> Do we really have to forward all DAD solicitations to solve the problem? >> Is there a problem to begin with? I don't see why lack of a binding in >> a SAVI device would help an attacker hijacking an address. >> >> After all, a SAVI binding can only be created with a DAD solicitation >> that receives no response. So even if a SAVI device did not see the DAD >> solicitation of the legitimate address owner, it will see the DAD >> response of the legitimate address owner in case an attacker is >> trying to >> hijack that owner's address. >> >> - Christian >> >> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi > > From marcelo@it.uc3m.es Thu Jul 2 01:39:28 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 75F7028C0E1 for ; Thu, 2 Jul 2009 01:39:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.536 X-Spam-Level: X-Spam-Status: No, score=-6.536 tagged_above=-999 required=5 tests=[AWL=0.063, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Lm+jJh5B0Z3Y for ; Thu, 2 Jul 2009 01:39:27 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 395493A6AB1 for ; Thu, 2 Jul 2009 01:39:27 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp01.uc3m.es (Postfix) with ESMTP id A3F1AB48307; Thu, 2 Jul 2009 10:39:47 +0200 (CEST) Message-ID: <4A4C7253.10207@it.uc3m.es> Date: Thu, 02 Jul 2009 10:39:47 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Fred Baker References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <3973B2C2-CEFA-48D1-A0FE-B27FB0B0C1CD@ericsson.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16738.004 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 08:39:28 -0000 Fred Baker escribió: > > On Jun 23, 2009, at 4:41 PM, Christian Vogt wrote: > >> It is true that Marcelo's proposed FCFS variant does not protect unused >> addresses. It only protects addresses being used by a link neighbor. >> But don't you think this alone is attractive? > > no, not at all. > > On a given /64 LAN, there are O(2^64) potential addresses that are not > being used. The 5 or 8 or 24 or maybe 4096 that are being used are nil > by comparison. The objective is not only to prevent hosts from > spoofing each other, but to provide a BCP 38 solution that forces them > to in fact use addresses they are supposed to be using. > > SAVI without protecting unused addresses is pointless. So basically, what you are suggesting is to hardcode that if the SAVI device has not seen a DAD NSOL, then the address is not being used and then no packets with that soruce address can be forwarded, correct? I think there are two problems with that: - First, that the DAD packet can be lost, so the host has actually legimtate use of the address, but the SAVI device has not seen the DAD packet. So, such approach would block legitmate users - Second, i am not sure how much guarantee this DAD procedure provides. I mean, if an attakcer wants to use an address that nobody else is using, it just sends the DAD apcket and then sends the data packet. The DAD procedure only protects from not using duplicate address i.e. not for protecting unused address, but for protecting from using addresses that are already in use by a neighbour. Regards, marcelo > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From marcelo@it.uc3m.es Thu Jul 2 02:56:56 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2B56D3A6B33 for ; Thu, 2 Jul 2009 02:56:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[AWL=0.062, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nnoTkAIqgdKy for ; Thu, 2 Jul 2009 02:56:55 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id DFEC73A6A9E for ; Thu, 2 Jul 2009 02:56:54 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp02.uc3m.es (Postfix) with ESMTP id C5DFB65A19F; Thu, 2 Jul 2009 11:57:14 +0200 (CEST) Message-ID: <4A4C847A.8020509@it.uc3m.es> Date: Thu, 02 Jul 2009 11:57:14 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <2EC11997-A958-4639-A661-79FFA977ABC1@cisco.com> <6026EA38-2F5B-4C51-9B9D-6139EBE10F71@ericsson.com> In-Reply-To: <6026EA38-2F5B-4C51-9B9D-6139EBE10F71@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16738.004 Cc: Guang Yao , SAVI Mailing List Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 09:56:56 -0000 Christian Vogt escribió: > On Jun 23, 2009, Fred Baker wrote: > >> I remain of the opinion that a switch is able to prevent its own clients >> from using addresses they have not been assigned, and that this is >> sufficient for a network of SAVI devices. The costs of a switch escalate >> if it has to have memory for devices that are not its clients, meaning >> that SAVI is unlikely to get market traction in this very cost-sensitive >> market if we force the switches to have large memories. > > Fred - > > The FCFS variant we are considering exactly addresses your concern: > Since lack of a binding cannot lead to false packet drops, bindings do > not have to be explicitly copied across SAVI devices. mmm, but this would imply that the protection is very low, right? I mean, in this case, a given source addressmay have a binding in one savi device and not in other, so the source address is not protected in that SAVI device.... So, i think it is ok not to protect unused addresses (i fail to see how we could do this without reading much more into DAD that what it was originally designed for), so, i am ok to not protect a source address for which the original DAD was lost, since i see this as a rare event. However, if the solution does not protect addresses for which the DAD apcket have not been lost, i am not sure we are providing a reasonable level of protection. So, what i am trying to say, is that if we go this way, we must make sure that the DAD is distributed as much as possible including all SAVI devices and this will imply that all SAVI devices will contain all the source addresses in the link > This reduces > memory requirements. In particular, bindings for a given address are > only created in SAVI devices on the path of the corresponding DAD > solicitation or DHCP address assignment. The number of bindings for a > given address can be reduced further by manually disabling SAVI > protection on large port trunks. > >> the primary argument for a binding protocol is that there might be some >> non-savi devices in the network. I think the simpler solution is to tell >> people that they don't get the benefits of SAVI in that environment. > > FWIW: The main argument is actually the prevention of false packet > drops. right > This affects SAVI solutions that drop packets in the absence of > a binding. A dedicated binding protocol can then ensure that the > necessary bindings are in place, hence avoiding false packet drops. > right Regards, marcelo > Since Marcelo's proposed FCFS variant does NOT drop packets in the > absence of a binding, I don't see the need for a dedicated binding > protocol. This is what I am explaining in my message below. > > - Christian > > > > On Jun 23, 2009, Christian Vogt wrote: > >>>> Local bindings always are part of all the bindings in the network, >>>> because bindings are set up through DAD snooping, and DAD NS is a >>>> group >>>> cast message, not broad cast. Thus, attackers can still spoof the >>>> address of another host as long as it is not bound on the savi device >>>> along the packet path. >>>> >>>> right, but we can change that. I mean, we could simply require that >>>> SAVI >>>> devices snoop all MLD messages and that DAD packets are forwarded >>>> to all >>>> SAVI devices irrespectively whether there any host subscribed tot he >>>> particular solicited node mcast group on that particular SAVI device. >>>> That would essentially imply that all SAVI devices receive all DAD >>>> msgs. >>>> Would that solve the problem? >>> >>> >>> Do we really have to forward all DAD solicitations to solve the >>> problem? >>> Is there a problem to begin with? I don't see why lack of a binding in >>> a SAVI device would help an attacker hijacking an address. >>> >>> After all, a SAVI binding can only be created with a DAD solicitation >>> that receives no response. So even if a SAVI device did not see the >>> DAD >>> solicitation of the legitimate address owner, it will see the DAD >>> response of the legitimate address owner in case an attacker is trying >>> to hijack that owner's address. >>> >>> - Christian > > > > From marcelo@it.uc3m.es Thu Jul 2 03:02:46 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 88BF23A6BC9 for ; Thu, 2 Jul 2009 03:02:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.538 X-Spam-Level: X-Spam-Status: No, score=-6.538 tagged_above=-999 required=5 tests=[AWL=0.061, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IYNq1sE883+w for ; Thu, 2 Jul 2009 03:02:45 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 92BFF3A6B9B for ; Thu, 2 Jul 2009 03:02:45 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp01.uc3m.es (Postfix) with ESMTP id 0E6E7BA69D5; Thu, 2 Jul 2009 12:03:05 +0200 (CEST) Message-ID: <4A4C85D9.3020703@it.uc3m.es> Date: Thu, 02 Jul 2009 12:03:05 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Frank Xia References: <4A2C0DFB.3040803@it.uc3m.es> <00e301c9edcf$c7cc7bd0$3e0c7c0a@china.huawei.com> <4A36706D.9050501@it.uc3m.es> <001901c9edda$ff5bceb0$3e0c7c0a@china.huawei.com> <4ECD61DE-172E-486D-A9DC-948DB322D565@ericsson.com> <00c401c9f477$360829c0$3e0c7c0a@china.huawei.com> In-Reply-To: <00c401c9f477$360829c0$3e0c7c0a@china.huawei.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16738.004 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 10:02:46 -0000 Frank Xia escribió: > Hi Christian > > Yes. > > My another observation is that people only talk about > DAD defined in RFC4862 while ignoring Optimistic DAD defined in > RFC4429 which > let go data traffic preceding control message mmm, maybe i am confused, but in optimistc DAD what changes is that the node does not wait for 1 sec before sending data apcket with the soruce address, but it is still sending the DAD NSOL prior sending data packets, right? So, i mean, the SAVI device would still first see the DAD NSOL and then right away a data packet. So, in that case, we could create the optimistic binding and keep track if there is any DAD NADV as a reply to the original DAD NSOL. Regards, marcelo > > BR > Frank > > ----- Original Message ----- From: "Christian Vogt" > > To: "Frank Xia" > Cc: "SAVI Mailing List" > Sent: Tuesday, June 23, 2009 9:05 PM > Subject: Re: [savi] A different trade off for SAVI > > >> >> On Jun 15, 2009, Frank Xia wrote: >> >>> DAD is NOT a MUST for stateless address configuration. RFC 4862 reads >>> >>> "By default, all addresses should be tested for uniqueness prior to >>> their assignment to an interface for safety. The test should >>> individually be performed on all addresses obtained manually, via >>> stateless address autoconfiguration, or via DHCPv6. To accommodate >>> sites that believe the overhead of performing Duplicate Address >>> Detection outweighs its benefits, the use of Duplicate Address >>> Detection can be disabled through the administrative setting of a >>> per-interface configuration flag." >> >> Isn't this just another reason to forward packets in the absence of a >> binding, rather than discarding them? I see this in support of the >> proposed FCFS variant. >> >> - Christian >> >> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From elevyabe@cisco.com Thu Jul 2 07:03:35 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3FE693A6893 for ; Thu, 2 Jul 2009 07:03:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.343 X-Spam-Level: X-Spam-Status: No, score=-10.343 tagged_above=-999 required=5 tests=[AWL=0.256, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 7dJ5nSt3BJms for ; Thu, 2 Jul 2009 07:03:34 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 78B183A6968 for ; Thu, 2 Jul 2009 07:03:33 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,334,1243814400"; d="scan'208";a="44223952" Received: from ams-dkim-2.cisco.com ([144.254.224.139]) by ams-iport-1.cisco.com with ESMTP; 02 Jul 2009 14:03:55 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id n62E3se9005069; Thu, 2 Jul 2009 16:03:54 +0200 Received: from xbh-ams-331.emea.cisco.com (xbh-ams-331.cisco.com [144.254.231.71]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n62E3tfB011605; Thu, 2 Jul 2009 14:03:55 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-331.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 2 Jul 2009 16:03:54 +0200 Received: from [144.254.53.107] ([144.254.53.107]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 2 Jul 2009 16:03:54 +0200 Message-ID: <4A4CBE4A.2050207@cisco.com> Date: Thu, 02 Jul 2009 16:03:54 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 02 Jul 2009 14:03:54.0672 (UTC) FILETIME=[EF738B00:01C9FB1D] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3179; t=1246543434; x=1247407434; c=relaxed/simple; s=amsdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20A=20different=20trade=20off=20 for=20SAVI |Sender:=20; bh=RQkn+mJPsDK/TIpHmWzMWrmZsG+HfMY+5h+hzlD3Qf0=; b=mS29cScixqVMQSVQtr6JybHrjw140sNDh5572tsIXIUmRQn6He5YztXqXH ro2oU1/ohklWYIhluKDcp5TP4R82/kjNunGBAXZuxPxypxhBX5ZHfVZaxCfI tV2g8mBh7v; Authentication-Results: ams-dkim-2; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim2001 verified; ); Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 14:03:35 -0000 Christian, Christian Vogt a écrit : > Joel - > >> It depends upon what one assumes, I think. For example, I have tended to >> pick on SEND. If one assumes SEND, DAD packets may still be lost. But >> secured Neighbor Solicitation Request / Responses must occur. So >> snooping those would give you a reliable method of establishing >> appropriate bindings. If the switches enforced that the MAC/IP address >> pair appeared only on the correct port, based on this observation, we >> would have achieved a goal that some people consider important. > > Yes, in networks that use SEND, monitoring or using ND packets other > than DAD packets may be useful. Hence my question to Eric whether he > considers his ideas to be specific to SEND-capable networks. In that > case, though, one would have to evaluate how much room for improvement > there is for our existing SEND-based SAVI solution. Our existing > SEND-based SAVI solution already makes extended use of ND packets. > A very realistic deployment scenario for SeND is going to be the one of a mix of SeND and and non-SeND capable devices attached to the same link/switch. In that case, non-SeND capable device are not taking any benefit of SeND, and can be led to trust SeND node bogus bindings. If bindings with SeND credential can be preferred over the one without (in case of collision) - overriding the fist-come algorithm -, then the switch will increase the security for everybody, not just the subset or SeND-capable nodes. So it's not only SEND-capable networks, it's any network with a few (even just one) SeND-capable device. Eric >> On the other hand, some folks have asked for accountability, so that any >> packet stream on the Internet can be correctly associated with the >> machine that sourced it. That probably requires additional mechanisms, >> such as syslog recording or DHCP logs. Some folks find those mechanisms >> to be onnerous, while others consider them reasonable and necessary. >> Whether we need them depends upon what threat we want to counter. > > Our current discussion on the protection of unused addresses is based on > the underlying question of whether we want to, and can with reasonable > complexity, prevent attackers from hiding their identity or location. > Hiding one's identity or location is a common motivation for attackers > to spoof their IP source address, by hijacking an address that may be > unused. Would you say that logging potential attempts to hijack an > unused address would be useful in combatting those attackers? > > If we could agree to log, but not discard, packets with unknown source > addresses in scenarios where (non-SEND) SLAAC is in use, and to discard > those packets in SEND-capable or DHCP-only networks, then we would be a > big step further: Such an agreement would be in line with the previous > observation [1] that the benefit/cost ratio for discarding those packets > is significantly lower in networks that use SLAAC than it is in > SEND-capable or DHCP-only networks. > > - Christian > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html > > > > From elevyabe@cisco.com Thu Jul 2 07:56:05 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 156D228C138 for ; Thu, 2 Jul 2009 07:56:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.369 X-Spam-Level: X-Spam-Status: No, score=-10.369 tagged_above=-999 required=5 tests=[AWL=0.230, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id akp0kNF+opz9 for ; Thu, 2 Jul 2009 07:56:04 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 6A05C3A6D7B for ; Thu, 2 Jul 2009 07:55:42 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,334,1243814400"; d="scan'208";a="44231113" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 02 Jul 2009 14:56:04 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n62Eu3VB010009; Thu, 2 Jul 2009 16:56:03 +0200 Received: from xbh-ams-331.emea.cisco.com (xbh-ams-331.cisco.com [144.254.231.71]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n62Eu3ZD000643; Thu, 2 Jul 2009 14:56:03 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-331.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 2 Jul 2009 16:56:03 +0200 Received: from [144.254.53.107] ([144.254.53.107]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 2 Jul 2009 16:56:03 +0200 Message-ID: <4A4CCA82.4060800@cisco.com> Date: Thu, 02 Jul 2009 16:56:03 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> <4A4CBE4A.2050207@cisco.com> In-Reply-To: <4A4CBE4A.2050207@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 02 Jul 2009 14:56:03.0382 (UTC) FILETIME=[384ECD60:01C9FB25] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3679; t=1246546563; x=1247410563; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20A=20different=20trade=20off=20 for=20SAVI |Sender:=20; bh=oKExQewcEBSpD8p73oeWd59tNZk41pxmvn4EIUbynPQ=; b=DTE5D8XtrdObvoperzIt9585WJ/1xAgBU+axQml1qFJjryY5VYK2Rz3Kdn pocHZKEuZtLvC5uHakKMBIu2qLzdmt9dzPCNl8x3tmW6yjBs1qTZexDtk8g+ ebGqjPE441; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 14:56:05 -0000 Eric Levy-Abegnoli a écrit : > Christian, > Christian Vogt a écrit : >> Joel - >> >>> It depends upon what one assumes, I think. For example, I have >>> tended to >>> pick on SEND. If one assumes SEND, DAD packets may still be lost. But >>> secured Neighbor Solicitation Request / Responses must occur. So >>> snooping those would give you a reliable method of establishing >>> appropriate bindings. If the switches enforced that the MAC/IP address >>> pair appeared only on the correct port, based on this observation, we >>> would have achieved a goal that some people consider important. >> >> Yes, in networks that use SEND, monitoring or using ND packets other >> than DAD packets may be useful. Hence my question to Eric whether he >> considers his ideas to be specific to SEND-capable networks. In that >> case, though, one would have to evaluate how much room for improvement >> there is for our existing SEND-based SAVI solution. Our existing >> SEND-based SAVI solution already makes extended use of ND packets. >> > > A very realistic deployment scenario for SeND is going to be the one > of a mix of SeND and and non-SeND capable devices attached to the same > link/switch. In that case, non-SeND capable device are not taking any > benefit of SeND, and can be led to trust SeND node bogus bindings. I just realized that sentence was very confusing. What I meant is that the non-SeND capable device have no way to prefer the SeND binding over the non-SeND one. So it has some value if the switch does that on its behalf. Eric. > If bindings with SeND credential can be preferred over the one without > (in case of collision) - overriding the fist-come algorithm -, then > the switch will increase the security for everybody, not just the > subset or SeND-capable nodes. > So it's not only SEND-capable networks, it's any network with a few > (even just one) SeND-capable device. > Eric >>> On the other hand, some folks have asked for accountability, so that >>> any >>> packet stream on the Internet can be correctly associated with the >>> machine that sourced it. That probably requires additional mechanisms, >>> such as syslog recording or DHCP logs. Some folks find those >>> mechanisms >>> to be onnerous, while others consider them reasonable and necessary. >>> Whether we need them depends upon what threat we want to counter. >> >> Our current discussion on the protection of unused addresses is based on >> the underlying question of whether we want to, and can with reasonable >> complexity, prevent attackers from hiding their identity or location. >> Hiding one's identity or location is a common motivation for attackers >> to spoof their IP source address, by hijacking an address that may be >> unused. Would you say that logging potential attempts to hijack an >> unused address would be useful in combatting those attackers? >> >> If we could agree to log, but not discard, packets with unknown source >> addresses in scenarios where (non-SEND) SLAAC is in use, and to discard >> those packets in SEND-capable or DHCP-only networks, then we would be a >> big step further: Such an agreement would be in line with the previous >> observation [1] that the benefit/cost ratio for discarding those packets >> is significantly lower in networks that use SLAAC than it is in >> SEND-capable or DHCP-only networks. >> >> - Christian >> >> [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html >> >> >> >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From marcelo@it.uc3m.es Thu Jul 2 10:16:06 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4871D3A6B9E for ; Thu, 2 Jul 2009 10:16:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.54 X-Spam-Level: X-Spam-Status: No, score=-6.54 tagged_above=-999 required=5 tests=[AWL=0.059, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MQrtUHOYWv3l for ; Thu, 2 Jul 2009 10:16:05 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 119F53A6BE1 for ; Thu, 2 Jul 2009 10:15:43 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp01.uc3m.es (Postfix) with ESMTP id 7CF06BA50C6; Thu, 2 Jul 2009 19:16:04 +0200 (CEST) Message-ID: <4A4CEB54.2020303@it.uc3m.es> Date: Thu, 02 Jul 2009 19:16:04 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> In-Reply-To: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16740.000 Cc: SAVI Mailing List Subject: Re: [savi] On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 17:16:06 -0000 Christian, Christian Vogt escribió: > On Jun 23, 2009, Fred Baker wrote on thread "Your opinion on a different > tradeoff for SAVI": > >> SAVI without protecting unused addresses is pointless. > > > Fred and all - > > Protection of unused addresses would, of course, be a useful feature. > But before making this mandatory, we should do a benefit-cost analysis. > Here is one, along with a proposal of how to move forward: > > The benefit of protecting unused addresses is that it prevents an > attacker from hiding its identity or location. i am not sure what do you mean by this... I mean, the attacker will need to use a topologically correct address, since we are asuming ingress filtering then within the prefix, it can use any unused address, if not SAVI will drop it. The only question is whether it shoudl perform a DAD previously doing it or not So, i fail to see what is the concept of protecting unused addresses... > An attacker who wants to > do this can use any source address as long as it is not its own address. > Protecting unused addresses is especially useful in networks where DHCP > is the only permitted method for address configuration, since those > networks are in control of which addresses are used. right, i can see that having value in a dhcp based network > On the other hand, > in networks where Stateless Address Autoconfiguration is permitted, it > is up to the (potentially malicious) hosts which addresses are used. > Protecting unused addresses then has little benefit: All it achieves is > requiring an attacker to formally turn an unused address into a used > address by sending a DAD solicitation. exactly morevoer, it does has a problem, that if the DAD packet gets lost, the host is blocked, even if from the host perspective, the DAD was succesfull > > The cost of protecting unused addresses is a need to coordinate multiple > SAVI devices on the same link. well for me the major (and unacceptable cost) is that we require that the SAVI device sees a DAD before letting the a source address flow what if the DAD packet was lost? from the host perspective, it was succesful, cause there were no replies, but the SAVI device will block it from the network, and only because the DAD packet was lost. It seems hardly a good design to me > If this coordination does not exist, or > is insufficient, legitimate packets may get dropped, because one SAVI > device may consider unused an address that is in fact in use at another > SAVI device. Coordination between SAVI devices, in turn, can be > accomplished in one of two ways: > > - By partitioning the scope of SAVI protection into one area per SAVI > device. This requires manual configuration of SAVI devices, since > switch ports that connect to other SAVI devices must be labeled as > such. Link partitioning is the approach of the CPS solution. > > - By synchronizing binding state across SAVI devices so that each SAVI > device can validate addresses from anywhere else on the link. This > requires an extra binding distribution protocol, plus extra memory > for binding state copied from other SAVI devices. Synchronization > was proposed as an add-on to the original FCFS solution. > > Either form of coordination implies an undesired cost for protecting > unused addresses. Given this cost, and given that the main benefit is > in networks where DHCP is the only permitted address configuration > method, a potential way to move forward may be to make the protection > of unused addresses optional and limited to those DHCP-only networks. i think i can live with that i would like to understand the implications on a dhcp based solution > More specifically, we could add an optional "DHCP-only mode" to SAVI, > in which SAVI devices would permit only those addresses that have been > explicitly assigned via DHCP. In DHCP-only mode, SAVI devices would: > > - Create bindings only based on DHCP address assignments, but not based > on DAD solicitations. > > - Drop packets with unused source addresses. > > As a method for inter-SAVI-device coordination, I suggest partitioning > the scope of SAVI protection. Thus, network administrators who enable > DHCP-only mode may also have to manually designate switch ports that > connect to other SAVI devices. This extra manual configuration should > be acceptable given that the DHCP-only mode already needs to be turned > on manually. At the same time, link partitioning avoids the extra > complexity and manufacturing cost that synchronization would entail. > mmm, i think it may be possible to achieve similar benefits without configuring port per port. I actually think it would be easier to configure a shared secret in every savi device than to manually define device by device which port is used for what function Regards, marcelo > What do folks think? Would this be a reasonable approach? > > - Christian > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From marcelo@it.uc3m.es Thu Jul 2 10:21:37 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 87DFB3A6A59 for ; Thu, 2 Jul 2009 10:21:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.541 X-Spam-Level: X-Spam-Status: No, score=-6.541 tagged_above=-999 required=5 tests=[AWL=0.058, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KiRsEbydKknt for ; Thu, 2 Jul 2009 10:21:36 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 8BFDC3A6B56 for ; Thu, 2 Jul 2009 10:20:25 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp02.uc3m.es (Postfix) with ESMTP id 3BBA26C1214; Thu, 2 Jul 2009 19:20:33 +0200 (CEST) Message-ID: <4A4CEC60.2010600@it.uc3m.es> Date: Thu, 02 Jul 2009 19:20:32 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16740.000 Cc: SAVI Mailing List Subject: Re: [savi] More Opinions, Please - On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 17:21:37 -0000 Christian Vogt escribió: > Folks - > > I would like to solicit more feedback on the benefit-cost analysis > (below) for protecting unused addresses. How valuable do people consider > protection of unused addresses, how much cost do they think is OK? Is > there something that the analysis overlooks? We already got several > very useful comments from a few people. What do the others think? > > To recap: We need to decide between the following three options of > dealing with unused addresses: > i think you need to define what is an unused address In dhcp, it is clear and i think it makes sense In statelsss address autconfiguration, it means an address for which the savi device has not seen a DAD? If so, i think the definition is broken, cause the address can be legitmatelly assigned to a host but still fulfill the definition of unused. > - Not protect unused addresses, i.e., forward packets without a binding. > Logging is still possible, though. > > - Protect unused addresses, and coordinate SAVI devices on the same link > by manually disabling SAVI protection on ports connecting to other > SAVI devices. > > - Protect unused addresses, and coordinate SAVI devices on the same link > with a dedicated binding synchronization protocol. > I personally don't think it is feasible to define what an unused address is from the SAVI perspective. I don't agree with the definition of an address being unused if there was no DAD before as seen by the SAVI device. So i think the SAVI device has no means to figure out if an address is legitiamlly used or not in the case stateless addres autoconf is being used About the other options, i don't know.... > Please send your feedback by Sunday, July 5. We will vote after that. > > - Christian > > > > On Jun 24, 2009, Christian Vogt wrote: > >> On Jun 23, 2009, Fred Baker wrote on thread "Your opinion on a different >> tradeoff for SAVI": >> >>> SAVI without protecting unused addresses is pointless. >> >> >> Fred and all - >> >> Protection of unused addresses would, of course, be a useful feature. >> But before making this mandatory, we should do a benefit-cost analysis. >> Here is one, along with a proposal of how to move forward: >> >> The benefit of protecting unused addresses is that it prevents an >> attacker from hiding its identity or location. An attacker who wants to >> do this can use any source address as long as it is not its own address. >> Protecting unused addresses is especially useful in networks where DHCP >> is the only permitted method for address configuration, since those >> networks are in control of which addresses are used. On the other hand, >> in networks where Stateless Address Autoconfiguration is permitted, it >> is up to the (potentially malicious) hosts which addresses are used. >> Protecting unused addresses then has little benefit: All it achieves is >> requiring an attacker to formally turn an unused address into a used >> address by sending a DAD solicitation. >> >> The cost of protecting unused addresses is a need to coordinate multiple >> SAVI devices on the same link. If this coordination does not exist, or >> is insufficient, legitimate packets may get dropped, because one SAVI >> device may consider unused an address that is in fact in use at another >> SAVI device. Coordination between SAVI devices, in turn, can be >> accomplished in one of two ways: >> >> - By partitioning the scope of SAVI protection into one area per SAVI >> device. This requires manual configuration of SAVI devices, since >> switch ports that connect to other SAVI devices must be labeled as >> such. Link partitioning is the approach of the CPS solution. >> >> - By synchronizing binding state across SAVI devices so that each SAVI >> device can validate addresses from anywhere else on the link. This >> requires an extra binding distribution protocol, plus extra memory >> for binding state copied from other SAVI devices. Synchronization >> was proposed as an add-on to the original FCFS solution. >> >> Either form of coordination implies an undesired cost for protecting >> unused addresses. Given this cost, and given that the main benefit is >> in networks where DHCP is the only permitted address configuration >> method, a potential way to move forward may be to make the protection >> of unused addresses optional and limited to those DHCP-only networks. >> More specifically, we could add an optional "DHCP-only mode" to SAVI, >> in which SAVI devices would permit only those addresses that have been >> explicitly assigned via DHCP. In DHCP-only mode, SAVI devices would: >> >> - Create bindings only based on DHCP address assignments, but not based >> on DAD solicitations. >> >> - Drop packets with unused source addresses. >> >> As a method for inter-SAVI-device coordination, I suggest partitioning >> the scope of SAVI protection. Thus, network administrators who enable >> DHCP-only mode may also have to manually designate switch ports that >> connect to other SAVI devices. This extra manual configuration should >> be acceptable given that the DHCP-only mode already needs to be turned >> on manually. At the same time, link partitioning avoids the extra >> complexity and manufacturing cost that synchronization would entail. >> >> What do folks think? Would this be a reasonable approach? >> >> - Christian > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From marcelo@it.uc3m.es Thu Jul 2 11:19:57 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D71CC28C26D for ; Thu, 2 Jul 2009 11:19:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.543 X-Spam-Level: X-Spam-Status: No, score=-6.543 tagged_above=-999 required=5 tests=[AWL=0.056, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0q3JjpV-dk6k for ; Thu, 2 Jul 2009 11:19:56 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 7237A28C270 for ; Thu, 2 Jul 2009 11:19:56 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp02.uc3m.es (Postfix) with ESMTP id 47941655168; Thu, 2 Jul 2009 19:22:19 +0200 (CEST) Message-ID: <4A4CECCA.1060003@it.uc3m.es> Date: Thu, 02 Jul 2009 19:22:18 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: "Joel M. Halpern" References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A49500B.6000702@joelhalpern.com> In-Reply-To: <4A49500B.6000702@joelhalpern.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16740.000 Cc: SAVI Mailing List Subject: Re: [savi] More Opinions, Please - On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 18:19:57 -0000 Joel M. Halpern escribió: > While I appreciate Christian's question, I think that this is part of > a larger pair of questions that we talk around, but do not address. > > 1) What threats are we actually trying to protect against. The > threats draft talks about general internet threats and the need to be > able to track them back. But it is not particularly clear about what > behavioral threats we are actually concerned with stopping in SAVI > - Are we concerned with ensure that every packet leaving a site can be > reliably tracked back to a human being > - Are we concerned with preventing one device within a site from > masquerading as another device, either at the IP or MAC layer. > > 2) What tools do we want to require or prohibit. While we probably do > not want to mandate a single tool set, without mandating something we > get nowhere. Possibilities include > - restricting mobility (with or without session continuity) > - Requiring MAC or IP authentication (*02.1X, SEND, ...) > - Requiring central management of addressing and bindings > > No, those are not all the alternatives. As far as I can tell from > watching this list, there are folks who take as given the need for > almost any subset of these and related constraints you can imagine. > Unless we pick, explicitly, we will continue to argue in circles. i agree with this i guess that now that we understnad the problem space a bit better, e could try to define more precisely what are the requirements for a solution Regards, marcelo > > For example, the question of controlling unregistered addresses turns > on assumptions about what threats we are addressing, and assumptions > about address allocation that mean that "unregistered" is a meaningful > condition. I don't object to that particular pair, but it is really > hard to discuss the acceptability of answers without agreeing on the > questions. > > Yours, > Joel M. Halpern > > Christian Vogt wrote: >> Folks - >> >> I would like to solicit more feedback on the benefit-cost analysis >> (below) for protecting unused addresses. How valuable do people consider >> protection of unused addresses, how much cost do they think is OK? Is >> there something that the analysis overlooks? We already got several >> very useful comments from a few people. What do the others think? >> >> To recap: We need to decide between the following three options of >> dealing with unused addresses: >> >> - Not protect unused addresses, i.e., forward packets without a binding. >> Logging is still possible, though. >> >> - Protect unused addresses, and coordinate SAVI devices on the same link >> by manually disabling SAVI protection on ports connecting to other >> SAVI devices. >> >> - Protect unused addresses, and coordinate SAVI devices on the same link >> with a dedicated binding synchronization protocol. >> >> Please send your feedback by Sunday, July 5. We will vote after that. >> >> - Christian > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From xiayangsong@huawei.com Thu Jul 2 12:12:48 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E0893A6DAF for ; Thu, 2 Jul 2009 12:12:48 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.599 X-Spam-Level: X-Spam-Status: No, score=-0.599 tagged_above=-999 required=5 tests=[AWL=-0.104, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id f+-Xd4ZA50Og for ; Thu, 2 Jul 2009 12:12:47 -0700 (PDT) Received: from szxga01-in.huawei.com (unknown [119.145.14.64]) by core3.amsl.com (Postfix) with ESMTP id 2EC8F3A6DA5 for ; Thu, 2 Jul 2009 12:12:47 -0700 (PDT) Received: from huawei.com (szxga01-in [172.24.2.3]) by szxga01-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KM600CLA5DNF1@szxga01-in.huawei.com> for savi@ietf.org; Fri, 03 Jul 2009 03:12:59 +0800 (CST) Received: from huawei.com ([172.24.1.24]) by szxga01-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KM600CIB5DN8B@szxga01-in.huawei.com> for savi@ietf.org; Fri, 03 Jul 2009 03:12:59 +0800 (CST) Received: from X24512z ([10.124.12.62]) by szxml04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTPA id <0KM600DGO5DK3O@szxml04-in.huawei.com> for savi@ietf.org; Fri, 03 Jul 2009 03:12:59 +0800 (CST) Date: Thu, 02 Jul 2009 14:12:56 -0500 From: Frank Xia To: marcelo bagnulo braun Message-id: <013901c9fb49$1ca26940$3e0c7c0a@china.huawei.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Mailer: Microsoft Outlook Express 6.00.2900.3138 Content-type: text/plain; format=flowed; charset=iso-8859-1; reply-type=response Content-transfer-encoding: 8BIT X-Priority: 3 X-MSMail-priority: Normal References: <4A2C0DFB.3040803@it.uc3m.es> <00e301c9edcf$c7cc7bd0$3e0c7c0a@china.huawei.com> <4A36706D.9050501@it.uc3m.es> <001901c9edda$ff5bceb0$3e0c7c0a@china.huawei.com> <4ECD61DE-172E-486D-A9DC-948DB322D565@ericsson.com> <00c401c9f477$360829c0$3e0c7c0a@china.huawei.com> <4A4C85D9.3020703@it.uc3m.es> Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 02 Jul 2009 19:12:48 -0000 Hi Marcelo Please check.. BR Frank ----- Original Message ----- From: "marcelo bagnulo braun" To: "Frank Xia" Cc: "Christian Vogt" ; "SAVI Mailing List" Sent: Thursday, July 02, 2009 5:03 AM Subject: Re: [savi] A different trade off for SAVI > Frank Xia escribió: >> Hi Christian >> >> Yes. >> >> My another observation is that people only talk about >> DAD defined in RFC4862 while ignoring Optimistic DAD defined in RFC4429 >> which >> let go data traffic preceding control message > > mmm, maybe i am confused, but in optimistc DAD what changes is that the > node does not wait for 1 sec before sending data apcket with the soruce > address, but it is still sending the DAD NSOL prior sending data packets, > right? Frank=>No. It is possible to sending data packets before any ND messages. > So, i mean, the SAVI device would still first see the DAD NSOL and then > right away a data packet. So, in that case, we could create the optimistic > binding and keep track if there is any DAD NADV as a reply to the original > DAD NSOL. > > Regards, marcelo > > >> >> BR >> Frank >> >> ----- Original Message ----- From: "Christian Vogt" >> >> To: "Frank Xia" >> Cc: "SAVI Mailing List" >> Sent: Tuesday, June 23, 2009 9:05 PM >> Subject: Re: [savi] A different trade off for SAVI >> >> >>> >>> On Jun 15, 2009, Frank Xia wrote: >>> >>>> DAD is NOT a MUST for stateless address configuration. RFC 4862 reads >>>> >>>> "By default, all addresses should be tested for uniqueness prior to >>>> their assignment to an interface for safety. The test should >>>> individually be performed on all addresses obtained manually, via >>>> stateless address autoconfiguration, or via DHCPv6. To accommodate >>>> sites that believe the overhead of performing Duplicate Address >>>> Detection outweighs its benefits, the use of Duplicate Address >>>> Detection can be disabled through the administrative setting of a >>>> per-interface configuration flag." >>> >>> Isn't this just another reason to forward packets in the absence of a >>> binding, rather than discarding them? I see this in support of the >>> proposed FCFS variant. >>> >>> - Christian >>> >>> >>> >>> _______________________________________________ >>> savi mailing list >>> savi@ietf.org >>> https://www.ietf.org/mailman/listinfo/savi >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> > From christian.vogt@ericsson.com Fri Jul 3 13:12:15 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 416003A6B83 for ; Fri, 3 Jul 2009 13:12:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.548 X-Spam-Level: X-Spam-Status: No, score=-6.548 tagged_above=-999 required=5 tests=[AWL=0.051, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TG0RY9mP-wqe for ; Fri, 3 Jul 2009 13:12:14 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 72B653A68AE for ; Fri, 3 Jul 2009 13:12:14 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n63KCQud024363; Fri, 3 Jul 2009 15:12:30 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.50]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 15:11:29 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 15:11:29 -0500 Message-Id: <00A279CD-6F18-487E-942B-7E21085D11FB@ericsson.com> From: Christian Vogt To: "Joel M. Halpern" In-Reply-To: <4A4C1E94.8020104@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 3 Jul 2009 13:11:28 -0700 References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> <4A4C1E94.8020104@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 03 Jul 2009 20:11:29.0103 (UTC) FILETIME=[735465F0:01C9FC1A] Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 20:12:15 -0000 On Jul 1, 2009, Joel M. Halpern wrote: > IP address. (This is why I assumed no wireless.) If we are willing to > require a topology where there are Savi-sensitive switches at every > leaf, and that they have that kind of logging, then we would have a > proposal to evaluate. Joel - Would it be a reasonable conclusion from your statement that logging should be deactivate-able on a per-port basis? This would help avoiding excessive logging in SAVI devices with large port trunks -- logging, which would be redundant if there are more SAVI devices further downstream the port trunk. It would also be in line with an earlier conclusion that SAVI protection itself should be deactivate-able on a per-port basis, to prevent excessive memory requirements in SAVI devices with large port trunks. - Christian From jmh@joelhalpern.com Fri Jul 3 13:22:36 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 486D63A68AE for ; Fri, 3 Jul 2009 13:22:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.531 X-Spam-Level: X-Spam-Status: No, score=-3.531 tagged_above=-999 required=5 tests=[AWL=0.068, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id opg8XjkfjOnt for ; Fri, 3 Jul 2009 13:22:35 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id 7D7C33A68A5 for ; Fri, 3 Jul 2009 13:22:35 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 5CD8143029A; Fri, 3 Jul 2009 13:22:59 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-172.clppva.btas.verizon.net [71.161.52.172]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 6F452430288; Fri, 3 Jul 2009 13:22:58 -0700 (PDT) Message-ID: <4A4E68A0.5010905@joelhalpern.com> Date: Fri, 03 Jul 2009 16:22:56 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> <4A4C1E94.8020104@joelhalpern.com> <00A279CD-6F18-487E-942B-7E21085D11FB@ericsson.com> In-Reply-To: <00A279CD-6F18-487E-942B-7E21085D11FB@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 20:22:36 -0000 If one has sufficiently good leaf protection, it does seem sensibel to allow the sie adminsitrator to disable that on ports which are not leaf. Whether that is a good idea depends upon what the rest of the plan looks like. To me that looks like an incidental issue. Yours, Joel Christian Vogt wrote: > On Jul 1, 2009, Joel M. Halpern wrote: > >> IP address. (This is why I assumed no wireless.) If we are willing to >> require a topology where there are Savi-sensitive switches at every >> leaf, and that they have that kind of logging, then we would have a >> proposal to evaluate. > > > Joel - > > Would it be a reasonable conclusion from your statement that logging > should be deactivate-able on a per-port basis? This would help avoiding > excessive logging in SAVI devices with large port trunks -- logging, > which would be redundant if there are more SAVI devices further > downstream the port trunk. It would also be in line with an earlier > conclusion that SAVI protection itself should be deactivate-able on a > per-port basis, to prevent excessive memory requirements in SAVI devices > with large port trunks. > > - Christian > > > > From christian.vogt@ericsson.com Fri Jul 3 13:42:33 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 228003A693D for ; Fri, 3 Jul 2009 13:42:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.549 X-Spam-Level: X-Spam-Status: No, score=-6.549 tagged_above=-999 required=5 tests=[AWL=0.050, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vtFqEYuJ7x0O for ; Fri, 3 Jul 2009 13:42:32 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 5F8D63A68AC for ; Fri, 3 Jul 2009 13:42:32 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n63KgMtS004874; Fri, 3 Jul 2009 15:42:24 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.50]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 15:41:24 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 15:41:24 -0500 From: Christian Vogt To: Frank Xia In-Reply-To: <013901c9fb49$1ca26940$3e0c7c0a@china.huawei.com> X-Priority: 3 References: <4A2C0DFB.3040803@it.uc3m.es> <00e301c9edcf$c7cc7bd0$3e0c7c0a@china.huawei.com> <4A36706D.9050501@it.uc3m.es> <001901c9edda$ff5bceb0$3e0c7c0a@china.huawei.com> <4ECD61DE-172E-486D-A9DC-948DB322D565@ericsson.com> <00c401c9f477$360829c0$3e0c7c0a@china.huawei.com> <4A4C85D9.3020703@it.uc3m.es> <013901c9fb49$1ca26940$3e0c7c0a@china.huawei.com> Message-Id: <85739D12-D8AE-48EC-AE1F-DB0F227A9D5B@ericsson.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 3 Jul 2009 13:41:23 -0700 X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 03 Jul 2009 20:41:24.0439 (UTC) FILETIME=[A16EEE70:01C9FC1E] Cc: SAVI Mailing List Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 20:42:33 -0000 >> mmm, maybe i am confused, but in optimistc DAD what changes is that >> the >> node does not wait for 1 sec before sending data apcket with the >> soruce >> address, but it is still sending the DAD NSOL prior sending data >> packets, right? > > Frank=>No. It is possible to sending data packets before any ND > messages. Right. FWIW, draft-vogt-dna-relocation-01 explains the motivation for this behavior of Optimistic DAD: The DAD Neighbor Solicitation must wait for MLD subscriptions to complete, which may take up to 1 second. Waiting for the DAD Neighbor Solicitation before sending regular data would hence defeat the purpose of Optimistic DAD. - Christian From christian.vogt@ericsson.com Fri Jul 3 13:54:31 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E611F3A68AC for ; Fri, 3 Jul 2009 13:54:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.55 X-Spam-Level: X-Spam-Status: No, score=-6.55 tagged_above=-999 required=5 tests=[AWL=0.049, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vdKYPiGbHwUu for ; Fri, 3 Jul 2009 13:54:31 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id 109EE3A6CD2 for ; Fri, 3 Jul 2009 13:54:20 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n63KseQh017328; Fri, 3 Jul 2009 15:54:42 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 15:54:26 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 15:54:25 -0500 Message-Id: <441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com> From: Christian Vogt To: marcelo bagnulo braun In-Reply-To: <4A4CEB54.2020303@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 3 Jul 2009 13:54:24 -0700 References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 03 Jul 2009 20:54:25.0733 (UTC) FILETIME=[731EEF50:01C9FC20] Cc: SAVI Mailing List Subject: Re: [savi] On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 20:54:32 -0000 On Jul 2, 2009, marcelo bagnulo braun wrote: >> As a method for inter-SAVI-device coordination, I suggest >> partitioning >> the scope of SAVI protection. Thus, network administrators who >> enable >> DHCP-only mode may also have to manually designate switch ports that >> connect to other SAVI devices. This extra manual configuration >> should >> be acceptable given that the DHCP-only mode already needs to be >> turned >> on manually. At the same time, link partitioning avoids the extra >> complexity and manufacturing cost that synchronization would entail. > > mmm, i think it may be possible to achieve similar benefits without > configuring port per port. I actually think it would be easier to > configure a shared secret in every savi device than to manually define > device by device which port is used for what function Interesting. Should SAVI devices use this shared secret to synchronize binding state, or to automatically partition the scope of SAVI protection? I am assuming the latter, since you mention it as an alternative to manual partitioning. But in the latter case, how would this work, in particular in the presence of legacy switches? - Christian From christian.vogt@ericsson.com Fri Jul 3 14:03:02 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C076B3A6EAF for ; Fri, 3 Jul 2009 14:03:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.551 X-Spam-Level: X-Spam-Status: No, score=-6.551 tagged_above=-999 required=5 tests=[AWL=0.048, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yfyubr1DFqe5 for ; Fri, 3 Jul 2009 14:03:02 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 0903C3A6E7E for ; Fri, 3 Jul 2009 14:03:01 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n63L2fSH015407; Fri, 3 Jul 2009 16:02:44 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 16:02:16 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 16:02:16 -0500 Message-Id: <2011F63B-A915-4E3F-B747-C41574D0B836@ericsson.com> From: Christian Vogt To: marcelo bagnulo braun In-Reply-To: <4A4CEB54.2020303@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 3 Jul 2009 14:02:15 -0700 References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 03 Jul 2009 21:02:16.0464 (UTC) FILETIME=[8BB2C900:01C9FC21] Cc: SAVI Mailing List Subject: Re: [savi] On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 21:03:02 -0000 >> Protection of unused addresses would, of course, be a useful feature. >> But before making this mandatory, we should do a benefit-cost >> analysis. >> Here is one, along with a proposal of how to move forward: >> >> The benefit of protecting unused addresses is that it prevents an >> attacker from hiding its identity or location. > > i am not sure what do you mean by this... I mean, the attacker will > need > to use a topologically correct address, since we are asuming ingress > filtering then within the prefix, it can use any unused address, if > not > SAVI will drop it. The only question is whether it shoudl perform a > DAD > previously doing it or not So, i fail to see what is the concept of > protecting unused addresses... Marcelo - Even in the presence of ingress filtering, source addresses with a correct prefix, but spoofed interface identifier, could still permit an attacker to conceal its identify or location. The effectiveness of this concealment depends on the size and structure of the link. This said, I do agree with your statement that protection of unused addresses is of limited benefit in networks that allow Stateless Address Autoconfiguration -- as I explained in my previous email. - Christian From christian.vogt@ericsson.com Fri Jul 3 14:21:33 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 585A428C1D7 for ; Fri, 3 Jul 2009 14:21:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.553 X-Spam-Level: X-Spam-Status: No, score=-6.553 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5XwtQR5fBpLS for ; Fri, 3 Jul 2009 14:21:32 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 6E4F628C111 for ; Fri, 3 Jul 2009 14:21:32 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n63LLQsC023137; Fri, 3 Jul 2009 16:21:29 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.56]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 16:21:29 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 16:21:29 -0500 Message-Id: <6CA9521A-A807-4C55-B91D-AC32F23AD296@ericsson.com> From: Christian Vogt To: Eric Levy-Abegnoli In-Reply-To: <4A4CBE4A.2050207@cisco.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 3 Jul 2009 14:21:28 -0700 References: <4A2C0DFB.3040803@it.uc3m.es> <4A2D2221.4030503@cisco.com><4A2D2739.1000206@it.uc3m.es> <4A2F9E29.5070704@cisco.com><4A30D6CD.8060209@it.uc3m.es><49417952-8570-467E-B312-B759DC3D88DD@ericsson.com><4A35ECEE.7060801@cisco.com><86861CC6-385A-4CBA-9B9C-5D7E56EF119B@ericsson.com><4A42591A.5060408@cisco.com> <20DEB994-56B6-4D86-98BD-6C5F9CA56A5D@ericsson.com> <6983BF97BFC24D4EA551F14071232918011000EC@melmail.netstarnetworks.com> <75D6B967-CF62-4D44-9856-C7052D14BE10@ericsson.com> <4A4A1ECB.50109@cisco.com> <73ECA0F6-1C5A-49D6-95A0-486C0E0962DA@ericsson.com> <4A4B87B2.1030105@cisco.com> <6062B093-2295-4E8B-91AA-36F094350034@ericsson.com> <4A4C0A68.4020504@joelhalpern.com> <4A4CBE4A.2050207@cisco.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 03 Jul 2009 21:21:29.0160 (UTC) FILETIME=[3AC23C80:01C9FC24] Cc: SAVI Mailing List , Greg Daley Subject: Re: [savi] A different trade off for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 21:21:33 -0000 On Jul 2, 2009, Eric Levy-Abegnoli wrote: > A very realistic deployment scenario for SeND is going to be the one > of > a mix of SeND and and non-SeND capable devices attached to the same > link/switch. In that case, non-SeND capable device are not taking any > benefit of SeND, and can be led to trust SeND node bogus bindings. If > bindings with SeND credential can be preferred over the one without > (in > case of collision) - overriding the fist-come algorithm -, then the > switch will increase the security for everybody, not just the subset > or > SeND-capable nodes. So it's not only SEND-capable networks, it's any > network with a few (even just one) SeND-capable device. Right. - Christian From christian.vogt@ericsson.com Fri Jul 3 15:12:54 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BF1F228C2F7 for ; Fri, 3 Jul 2009 15:12:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.554 X-Spam-Level: X-Spam-Status: No, score=-6.554 tagged_above=-999 required=5 tests=[AWL=0.045, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5wMFFgon1JsR for ; Fri, 3 Jul 2009 15:12:54 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id E968628C2D3 for ; Fri, 3 Jul 2009 15:12:53 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n63MDCnF011272; Fri, 3 Jul 2009 17:13:16 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 17:12:23 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 3 Jul 2009 17:12:22 -0500 Message-Id: <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> From: Christian Vogt To: marcelo bagnulo braun In-Reply-To: <4A4C6EC3.4070906@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 3 Jul 2009 15:12:21 -0700 References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 03 Jul 2009 22:12:22.0664 (UTC) FILETIME=[56C9F880:01C9FC2B] Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 03 Jul 2009 22:12:54 -0000 On Jul 2, 2009, marcelo bagnulo braun wrote: >> Do we really have to forward all DAD solicitations to solve the >> problem? >> Is there a problem to begin with? I don't see why lack of a >> binding in >> a SAVI device would help an attacker hijacking an address. >> >> After all, a SAVI binding can only be created with a DAD solicitation >> that receives no response. So even if a SAVI device did not see >> the DAD >> solicitation of the legitimate address owner, it will see the DAD >> response of the legitimate address owner in case an attacker is >> trying >> to hijack that owner's address. > > but, the problem is that if the DAD is not seen by all SAVI devices > and > we are only filtering those addresses that do have a binding, then the > solution is more weak. Ah, ok. You want to increase the probability that SAVI devices have a binding. And the motivation for this is to enable SAVI protection for a larger set of addresses -- not to avoid dropping legitimate packets. This makes sense. Of course, distributing bindings increases memory requirements for SAVI devices, and consequently production costs. This is clearly a disadvantage. On the other hand, I don't think we can avoid binding distribution in any case, because it is required either: - to avoid dropping legitimate packets, or - to increase the set of addresses being protected. The first applies if SAVI devices were to drop packets for which no binding exists. The second applies if SAVI devices were to forward those packets. Importantly, binding distribution is crucial in the first case, whereas one may argue that it could be best-effort in the second case. - Christian From marcelo@it.uc3m.es Sat Jul 4 01:09:42 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A06C73A6403 for ; Sat, 4 Jul 2009 01:09:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.544 X-Spam-Level: X-Spam-Status: No, score=-6.544 tagged_above=-999 required=5 tests=[AWL=0.055, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id XIGFMmRjI59J for ; Sat, 4 Jul 2009 01:09:41 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 6B8BD3A685E for ; Sat, 4 Jul 2009 01:09:02 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp02.uc3m.es (Postfix) with ESMTP id 9B73165599E; Sat, 4 Jul 2009 10:07:25 +0200 (CEST) Message-ID: <4A4F0DBD.90405@it.uc3m.es> Date: Sat, 04 Jul 2009 10:07:25 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> In-Reply-To: <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16742.005 Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jul 2009 08:09:42 -0000 Christian Vogt escribió: > > On Jul 2, 2009, marcelo bagnulo braun wrote: > >>> Do we really have to forward all DAD solicitations to solve the >>> problem? >>> Is there a problem to begin with? I don't see why lack of a binding in >>> a SAVI device would help an attacker hijacking an address. >>> >>> After all, a SAVI binding can only be created with a DAD solicitation >>> that receives no response. So even if a SAVI device did not see the >>> DAD >>> solicitation of the legitimate address owner, it will see the DAD >>> response of the legitimate address owner in case an attacker is trying >>> to hijack that owner's address. >> >> but, the problem is that if the DAD is not seen by all SAVI devices and >> we are only filtering those addresses that do have a binding, then the >> solution is more weak. > > Ah, ok. You want to increase the probability that SAVI devices have a > binding. And the motivation for this is to enable SAVI protection for a > larger set of addresses -- not to avoid dropping legitimate packets. mmm, i would say to increase the scope of protection of the addresses that have a binding in a SAVI device I mean, if the DAD is not received by some SAVI devices, then the address will not be protected in these devices. > > This makes sense. > > Of course, distributing bindings increases memory requirements for SAVI > devices, and consequently production costs. This is clearly a > disadvantage. On the other hand, I don't think we can avoid binding > distribution in any case, because it is required either: > > - to avoid dropping legitimate packets, or > > - to increase the set of addresses being protected. > > The first applies if SAVI devices were to drop packets for which no > binding exists. The second applies if SAVI devices were to forward > those packets. > > Importantly, binding distribution is crucial in the first case, whereas > one may argue that it could be best-effort in the second case. > well, i agree it depends on the topology, but we don't want to end up with a very weak solution, since nobody will care about it. Regards, marcelo > - Christian > > > > From marcelo@it.uc3m.es Sat Jul 4 01:21:25 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E5373A685E for ; Sat, 4 Jul 2009 01:21:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.545 X-Spam-Level: X-Spam-Status: No, score=-6.545 tagged_above=-999 required=5 tests=[AWL=0.054, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1wwdLByRsXtA for ; Sat, 4 Jul 2009 01:21:24 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 0F5743A6403 for ; Sat, 4 Jul 2009 01:21:23 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp01.uc3m.es (Postfix) with ESMTP id 43B16B48BF1; Sat, 4 Jul 2009 09:59:21 +0200 (CEST) Message-ID: <4A4F0BD8.1020004@it.uc3m.es> Date: Sat, 04 Jul 2009 09:59:20 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> <441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com> In-Reply-To: <441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16742.005 Cc: SAVI Mailing List Subject: Re: [savi] On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jul 2009 08:21:25 -0000 Christian Vogt escribió: > On Jul 2, 2009, marcelo bagnulo braun wrote: > >>> As a method for inter-SAVI-device coordination, I suggest partitioning >>> the scope of SAVI protection. Thus, network administrators who enable >>> DHCP-only mode may also have to manually designate switch ports that >>> connect to other SAVI devices. This extra manual configuration should >>> be acceptable given that the DHCP-only mode already needs to be turned >>> on manually. At the same time, link partitioning avoids the extra >>> complexity and manufacturing cost that synchronization would entail. >> >> mmm, i think it may be possible to achieve similar benefits without >> configuring port per port. I actually think it would be easier to >> configure a shared secret in every savi device than to manually define >> device by device which port is used for what function > > Interesting. Should SAVI devices use this shared secret to synchronize > binding state, or to automatically partition the scope of SAVI > protection? I am assuming the latter, since you mention it as an > alternative to manual partitioning. But in the latter case, how would > this work, in particular in the presence of legacy switches? I understand that what you are after is to configure that a valid dhcp server or a SAVI switch are connected to a given port of a given SAVI switch, in order to provide some level of security (i.e. that a attacker cannot pretend to be a valid dhcp server or another SAVI switch.) I think that this would require to manually configure each SAVI device to state which ports are SAVI switches and which port are dhcp servers. this may not require any protocol change but i think it would be quite burdesome and would require a very careful topology control. Using a shared secret woudl allow to identify dhcp servers and savi switeches without that careful manual configuration of ports. OTOH, it would require some protocol indeed. Regards, marcelo > > - Christian > > > From marcelo@it.uc3m.es Sat Jul 4 01:37:51 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 17F8B3A697B for ; Sat, 4 Jul 2009 01:37:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.546 X-Spam-Level: X-Spam-Status: No, score=-6.546 tagged_above=-999 required=5 tests=[AWL=0.053, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eO31orr5WGb6 for ; Sat, 4 Jul 2009 01:37:50 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id F2A763A6403 for ; Sat, 4 Jul 2009 01:37:49 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (110.pool85-53-138.dynamic.orange.es [85.53.138.110]) by smtp03.uc3m.es (Postfix) with ESMTP id 7947172D017; Sat, 4 Jul 2009 10:03:26 +0200 (CEST) Message-ID: <4A4F0CCE.7000304@it.uc3m.es> Date: Sat, 04 Jul 2009 10:03:26 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> <2011F63B-A915-4E3F-B747-C41574D0B836@ericsson.com> In-Reply-To: <2011F63B-A915-4E3F-B747-C41574D0B836@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16742.005 Cc: SAVI Mailing List Subject: Re: [savi] On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 04 Jul 2009 08:37:51 -0000 Christian Vogt escribió: >>> Protection of unused addresses would, of course, be a useful feature. >>> But before making this mandatory, we should do a benefit-cost analysis. >>> Here is one, along with a proposal of how to move forward: >>> >>> The benefit of protecting unused addresses is that it prevents an >>> attacker from hiding its identity or location. >> >> i am not sure what do you mean by this... I mean, the attacker will need >> to use a topologically correct address, since we are asuming ingress >> filtering then within the prefix, it can use any unused address, if not >> SAVI will drop it. The only question is whether it shoudl perform a DAD >> previously doing it or not So, i fail to see what is the concept of >> protecting unused addresses... > > Marcelo - > > Even in the presence of ingress filtering, source addresses with a > correct prefix, but spoofed interface identifier, could still permit an > attacker to conceal its identify or location. that i don't understand. I think you are making some assumption of what is the meaning of using a spoofed interface identifier. for me, spoofing a interface identifier means using someone's interface identifier. If the interface identifier is not being used, it is not spoofing it. I mean, why using a source address that is not being used is spoofing? I can perfectly configure that address manually in my interface and i am using it. Is it because there was no DAD before? well, the DAD msg could have been lost, so there is no way for a SAVI device to tell if the node didn't send the DAD msg. Regards, marcelo > The effectiveness of this > concealment depends on the size and structure of the link. > > This said, I do agree with your statement that protection of unused > addresses is of limited benefit in networks that allow Stateless Address > Autoconfiguration -- as I explained in my previous email. > > - Christian > > > From christian.vogt@ericsson.com Sun Jul 5 15:26:16 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3E6143A693F for ; Sun, 5 Jul 2009 15:26:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Gycog9zK6GAU for ; Sun, 5 Jul 2009 15:26:15 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id E9C9B3A68ED for ; Sun, 5 Jul 2009 15:26:14 -0700 (PDT) Received: from compute1.internal (compute1.internal [10.202.2.41]) by out1.messagingengine.com (Postfix) with ESMTP id C61013ACFA1; Sun, 5 Jul 2009 18:26:39 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute1.internal (MEProxy); Sun, 05 Jul 2009 18:26:39 -0400 X-Sasl-enc: IlsNnsPGfpbZvykrUMDHBzptH6YXVtVUWQUIe0jsLeuB 1246832799 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 068D749F92; Sun, 5 Jul 2009 18:26:38 -0400 (EDT) Message-Id: From: Christian Vogt To: marcelo bagnulo braun In-Reply-To: <4A4F0DBD.90405@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Sun, 5 Jul 2009 15:26:36 -0700 References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> <4A4F0DBD.90405@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2009 22:26:16 -0000 On Jul 4, 2009, marcelo bagnulo braun wrote: >> Ah, ok. You want to increase the probability that SAVI devices >> have a >> binding. And the motivation for this is to enable SAVI protection >> for a >> larger set of addresses -- not to avoid dropping legitimate packets. > > mmm, i would say to increase the scope of protection of the > addresses that > have a binding in a SAVI device I mean, if the DAD is not received > by some > SAVI devices, then the address will not be protected in these devices. Yes. >> Of course, distributing bindings increases memory requirements for >> SAVI >> devices, and consequently production costs. This is clearly a >> disadvantage. On the other hand, I don't think we can avoid binding >> distribution in any case, because it is required either: >> >> - to avoid dropping legitimate packets, or >> >> - to increase the set of addresses being protected. >> >> The first applies if SAVI devices were to drop packets for which no >> binding exists. The second applies if SAVI devices were to forward >> those packets. >> >> Importantly, binding distribution is crucial in the first case, >> whereas >> one may argue that it could be best-effort in the second case. >> > > well, i agree it depends on the topology, but we don't want to end > up with > a very weak solution, since nobody will care about it. Absolutely. But my point here is this: Occasionally not having a binding is OK if this leads to lower protection of a particular address. It is not OK if this prevents a host from communicating. Do you and the working group agree with this? - Christian From christian.vogt@ericsson.com Sun Jul 5 15:54:03 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8DB503A6B00 for ; Sun, 5 Jul 2009 15:54:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hOQaNKW+dm42 for ; Sun, 5 Jul 2009 15:54:02 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id B62DC3A6ACA for ; Sun, 5 Jul 2009 15:54:02 -0700 (PDT) Received: from compute1.internal (compute1.internal [10.202.2.41]) by out1.messagingengine.com (Postfix) with ESMTP id D43743AD035; Sun, 5 Jul 2009 18:54:27 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute1.internal (MEProxy); Sun, 05 Jul 2009 18:54:27 -0400 X-Sasl-enc: kdxXwfcNesV9INhsAA63/HN2CZoLfW5vpdBrvWvaecl4 1246834466 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 296662DD34; Sun, 5 Jul 2009 18:54:26 -0400 (EDT) Message-Id: <08E4A56C-AF29-4A78-B580-A07EAF47FE87@ericsson.com> From: Christian Vogt To: marcelo bagnulo braun In-Reply-To: <4A4F0BD8.1020004@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Sun, 5 Jul 2009 15:54:24 -0700 References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> <441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com> <4A4F0BD8.1020004@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) Cc: SAVI Mailing List Subject: [savi] Using shared secrets to identify other SAVI devices X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2009 22:54:03 -0000 Forking off from thread "On the Protection of Unused Addresses" On Jul 4, 2009, marcelo bagnulo braun wrote: >>> mmm, i think it may be possible to achieve similar benefits without >>> configuring port per port. I actually think it would be easier to >>> configure a shared secret in every savi device than to manually >>> define >>> device by device which port is used for what function >> >> Interesting. Should SAVI devices use this shared secret to >> synchronize >> binding state, or to automatically partition the scope of SAVI >> protection? I am assuming the latter, since you mention it as an >> alternative to manual partitioning. But in the latter case, how >> would >> this work, in particular in the presence of legacy switches? > > I understand that what you are after is to configure that a valid dhcp > server or a SAVI switch are connected to a given port of a given SAVI > switch, in order to provide some level of security (i.e. that a > attacker > cannot pretend to be a valid dhcp server or another SAVI switch.) > > I think that this would require to manually configure each SAVI device > to state which ports are SAVI switches and which port are dhcp > servers. > this may not require any protocol change but i think it would be quite > burdesome and would require a very careful topology control. > > Using a shared secret woudl allow to identify dhcp servers and savi > switeches without that careful manual configuration of ports. OTOH, it > would require some protocol indeed. Avoiding manual configuration would indeed be of advantage. Yet I am still not sure whether shared secrets would permit auto-configuration. The reason is this: Knowledge of the presence of other SAVI devices or DHCP servers on a particular port is useful only if those SAVI devices and DHCP servers attach /directly/ to the port. If they do not attach directly, one may want to treat the port just like a port without other SAVI devices or DHCP servers. An example of a scenario where this happens is a port trunk with both legacy switches and SAVI devices. So using a shared secret for SAVI devices to auto-detect ports with other SAVI devices and DHCP servers would be useful only if the SAVI devices could detect whether those other SAVI devices and DHCP servers attach directly. I don't see how this could be realized. - Christian From christian.vogt@ericsson.com Sun Jul 5 16:14:17 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 726133A692D for ; Sun, 5 Jul 2009 16:14:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xuAGacj5AIBI for ; Sun, 5 Jul 2009 16:14:16 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id 8CA0C3A67AC for ; Sun, 5 Jul 2009 16:14:16 -0700 (PDT) Received: from compute1.internal (compute1.internal [10.202.2.41]) by out1.messagingengine.com (Postfix) with ESMTP id 088313AA952; Sun, 5 Jul 2009 19:14:40 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute1.internal (MEProxy); Sun, 05 Jul 2009 19:14:40 -0400 X-Sasl-enc: QiSUYFYHhbhlZ09eUNWK3N8sTQxVe2eyn+rVwdOFB2+p 1246835679 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 7550E2DD3E; Sun, 5 Jul 2009 19:14:39 -0400 (EDT) Message-Id: <7CE6A030-9D49-465D-8C9B-D936384AEAF6@ericsson.com> From: Christian Vogt To: marcelo bagnulo braun In-Reply-To: <4A4F0CCE.7000304@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Sun, 5 Jul 2009 16:14:38 -0700 References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> <2011F63B-A915-4E3F-B747-C41574D0B836@ericsson.com> <4A4F0CCE.7000304@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) Cc: SAVI Mailing List Subject: Re: [savi] On the Protection of Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 05 Jul 2009 23:14:17 -0000 On Jul 4, 2009, marcelo bagnulo braun wrote: > for me, spoofing a interface identifier means using someone's > interface > identifier. If the interface identifier is not being used, it is not > spoofing it. I mean, why using a source address that is not being used > is spoofing? I can perfectly configure that address manually in my > interface and i am using it. Is it because there was no DAD before? > well, the DAD msg could have been lost, so there is no way for a SAVI > device to tell if the node didn't send the DAD msg. Marcelo and all - The text that you, Marcelo, are commenting on was my summary of other working group members' motivation for protecting unused addresses. I would like those working group members to respond to Marcelo's comments if they still think that unused addresses should be protected in networks that permit SLAAC. Personally, I think Marcelo's arguments do make sense. In fact, I was coming to a similar conclusion in my analysis in [1]. - Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From christian.vogt@ericsson.com Sun Jul 5 20:20:19 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5F5703A6B64 for ; Sun, 5 Jul 2009 20:20:19 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tDuBWeb2sl0t for ; Sun, 5 Jul 2009 20:20:18 -0700 (PDT) Received: from out5.smtp.messagingengine.com (out5.smtp.messagingengine.com [66.111.4.29]) by core3.amsl.com (Postfix) with ESMTP id 937A43A697F for ; Sun, 5 Jul 2009 20:20:18 -0700 (PDT) Received: from compute1.internal (compute1.internal [10.202.2.41]) by out1.messagingengine.com (Postfix) with ESMTP id 1E80B3ADA52 for ; Sun, 5 Jul 2009 23:20:43 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute1.internal (MEProxy); Sun, 05 Jul 2009 23:20:43 -0400 X-Sasl-enc: 5S+HiPVkjX3CwySYg5hfyDXLXcRgU9gzWYdKEhdrw7g0 1246850442 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 8CC6BC507 for ; Sun, 5 Jul 2009 23:20:42 -0400 (EDT) Message-Id: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> From: Christian Vogt To: SAVI Mailing List Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Sun, 5 Jul 2009 20:20:41 -0700 X-Mailer: Apple Mail (2.935.3) Subject: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 03:20:19 -0000 Folks - Thank you for the good discussion on the protection of unused addresses. While this discussion continues, I would like to agree with you on the questions that we should eventually ask to conclude the discussion and determine rough consensus. I would like to suggest the following two questions, plus the corresponding answer options, and I am asking for your feedback on those: (1) For which address configuration methods should SAVI protect unused addresses? (1a) For all address configuration methods, including SLAAC. (1b) Only when DHCP is the only permitted address configuration method. (1c) Unused addresses never have to be protected. (2) If your answer to question (1) is (1a): How should SAVI minimize the risk of classifying a legitimate address unused, thus preventing a legitimate host from communicating? (2a) By protecting unused addresses only on ports with directly attached hosts. This requires manual configuration of SAVI devices. (2b) By synchronizing bindings across SAVI devices so that SAVI devices are reliably informed of which addresses are in use and which are unused. This requires a dedicated new protocol. (2c) It is OK to occasionally prevent a legitimate host from communicating. Please provide your feedback on these questions by Thursday, July 9. Do you think these questions are fine? Would you like to make changes? The final, potentially modified questions will be posted on Friday, July 10, for voting. - Christian From jmh@joelhalpern.com Sun Jul 5 20:59:42 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4739328C147 for ; Sun, 5 Jul 2009 20:59:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id cmGCIrmk-GTr for ; Sun, 5 Jul 2009 20:59:41 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id 77B2C3A6C0C for ; Sun, 5 Jul 2009 20:59:41 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id EEDD3430421 for ; Sun, 5 Jul 2009 21:00:06 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [192.168.2.250] (wsip-24-249-19-66.hr.hr.cox.net [24.249.19.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 9292D43041B for ; Sun, 5 Jul 2009 21:00:06 -0700 (PDT) Message-ID: <4A5176C3.7000506@joelhalpern.com> Date: Mon, 06 Jul 2009 00:00:03 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: SAVI Mailing List References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> In-Reply-To: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 03:59:42 -0000 Please first define "unused address". It makes a big difference whether you mean "currently unused by any other machine on the savi net" vs "legitimately usable by this machine". Also, please define what threat we are evaluating this against. various combinations are viable against certain threats, and not against other. Personally, rather than deciding on an abstract, I would find it sensible to decide on whether a particular strategy was worthwhile due to the protection it provided against specified threats. Deciding to use or not use a mechanism in the abstract seems backwards to me. Hence, my impression is that this is the wrong question. Yours, Joel Christian Vogt wrote: > Folks - > > Thank you for the good discussion on the protection of unused addresses. > While this discussion continues, I would like to agree with you on the > questions that we should eventually ask to conclude the discussion and > determine rough consensus. I would like to suggest the following two > questions, plus the corresponding answer options, and I am asking for > your feedback on those: > > (1) For which address configuration methods should SAVI protect unused > addresses? > > (1a) For all address configuration methods, including SLAAC. > > (1b) Only when DHCP is the only permitted address configuration > method. > > (1c) Unused addresses never have to be protected. > > (2) If your answer to question (1) is (1a): How should SAVI minimize > the risk of classifying a legitimate address unused, thus > preventing a legitimate host from communicating? > > (2a) By protecting unused addresses only on ports with directly > attached hosts. This requires manual configuration of SAVI > devices. > > (2b) By synchronizing bindings across SAVI devices so that SAVI > devices are reliably informed of which addresses are in use and > which are unused. This requires a dedicated new protocol. > > (2c) It is OK to occasionally prevent a legitimate host from > communicating. > > Please provide your feedback on these questions by Thursday, July 9. Do > you think these questions are fine? Would you like to make changes? > > The final, potentially modified questions will be posted on Friday, July > 10, for voting. > > - Christian > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From marcelo@it.uc3m.es Mon Jul 6 01:07:05 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7E29528C0FC for ; Mon, 6 Jul 2009 01:07:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.482 X-Spam-Level: X-Spam-Status: No, score=-6.482 tagged_above=-999 required=5 tests=[AWL=0.117, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FjhhdgZZB6Vc for ; Mon, 6 Jul 2009 01:07:01 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 554A428C0F7 for ; Mon, 6 Jul 2009 01:07:00 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap003.it.uc3m.es [163.117.139.45]) by smtp02.uc3m.es (Postfix) with ESMTP id 0C5CF655E46; Mon, 6 Jul 2009 10:06:28 +0200 (CEST) Message-ID: <4A51B083.9070303@it.uc3m.es> Date: Mon, 06 Jul 2009 10:06:27 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com> <4A4CEB54.2020303@it.uc3m.es> <441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com> <4A4F0BD8.1020004@it.uc3m.es> <08E4A56C-AF29-4A78-B580-A07EAF47FE87@ericsson.com> In-Reply-To: <08E4A56C-AF29-4A78-B580-A07EAF47FE87@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16746.005 Cc: SAVI Mailing List Subject: Re: [savi] Using shared secrets to identify other SAVI devices X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 08:07:05 -0000 Christian Vogt escribió: > > Forking off from thread "On the Protection of Unused Addresses" > > > On Jul 4, 2009, marcelo bagnulo braun wrote: > >>>> mmm, i think it may be possible to achieve similar benefits without >>>> configuring port per port. I actually think it would be easier to >>>> configure a shared secret in every savi device than to manually define >>>> device by device which port is used for what function >>> >>> Interesting. Should SAVI devices use this shared secret to synchronize >>> binding state, or to automatically partition the scope of SAVI >>> protection? I am assuming the latter, since you mention it as an >>> alternative to manual partitioning. But in the latter case, how would >>> this work, in particular in the presence of legacy switches? >> >> I understand that what you are after is to configure that a valid dhcp >> server or a SAVI switch are connected to a given port of a given SAVI >> switch, in order to provide some level of security (i.e. that a attacker >> cannot pretend to be a valid dhcp server or another SAVI switch.) >> >> I think that this would require to manually configure each SAVI device >> to state which ports are SAVI switches and which port are dhcp servers. >> this may not require any protocol change but i think it would be quite >> burdesome and would require a very careful topology control. >> >> Using a shared secret woudl allow to identify dhcp servers and savi >> switeches without that careful manual configuration of ports. OTOH, it >> would require some protocol indeed. > > Avoiding manual configuration would indeed be of advantage. Yet I am > still not sure whether shared secrets would permit auto-configuration. > > The reason is this: Knowledge of the presence of other SAVI devices or > DHCP servers on a particular port is useful only if those SAVI devices > and DHCP servers attach /directly/ to the port. If they do not attach > directly, one may want to treat the port just like a port without other > SAVI devices or DHCP servers. An example of a scenario where this > happens is a port trunk with both legacy switches and SAVI devices. > > So using a shared secret for SAVI devices to auto-detect ports with > other SAVI devices and DHCP servers would be useful only if the SAVI > devices could detect whether those other SAVI devices and DHCP servers > attach directly. I don't see how this could be realized. right i agree that manuallly configuring what is connected to which port provides a different set of capabilities than a shared secret However, depending what we are looking for, the features provided by a shared secret may be what is needed. Anycase, i think that maybe we should leave the this discussion for a concrete case. Regards, marcelo > > - Christian > > > > From marcelo@it.uc3m.es Mon Jul 6 01:27:10 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C107128C1D0 for ; Mon, 6 Jul 2009 01:27:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.487 X-Spam-Level: X-Spam-Status: No, score=-6.487 tagged_above=-999 required=5 tests=[AWL=0.112, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id id0FPWJycRAu for ; Mon, 6 Jul 2009 01:27:10 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id 9D3EF3A6859 for ; Mon, 6 Jul 2009 01:27:09 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap003.it.uc3m.es [163.117.139.45]) by smtp03.uc3m.es (Postfix) with ESMTP id 6D2046C9707; Mon, 6 Jul 2009 09:58:58 +0200 (CEST) Message-ID: <4A51AEC1.1090205@it.uc3m.es> Date: Mon, 06 Jul 2009 09:58:57 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> <4A4F0DBD.90405@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16746.005 Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 08:27:11 -0000 Christian Vogt escribió: > > On Jul 4, 2009, marcelo bagnulo braun wrote: > >>> Ah, ok. You want to increase the probability that SAVI devices have a >>> binding. And the motivation for this is to enable SAVI protection >>> for a >>> larger set of addresses -- not to avoid dropping legitimate packets. >> >> mmm, i would say to increase the scope of protection of the addresses >> that >> have a binding in a SAVI device I mean, if the DAD is not received by >> some >> SAVI devices, then the address will not be protected in these devices. > > Yes. > >>> Of course, distributing bindings increases memory requirements for SAVI >>> devices, and consequently production costs. This is clearly a >>> disadvantage. On the other hand, I don't think we can avoid binding >>> distribution in any case, because it is required either: >>> >>> - to avoid dropping legitimate packets, or >>> >>> - to increase the set of addresses being protected. >>> >>> The first applies if SAVI devices were to drop packets for which no >>> binding exists. The second applies if SAVI devices were to forward >>> those packets. >>> >>> Importantly, binding distribution is crucial in the first case, whereas >>> one may argue that it could be best-effort in the second case. >>> >> >> well, i agree it depends on the topology, but we don't want to end up >> with >> a very weak solution, since nobody will care about it. > > Absolutely. But my point here is this: Occasionally not having a > binding is OK if this leads to lower protection of a particular address. > It is not OK if this prevents a host from communicating. > > Do you and the working group agree with this? i agree of course the tricky part of this statement is how to determine what lower protection is still acceptable > > - Christian > > > > From marcelo@it.uc3m.es Mon Jul 6 01:37:16 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE3093A6C43 for ; Mon, 6 Jul 2009 01:37:16 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.491 X-Spam-Level: X-Spam-Status: No, score=-6.491 tagged_above=-999 required=5 tests=[AWL=0.108, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8daiX4pPAMeo for ; Mon, 6 Jul 2009 01:37:16 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id CE5B43A6C29 for ; Mon, 6 Jul 2009 01:37:15 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap003.it.uc3m.es [163.117.139.45]) by smtp01.uc3m.es (Postfix) with ESMTP id BF61DBA50A9; Mon, 6 Jul 2009 10:17:15 +0200 (CEST) Message-ID: <4A51B30B.8070306@it.uc3m.es> Date: Mon, 06 Jul 2009 10:17:15 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Christian Vogt References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> In-Reply-To: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16746.005 Cc: SAVI Mailing List Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 08:37:17 -0000 Hi, As Joel commented, i think you need to define what do you mean by unused address, especially in the SLAAC case. One definition is that the address is not configured as preferred in any host. That would be an accurate definition imho, but it is difficult to evaluate from the perspective of a SAVI device. So the definition that can be actually be verified by an external SAVI device and what i think it is actually being discussed here is that an unused address is an address for which there has not been a previous (succesuful) DAD procedure. So in the SLAAC case, i think the question that should be asked is whether it is ok to block packets for which the SAVI device has not seen a successful DAD procedure. Regards, marcelo Christian Vogt escribió: > Folks - > > Thank you for the good discussion on the protection of unused addresses. > While this discussion continues, I would like to agree with you on the > questions that we should eventually ask to conclude the discussion and > determine rough consensus. I would like to suggest the following two > questions, plus the corresponding answer options, and I am asking for > your feedback on those: > > (1) For which address configuration methods should SAVI protect unused > addresses? > > (1a) For all address configuration methods, including SLAAC. > > (1b) Only when DHCP is the only permitted address configuration > method. > > (1c) Unused addresses never have to be protected. > > (2) If your answer to question (1) is (1a): How should SAVI minimize > the risk of classifying a legitimate address unused, thus > preventing a legitimate host from communicating? > > (2a) By protecting unused addresses only on ports with directly > attached hosts. This requires manual configuration of SAVI > devices. > > (2b) By synchronizing bindings across SAVI devices so that SAVI > devices are reliably informed of which addresses are in use and > which are unused. This requires a dedicated new protocol. > > (2c) It is OK to occasionally prevent a legitimate host from > communicating. > > Please provide your feedback on these questions by Thursday, July 9. Do > you think these questions are fine? Would you like to make changes? > > The final, potentially modified questions will be posted on Friday, July > 10, for voting. > > - Christian > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From xiayangsong@huawei.com Mon Jul 6 08:50:55 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3622A3A6D2D for ; Mon, 6 Jul 2009 08:50:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.595 X-Spam-Level: X-Spam-Status: No, score=-0.595 tagged_above=-999 required=5 tests=[AWL=-0.100, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZMGhfYFJqyjc for ; Mon, 6 Jul 2009 08:50:54 -0700 (PDT) Received: from szxga03-in.huawei.com (unknown [119.145.14.66]) by core3.amsl.com (Postfix) with ESMTP id 27F163A6CFE for ; Mon, 6 Jul 2009 08:50:54 -0700 (PDT) Received: from huawei.com (szxga03-in [172.24.2.9]) by szxga03-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KMD00DX6AKVRG@szxga03-in.huawei.com> for savi@ietf.org; Mon, 06 Jul 2009 23:48:31 +0800 (CST) Received: from huawei.com ([172.24.1.24]) by szxga03-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KMD002P3AKVT3@szxga03-in.huawei.com> for savi@ietf.org; Mon, 06 Jul 2009 23:48:31 +0800 (CST) Received: from X24512z ([10.124.12.62]) by szxml04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTPA id <0KMD00CXGAKP59@szxml04-in.huawei.com> for savi@ietf.org; Mon, 06 Jul 2009 23:48:31 +0800 (CST) Date: Mon, 06 Jul 2009 10:48:25 -0500 From: Frank Xia To: Christian Vogt , SAVI Mailing List Message-id: <003701c9fe51$360f7ac0$3e0c7c0a@china.huawei.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Mailer: Microsoft Outlook Express 6.00.2900.3138 Content-type: text/plain; format=flowed; charset=ISO-8859-1; reply-type=response Content-transfer-encoding: 7BIT X-Priority: 3 X-MSMail-priority: Normal References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 15:50:55 -0000 Hi Christian Please check my choice... BR Frank ----- Original Message ----- From: "Christian Vogt" To: "SAVI Mailing List" Sent: Sunday, July 05, 2009 10:20 PM Subject: [savi] Suggested Voting Questions on Protecting Unused Addresses > Folks - > > Thank you for the good discussion on the protection of unused addresses. > While this discussion continues, I would like to agree with you on the > questions that we should eventually ask to conclude the discussion and > determine rough consensus. I would like to suggest the following two > questions, plus the corresponding answer options, and I am asking for > your feedback on those: > > (1) For which address configuration methods should SAVI protect unused > addresses? > > (1a) For all address configuration methods, including SLAAC. > (1b) Only when DHCP is the only permitted address configuration > method. > > (1c) Unused addresses never have to be protected. Frank=>OK. > (2) If your answer to question (1) is (1a): How should SAVI minimize > the risk of classifying a legitimate address unused, thus > preventing a legitimate host from communicating? > > (2a) By protecting unused addresses only on ports with directly > attached hosts. This requires manual configuration of SAVI > devices. > > (2b) By synchronizing bindings across SAVI devices so that SAVI > devices are reliably informed of which addresses are in use > and > which are unused. This requires a dedicated new protocol. > > (2c) It is OK to occasionally prevent a legitimate host from > communicating. > > Please provide your feedback on these questions by Thursday, July 9. Do > you think these questions are fine? Would you like to make changes? > > The final, potentially modified questions will be posted on Friday, July > 10, for voting. > > - Christian > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From christian.vogt@ericsson.com Mon Jul 6 11:46:03 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D462E3A6D8F for ; Mon, 6 Jul 2009 11:46:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.558 X-Spam-Level: X-Spam-Status: No, score=-6.558 tagged_above=-999 required=5 tests=[AWL=0.041, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gs-rnUZa1Hko for ; Mon, 6 Jul 2009 11:46:03 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id D812B3A6D8D for ; Mon, 6 Jul 2009 11:46:00 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n66HHm14025884; Mon, 6 Jul 2009 12:17:49 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.53]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Mon, 6 Jul 2009 12:17:39 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Mon, 6 Jul 2009 12:17:39 -0500 Message-Id: From: Christian Vogt To: "Joel M. Halpern" In-Reply-To: <4A5176C3.7000506@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 6 Jul 2009 10:17:37 -0700 References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 06 Jul 2009 17:17:39.0361 (UTC) FILETIME=[A9F55110:01C9FE5D] Cc: SAVI Mailing List Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 18:46:03 -0000 Joel - > Please first define "unused address". It makes a big difference > whether > you mean "currently unused by any other machine on the savi net" vs > "legitimately usable by this machine". It is the former: An "unused address" is an address that is currently not in use by any host on the SAVI network. > Also, please define what threat we are evaluating this against. > various > combinations are viable against certain threats, and not against > other. Protecting unused addresses would help preventing attacks in which the attacker needs to conceal its identity. This includes certain virus-spread distributed DoS attacks. (In general, another reason for an attacker to grab unused addresses is to conceal its location. But this is irrelevant for our discussion given that SAVI's use of ingress filtering makes location concealment impossible.) > Personally, rather than deciding on an abstract, I would find it > sensible to decide on whether a particular strategy was worthwhile due > to the protection it provided against specified threats. Deciding to > use or not use a mechanism in the abstract seems backwards to me. Please clarify: By "strategy", do you mean a particular mechanism? Would you like to rather vote on, say, Marcelo's proposal [1], which does not protect unused addresses, in combination with a mode for DHCP-only networks that does protect unused addresses [2]? - Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From fred@cisco.com Mon Jul 6 11:59:08 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DDB3128C189 for ; Mon, 6 Jul 2009 11:59:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.568 X-Spam-Level: X-Spam-Status: No, score=-106.568 tagged_above=-999 required=5 tests=[AWL=0.031, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZjR5paMyCJ87 for ; Mon, 6 Jul 2009 11:59:07 -0700 (PDT) Received: from sj-iport-5.cisco.com (sj-iport-5.cisco.com [171.68.10.87]) by core3.amsl.com (Postfix) with ESMTP id 6679E3A6D69 for ; Mon, 6 Jul 2009 11:59:06 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,358,1243814400"; d="scan'208";a="84734005" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-5.cisco.com with ESMTP; 06 Jul 2009 18:58:50 +0000 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id n66Iwopw029603; Mon, 6 Jul 2009 11:58:50 -0700 Received: from stealth-10-32-244-220.cisco.com (stealth-10-32-244-220.cisco.com [10.32.244.220]) by sj-core-5.cisco.com (8.13.8/8.14.3) with ESMTP id n66Iwo4T005455; Mon, 6 Jul 2009 18:58:50 GMT Message-Id: <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> From: Fred Baker To: Christian Vogt In-Reply-To: Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 6 Jul 2009 11:58:47 -0700 References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1642; t=1246906730; x=1247770730; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Re=3A=20[savi]=20Suggested=20Voting=20Questions =20on=20Protecting=20Unused=20Addresses |Sender:=20; bh=cCT2Wgt3wby5FjQddkmj6B+4k5hvh9I67xVXrwcZB14=; b=iCs87y0e1UOLMZBCEva1D/bh26fWgsjlRgaybYZlOnK3lCv/7YGBG9kwc/ Nu/wTrUAmxszFrQcTLj+gvDrIPWeZyoUt3FCYYVyQSAx8YTDRLQ0uBdfTo8j GcHJXvcehF; Authentication-Results: sj-dkim-4; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Cc: SAVI Mailing List Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 18:59:08 -0000 On Jul 6, 2009, at 10:17 AM, Christian Vogt wrote: >> Please first define "unused address". It makes a big difference >> whether >> you mean "currently unused by any other machine on the savi net" vs >> "legitimately usable by this machine". > > It is the former: An "unused address" is an address that is currently > not in use by any host on the SAVI network. Personally, I think the question has to be about the addresses we know that a host is authorized to use, as opposed to "excluding all others". Either has the effect of excluding all others, but the addresses a host is known to be authorized to use is something that the SAVI switch can honestly know. If we are not preventing hosts from using addresses that they aren't authorized to use, I don't know what we are doing here. To my way of thinking, if a network is using DHCPv6, the only addresses a host should transmit from are those it has been assigned. Cold stop. To my way of thinking, if a network is using SLAAC, the switch should be able to observe that it has used the procedure. If the host has not used the procedure with respect to an address it emits, a SAVI switch should not just learn it, it should stop it. If it does not do so, consider all the attacks in which a host uses a foreign address once and tell me that SAVI has been helpful in any way in attack management. As for manual configuration, I don't think there is an obvious way to detect that apart from manually configuring the switch as well. So if a SAVI switch is used in a network, that is a side-effect of that decision. From marcelo@it.uc3m.es Mon Jul 6 12:36:09 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 005BA3A6D13 for ; Mon, 6 Jul 2009 12:36:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.54 X-Spam-Level: X-Spam-Status: No, score=-6.54 tagged_above=-999 required=5 tests=[AWL=0.059, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id N5LP0cebsfLA for ; Mon, 6 Jul 2009 12:36:08 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id F18413A6CFF for ; Mon, 6 Jul 2009 12:36:07 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (47.pool85-53-147.dynamic.orange.es [85.53.147.47]) by smtp02.uc3m.es (Postfix) with ESMTP id 5F8B46C20A3; Mon, 6 Jul 2009 21:35:34 +0200 (CEST) Message-ID: <4A525206.9000000@it.uc3m.es> Date: Mon, 06 Jul 2009 21:35:34 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Fred Baker References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> In-Reply-To: <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16748.001 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 19:36:09 -0000 Fred Baker escribió: > > On Jul 6, 2009, at 10:17 AM, Christian Vogt wrote: > >>> Please first define "unused address". It makes a big difference >>> whether >>> you mean "currently unused by any other machine on the savi net" vs >>> "legitimately usable by this machine". >> >> It is the former: An "unused address" is an address that is currently >> not in use by any host on the SAVI network. > > Personally, I think the question has to be about the addresses we know > that a host is authorized to use, as opposed to "excluding all > others". Either has the effect of excluding all others, but the > addresses a host is known to be authorized to use is something that > the SAVI switch can honestly know. > > If we are not preventing hosts from using addresses that they aren't > authorized to use, I don't know what we are doing here. > > To my way of thinking, if a network is using DHCPv6, the only > addresses a host should transmit from are those it has been assigned. > Cold stop. i agree with this DHCP can be seen as an device to authorize a node to use an address and if by default (i.e. if the node cannot communicate with the dhcp server) then the node won't use any address. (one concern with this is implementation wise, in particular i wonder what would happen if the savi switch reboots and looses the information it gathereed snooping dhcp messages, how it can recover it, but certainly we can think of ways to solve this) > > To my way of thinking, if a network is using SLAAC, the switch should > be able to observe that it has used the procedure. If the host has not > used the procedure with respect to an address it emits, a SAVI switch > should not just learn it, it should stop it. If it does not do so, > consider all the attacks in which a host uses a foreign address once > and tell me that SAVI has been helpful in any way in attack management. > the problem with this is that the node, if the DAD msg is lost, the node thinks the DAD procedure has been succesfull. So, as opposed to the dhcp case, the default action here is to use the address. So this is why i think it is not possible for an external device like the savi switch to know if a node is authorized to use an address Besides, if an attacker wants to use an address, it only needs to do a DAD procedure and the savi will let it use it, so i fail to see what attack we are preventing by this. > As for manual configuration, I don't think there is an obvious way to > detect that apart from manually configuring the switch as well. So if > a SAVI switch is used in a network, that is a side-effect of that > decision. > manually configured addresses (as well a dhcp assigned addresses must also perform the DAD procedure i think, so the same could apply here i guess Regards, marcelo > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From fred@cisco.com Mon Jul 6 13:12:28 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A5C5328C189 for ; Mon, 6 Jul 2009 13:12:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.569 X-Spam-Level: X-Spam-Status: No, score=-106.569 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P22OV3OwZ6BN for ; Mon, 6 Jul 2009 13:12:27 -0700 (PDT) Received: from sj-iport-3.cisco.com (sj-iport-3.cisco.com [171.71.176.72]) by core3.amsl.com (Postfix) with ESMTP id B8B0828C24C for ; Mon, 6 Jul 2009 13:12:27 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,358,1243814400"; d="scan'208";a="174878209" Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-3.cisco.com with ESMTP; 06 Jul 2009 20:05:08 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id n66K58sY029133; Mon, 6 Jul 2009 13:05:08 -0700 Received: from stealth-10-32-244-220.cisco.com (stealth-10-32-244-220.cisco.com [10.32.244.220]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n66K58vb020001; Mon, 6 Jul 2009 20:05:08 GMT Message-Id: <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> From: Fred Baker To: marcelo bagnulo braun In-Reply-To: <4A525206.9000000@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 6 Jul 2009 13:05:05 -0700 References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=364; t=1246910708; x=1247774708; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Re=3A=20[savi]=20Suggested=20Voting=20Questions =20on=20Protecting=20Unused=20Addresses |Sender:=20; bh=GWxT6a0MqKunnTU0+RG+G1MWcScP52fhsMhM6cX1H+g=; b=tDvQS72ZocbRJSqZzfR6AFXfnjxZgbF5isaxYT6tuqCvgv5Myy2HW1TVbY uh7rzG7f1gBDvm/bvY2tO4ZkM/IrolsXGhqjnhFfnh+YPzNZgaWjY2xdEIFL O1XKtMn6Ss; Authentication-Results: sj-dkim-3; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 20:12:28 -0000 On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: > Besides, if an attacker wants to use an address, it only needs to do > a DAD procedure and the savi will let it use it, so i fail to see > what attack we are preventing by this. If it uses a DAD procedure, it has allocated the address to itself. In such a case, SAVI *should* allow it. From fred@cisco.com Mon Jul 6 13:20:43 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 621DF3A6D3F for ; Mon, 6 Jul 2009 13:20:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.389 X-Spam-Level: X-Spam-Status: No, score=-106.389 tagged_above=-999 required=5 tests=[AWL=0.210, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Q8VZWnxZAUv2 for ; Mon, 6 Jul 2009 13:20:42 -0700 (PDT) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id 844683A6D4F for ; Mon, 6 Jul 2009 13:20:42 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,358,1243814400"; d="scan'208";a="183267252" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-2.cisco.com with ESMTP; 06 Jul 2009 20:20:09 +0000 Received: from sj-core-4.cisco.com (sj-core-4.cisco.com [171.68.223.138]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id n66KK953026629; Mon, 6 Jul 2009 13:20:09 -0700 Received: from stealth-10-32-244-220.cisco.com (stealth-10-32-244-220.cisco.com [10.32.244.220]) by sj-core-4.cisco.com (8.13.8/8.14.3) with ESMTP id n66KK7tT015691; Mon, 6 Jul 2009 20:20:08 GMT Message-Id: <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> From: Fred Baker To: marcelo bagnulo braun In-Reply-To: <4A525956.9080009@it.uc3m.es> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 6 Jul 2009 13:20:04 -0700 References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1195; t=1246911609; x=1247775609; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Re=3A=20[savi]=20Suggested=20Voting=20Questions =20on=20Protecting=20Unused=20Addresses |Sender:=20; bh=sNjlEc0c7KBSkksBKtpbSQC1rwntcAiETpBc4Cv7v4U=; b=GvfXm4VvCn2AytNsrbmtRbbUmZvDkXOIggYLp8/0lPMTF20+c316e0wIP4 SzbASjZxloy0aIHykp0ujIq/ac5XSsMtSvm6naUCkOpxYNgyP3htnsFmLjAL UjP0w6ersm; Authentication-Results: sj-dkim-4; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 20:20:43 -0000 If it has correctly allocated the address, and then uses it to =20 perpetrate an attack, we can track the attack to the source. Remember, =20= the fundamental issue SAVI was trying to prevent was perpetration of =20 attacks that could not be racked to their source, generally due to =20 address spoofing. Not all attacks use improper addresses; those that use proper =20 addresses can be tracked to their source. We're trying to prevent =20 improper use of addresses. Just letting the thing fly fails to ensure that it can be tracked to =20 its source. On Jul 6, 2009, at 1:06 PM, marcelo bagnulo braun wrote: > Fred Baker escribi=F3: >> >> On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: >> >>> Besides, if an attacker wants to use an address, it only needs to =20= >>> do a DAD procedure and the savi will let it use it, so i fail to =20 >>> see what attack we are preventing by this. >> >> If it uses a DAD procedure, it has allocated the address to itself. =20= >> In such a case, SAVI *should* allow it. >> > Right, so what kind of attack are we preventing by requiring an =20 > attacker to perform a DADprocedure before using an address? > From marcelo@it.uc3m.es Mon Jul 6 13:37:18 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2EB843A6DA9 for ; Mon, 6 Jul 2009 13:37:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.537 X-Spam-Level: X-Spam-Status: No, score=-6.537 tagged_above=-999 required=5 tests=[AWL=0.062, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id uphb0bqrkDWz for ; Mon, 6 Jul 2009 13:37:17 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id 19F233A6DA7 for ; Mon, 6 Jul 2009 13:37:16 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (47.pool85-53-147.dynamic.orange.es [85.53.147.47]) by smtp03.uc3m.es (Postfix) with ESMTP id 830427F2924; Mon, 6 Jul 2009 22:30:13 +0200 (CEST) Message-ID: <4A525ED5.1090000@it.uc3m.es> Date: Mon, 06 Jul 2009 22:30:13 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Fred Baker References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> In-Reply-To: <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16748.002 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 20:37:18 -0000 Fred Baker escribió: > If it has correctly allocated the address, and then uses it to > perpetrate an attack, we can track the attack to the source. but we can track it even if it didn't performed the DAd. Moreover, an address that we have not seen a previous DAD, it would look more suspicious and would trigger the logging capabiltiies easier. I mean, the SAVI device can perfectly let the packet through (in case the user is legimtate usingt he address but the DAD msg got lost) but still logging the packet, so it can be traced back in case it is an attacker. > Remember, the fundamental issue SAVI was trying to prevent was > perpetration of attacks that could not be racked to their source, > generally due to address spoofing. > > Not all attacks use improper addresses; those that use proper > addresses can be tracked to their source. We're trying to prevent > improper use of addresses. > > Just letting the thing fly fails to ensure that it can be tracked to > its source. > the option that would then accomplish all the goals would be to let the packet through and log these packets as well, i guess Regards, marcelo > On Jul 6, 2009, at 1:06 PM, marcelo bagnulo braun wrote: > >> Fred Baker escribió: >>> >>> On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: >>> >>>> Besides, if an attacker wants to use an address, it only needs to >>>> do a DAD procedure and the savi will let it use it, so i fail to >>>> see what attack we are preventing by this. >>> >>> If it uses a DAD procedure, it has allocated the address to itself. >>> In such a case, SAVI *should* allow it. >>> >> Right, so what kind of attack are we preventing by requiring an >> attacker to perform a DADprocedure before using an address? >> > > From marcelo@it.uc3m.es Mon Jul 6 14:08:56 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 222F43A6827 for ; Mon, 6 Jul 2009 14:08:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.538 X-Spam-Level: X-Spam-Status: No, score=-6.538 tagged_above=-999 required=5 tests=[AWL=0.061, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dwzU5Xgy9QbH for ; Mon, 6 Jul 2009 14:08:55 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 548E53A6983 for ; Mon, 6 Jul 2009 14:08:55 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (47.pool85-53-147.dynamic.orange.es [85.53.147.47]) by smtp01.uc3m.es (Postfix) with ESMTP id 6862DBA51A4; Mon, 6 Jul 2009 22:06:46 +0200 (CEST) Message-ID: <4A525956.9080009@it.uc3m.es> Date: Mon, 06 Jul 2009 22:06:46 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Fred Baker References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> In-Reply-To: <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16748.001 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 21:08:56 -0000 Fred Baker escribió: > > On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: > >> Besides, if an attacker wants to use an address, it only needs to do >> a DAD procedure and the savi will let it use it, so i fail to see >> what attack we are preventing by this. > > If it uses a DAD procedure, it has allocated the address to itself. In > such a case, SAVI *should* allow it. > Right, so what kind of attack are we preventing by requiring an attacker to perform a DADprocedure before using an address? From jmh@joelhalpern.com Mon Jul 6 16:19:20 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B298C28C33B for ; Mon, 6 Jul 2009 16:19:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.299 X-Spam-Level: X-Spam-Status: No, score=-3.299 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, J_CHICKENPOX_43=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kt3RsWs+AVqq for ; Mon, 6 Jul 2009 16:19:19 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id DDC433A6C60 for ; Mon, 6 Jul 2009 16:19:19 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 322FD430466; Mon, 6 Jul 2009 16:18:48 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [192.168.2.250] (wsip-24-249-19-66.hr.hr.cox.net [24.249.19.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 1906843044C; Mon, 6 Jul 2009 16:18:46 -0700 (PDT) Message-ID: <4A528654.3020704@joelhalpern.com> Date: Mon, 06 Jul 2009 19:18:44 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Fred Baker References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> In-Reply-To: <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 06 Jul 2009 23:19:20 -0000 I believe that there is a disconnect here. Assume a wireless infrastructure. Assume SLAAC / DAD. Assume that the malicious host has some way to guess when some other node is turn off / unavailable, etc. In that case, the malicious host 1) Switches its MAC address to that of some other host 2) uses DAD 3) Does bad things 4) turns off Note that if the site is not providing persistent logs of the IP anchoring, then step 1 (and the concomitant knowledge of some other MAC address) is also not needed, as after th attack there is no traceability. For a wired infrastructre, if logs are generated at the edge SAVI switch, then the log of the DAD binding, and what port it was received on, is indeed sufficient. That assumes logs and wired infrastructure. This is why I am asking that folks provide clarity on both the threats they believe need to be dealt with, and the assumptions that they are prepared to make. Yours, Joel PS: I tend to like combinations like logs+802.1x (plus simultaneous usage prevention), or logs+CGA. But I can not tell what assumptions the WG is prepared to make. Fred Baker wrote: > If it has correctly allocated the address, and then uses it to > perpetrate an attack, we can track the attack to the source. Remember, > the fundamental issue SAVI was trying to prevent was perpetration of > attacks that could not be racked to their source, generally due to > address spoofing. > > Not all attacks use improper addresses; those that use proper addresses > can be tracked to their source. We're trying to prevent improper use of > addresses. > > Just letting the thing fly fails to ensure that it can be tracked to its > source. > > On Jul 6, 2009, at 1:06 PM, marcelo bagnulo braun wrote: > >> Fred Baker escribió: >>> >>> On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: >>> >>>> Besides, if an attacker wants to use an address, it only needs to do >>>> a DAD procedure and the savi will let it use it, so i fail to see >>>> what attack we are preventing by this. >>> >>> If it uses a DAD procedure, it has allocated the address to itself. >>> In such a case, SAVI *should* allow it. >>> >> Right, so what kind of attack are we preventing by requiring an >> attacker to perform a DADprocedure before using an address? >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From fred@cisco.com Mon Jul 6 22:22:05 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B97B83A6B18 for ; Mon, 6 Jul 2009 22:22:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.41 X-Spam-Level: X-Spam-Status: No, score=-106.41 tagged_above=-999 required=5 tests=[AWL=0.189, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ebcoOZOX0+j2 for ; Mon, 6 Jul 2009 22:22:04 -0700 (PDT) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 58D423A69BD for ; Mon, 6 Jul 2009 22:22:04 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,361,1243814400"; d="scan'208";a="210248882" Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-1.cisco.com with ESMTP; 07 Jul 2009 05:21:41 +0000 Received: from sj-core-3.cisco.com (sj-core-3.cisco.com [171.68.223.137]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id n675LeWO014325; Mon, 6 Jul 2009 22:21:41 -0700 Received: from stealth-10-32-244-220.cisco.com (stealth-10-32-244-220.cisco.com [10.32.244.220]) by sj-core-3.cisco.com (8.13.8/8.14.3) with ESMTP id n675Le8Q026753; Tue, 7 Jul 2009 05:21:40 GMT Message-Id: From: Fred Baker To: "Joel M. Halpern" In-Reply-To: <4A528654.3020704@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 6 Jul 2009 22:21:40 -0700 References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=229; t=1246944101; x=1247808101; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Re=3A=20[savi]=20Suggested=20Voting=20Questions =20on=20Protecting=20Unused=20Addresses |Sender:=20; bh=72DgWUvTapPg775Tcx/6c3Coa+polAXVv6+2pGfbZJw=; b=Jnzs/HhpDoAQJahQbDNSlzMQW5AutyPequ9sFY6o/Qag7RvxoGYlOq83Gq XC8g7Z19t7NzAh4FAD741lQr1aIeIp/wZNOvCqoxRdsO5I6LHtejOlvCeQff xv6w114C1o; Authentication-Results: sj-dkim-3; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; ); Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 05:22:05 -0000 On Jul 6, 2009, at 4:18 PM, Joel M. Halpern wrote: > I believe that there is a disconnect here. > Assume a wireless infrastructure. The first disconnect is that we aren't allowed to work on wireless infrastructures. From marcelo@it.uc3m.es Tue Jul 7 00:06:31 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7569E3A6D85 for ; Tue, 7 Jul 2009 00:06:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.239 X-Spam-Level: X-Spam-Status: No, score=-6.239 tagged_above=-999 required=5 tests=[AWL=-0.240, BAYES_00=-2.599, J_CHICKENPOX_43=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id q+Czq7bGl0FA for ; Tue, 7 Jul 2009 00:06:30 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 44ED23A6D31 for ; Tue, 7 Jul 2009 00:06:30 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (47.pool85-53-147.dynamic.orange.es [85.53.147.47]) by smtp02.uc3m.es (Postfix) with ESMTP id 980DE655FA5; Tue, 7 Jul 2009 09:06:17 +0200 (CEST) Message-ID: <4A52F3E9.1050803@it.uc3m.es> Date: Tue, 07 Jul 2009 09:06:17 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: "Joel M. Halpern" References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> In-Reply-To: <4A528654.3020704@joelhalpern.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16748.004 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 07:06:31 -0000 Joel, SAVI will provide security of data packets by creating a binding between the IP source address and a L2 anchor. This means that the SAVI will learn that a given IP source address corresponds to a given L2 anchor and will make that binding and after that will only accept packets containing that IP source address when coming from that L2 anchor. Now, it is clear that the security of any SAVI solution will be as strong as the L2 anchor. There are many different L2 anchors we can use. One of them are L2 source addresses i.e. MAC source addresses. The problem with these is that they can be forged easily, so the resulting solution is not very secure. I think this is orthogonal to the fact we use DAD or SLAAC. The same thing can happen with dhcp. I understnad that this is a problem of the strength of the L2 anchor. OTOH, we can use switch ports as L2 anchors. These are much more secure imho. We can use them in wired netwroks and i understand that in some wireless networks, where crpto is used a each host has different crypto material, the result is similar. So, i agree with you, in some cases the attacks are very easy, but the solution of this rely on using better L2 anchors imho So about the assumptions you mention below, i think our default case should be the case where we use ports as L2 anchors. Do you think we need to make more assumptions? I don't feel at this point we need to assume CGAs. I do think logging will be an essential part of SAVI, cause it is what will allow to trace back attackers Regards, marcelo Joel M. Halpern escribió: > I believe that there is a disconnect here. > Assume a wireless infrastructure. > Assume SLAAC / DAD. > Assume that the malicious host has some way to guess when some other > node is turn off / unavailable, etc. > > In that case, the malicious host > 1) Switches its MAC address to that of some other host > 2) uses DAD > 3) Does bad things > 4) turns off > > Note that if the site is not providing persistent logs of the IP > anchoring, then step 1 (and the concomitant knowledge of some other > MAC address) is also not needed, as after th attack there is no > traceability. > > For a wired infrastructre, if logs are generated at the edge SAVI > switch, then the log of the DAD binding, and what port it was received > on, is indeed sufficient. > That assumes logs and wired infrastructure. > > This is why I am asking that folks provide clarity on both the threats > they believe need to be dealt with, and the assumptions that they are > prepared to make. > > Yours, > Joel > > PS: I tend to like combinations like logs+802.1x (plus simultaneous > usage prevention), or logs+CGA. But I can not tell what assumptions > the WG is prepared to make. > > Fred Baker wrote: >> If it has correctly allocated the address, and then uses it to >> perpetrate an attack, we can track the attack to the source. >> Remember, the fundamental issue SAVI was trying to prevent was >> perpetration of attacks that could not be racked to their source, >> generally due to address spoofing. >> >> Not all attacks use improper addresses; those that use proper >> addresses can be tracked to their source. We're trying to prevent >> improper use of addresses. >> >> Just letting the thing fly fails to ensure that it can be tracked to >> its source. >> >> On Jul 6, 2009, at 1:06 PM, marcelo bagnulo braun wrote: >> >>> Fred Baker escribió: >>>> >>>> On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: >>>> >>>>> Besides, if an attacker wants to use an address, it only needs to >>>>> do a DAD procedure and the savi will let it use it, so i fail to >>>>> see what attack we are preventing by this. >>>> >>>> If it uses a DAD procedure, it has allocated the address to itself. >>>> In such a case, SAVI *should* allow it. >>>> >>> Right, so what kind of attack are we preventing by requiring an >>> attacker to perform a DADprocedure before using an address? >>> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> > From gdaley@netstarnetworks.com Tue Jul 7 00:53:42 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A02AF3A6D69 for ; Tue, 7 Jul 2009 00:53:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.394 X-Spam-Level: X-Spam-Status: No, score=-1.394 tagged_above=-999 required=5 tests=[AWL=0.211, BAYES_00=-2.599, RELAY_IS_203=0.994] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3ylLQzRP2Qm2 for ; Tue, 7 Jul 2009 00:53:41 -0700 (PDT) Received: from mail.syd.netstarnetworks.com (mail.syd.netstarnetworks.com [203.8.7.220]) by core3.amsl.com (Postfix) with ESMTP id 9DE9E3A67B4 for ; Tue, 7 Jul 2009 00:53:41 -0700 (PDT) Received: from sydmail.netstarnetworks.com ([10.18.193.13]) by mail.syd.netstarnetworks.com (8.12.8/8.12.8) with ESMTP id n677rXRs020868; Tue, 7 Jul 2009 17:53:34 +1000 Received: from melmail.netstarnetworks.com ([10.20.193.13]) by sydmail.netstarnetworks.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 7 Jul 2009 17:53:22 +1000 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Tue, 7 Jul 2009 17:53:21 +1000 Message-ID: <6983BF97BFC24D4EA551F14071232918011365C4@melmail.netstarnetworks.com> In-Reply-To: <08E4A56C-AF29-4A78-B580-A07EAF47FE87@ericsson.com> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [savi] Using shared secrets to identify other SAVI devices Thread-Index: Acn9w5NuYLFgVjXPRSyy8Zt7jRckhgA3RVnw References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com><4A4CEB54.2020303@it.uc3m.es><441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com><4A4F0BD8.1020004@it.uc3m.es> <08E4A56C-AF29-4A78-B580-A07EAF47FE87@ericsson.com> From: "Greg Daley" To: "Christian Vogt" , "marcelo bagnulo braun" X-OriginalArrivalTime: 07 Jul 2009 07:53:22.0478 (UTC) FILETIME=[0018B4E0:01C9FED8] Cc: SAVI Mailing List Subject: Re: [savi] Using shared secrets to identify other SAVI devices X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 07:53:42 -0000 Hi Christian,=20 Shared secrets make sense in order to prevent misconfiguration or misbehaviour amongst the LAN. If there is no authentication, it is possible to trivially pretend to be a SAVI device (which defeats the purpose). While manual configuration would need to be minimal, if security is required, it cannot be avoided. Greg > > Using a shared secret woudl allow to identify dhcp servers and savi > > switeches without that careful manual configuration of=20 > > ports. OTOH, it would require some protocol indeed. >=20 > Avoiding manual configuration would indeed be of advantage. Yet I am > still not sure whether shared secrets would permit auto-configuration. >=20 > The reason is this: Knowledge of the presence of other SAVI=20 > devices or > DHCP servers on a particular port is useful only if those SAVI devices > and DHCP servers attach /directly/ to the port. If they do not attach > directly, one may want to treat the port just like a port=20 > without other > SAVI devices or DHCP servers. An example of a scenario where this > happens is a port trunk with both legacy switches and SAVI devices. >=20 > So using a shared secret for SAVI devices to auto-detect ports with > other SAVI devices and DHCP servers would be useful only if the SAVI > devices could detect whether those other SAVI devices and DHCP servers > attach directly. I don't see how this could be realized. >=20 > - Christian >=20 >=20 >=20 > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi >=20 From jmh@joelhalpern.com Tue Jul 7 04:47:47 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D7CC53A6D44 for ; Tue, 7 Jul 2009 04:47:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.499 X-Spam-Level: X-Spam-Status: No, score=-3.499 tagged_above=-999 required=5 tests=[AWL=0.100, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id raT-Y+jcv1EJ for ; Tue, 7 Jul 2009 04:47:47 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id 31FD03A6899 for ; Tue, 7 Jul 2009 04:47:47 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id C0E4E430090; Tue, 7 Jul 2009 04:46:08 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [192.168.2.250] (wsip-24-249-19-66.hr.hr.cox.net [24.249.19.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 2328F43008D; Tue, 7 Jul 2009 04:46:08 -0700 (PDT) Message-ID: <4A53357E.8030203@joelhalpern.com> Date: Tue, 07 Jul 2009 07:46:06 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Fred Baker References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 11:47:47 -0000 I rechecked the charter. There is nothing I could find in there which says that SAVI shall build solutions which address only wired ethernet. (It also does not say we will avoid thicknet, but I am prepared to assume that, since it just is not in use anywhere.) Given that many corporations use wireless in their office environments, without an explicit statement saying that is out of scope, I do not see how I can assume that. I will readily agree that if that is out of scope, then we have different assumptions that can be made. Yours, Joel Fred Baker wrote: > > On Jul 6, 2009, at 4:18 PM, Joel M. Halpern wrote: > >> I believe that there is a disconnect here. >> Assume a wireless infrastructure. > > The first disconnect is that we aren't allowed to work on wireless > infrastructures. > From jmh@joelhalpern.com Tue Jul 7 05:05:02 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7AEAE3A6861 for ; Tue, 7 Jul 2009 05:05:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.224 X-Spam-Level: X-Spam-Status: No, score=-3.224 tagged_above=-999 required=5 tests=[AWL=-0.225, BAYES_00=-2.599, J_CHICKENPOX_43=0.6, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G2Jg-LQY0OoZ for ; Tue, 7 Jul 2009 05:05:01 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id 5D2723A6B5D for ; Tue, 7 Jul 2009 05:05:01 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 1A024430093 for ; Tue, 7 Jul 2009 05:04:01 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [192.168.2.250] (wsip-24-249-19-66.hr.hr.cox.net [24.249.19.66]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id BB8CB43008D for ; Tue, 7 Jul 2009 05:04:00 -0700 (PDT) Message-ID: <4A5339AF.4020904@joelhalpern.com> Date: Tue, 07 Jul 2009 08:03:59 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: SAVI Mailing List References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> <4A52F3E9.1050803@it.uc3m.es> In-Reply-To: <4A52F3E9.1050803@it.uc3m.es> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 12:05:02 -0000 I do understand that SAVI needs to work with different binding anchors. I can live with a description that says that the SAVI binding anchor will have property "X". For example, declaring that the bindings will have the property of reliably selecting a specific physical machine is one way to separate the problems. I am concerned because with the different assumptions folks are prepared to make, this may be harder than it looks. The realities needed to meet that constraint, and the tightness of the applicability statement required to meet that, may be more than people would assume. (Physically moving machines is commonly doable in commercial environments.) Yours, Joel marcelo bagnulo braun wrote: > Joel, > > SAVI will provide security of data packets by creating a binding between > the IP source address and a L2 anchor. This means that the SAVI will > learn that a given IP source address corresponds to a given L2 anchor > and will make that binding and after that will only accept packets > containing that IP source address when coming from that L2 anchor. > > Now, it is clear that the security of any SAVI solution will be as > strong as the L2 anchor. > > There are many different L2 anchors we can use. > One of them are L2 source addresses i.e. MAC source addresses. > The problem with these is that they can be forged easily, so the > resulting solution is not very secure. I think this is orthogonal to the > fact we use DAD or SLAAC. The same thing can happen with dhcp. I > understnad that this is a problem of the strength of the L2 anchor. > > OTOH, we can use switch ports as L2 anchors. These are much more secure > imho. We can use them in wired netwroks and i understand that in some > wireless networks, where crpto is used a each host has different crypto > material, the result is similar. > > So, i agree with you, in some cases the attacks are very easy, but the > solution of this rely on using better L2 anchors imho > > So about the assumptions you mention below, i think our default case > should be the case where we use ports as L2 anchors. > Do you think we need to make more assumptions? I don't feel at this > point we need to assume CGAs. I do think logging will be an essential > part of SAVI, cause it is what will allow to trace back attackers > > Regards, marcelo > > > Joel M. Halpern escribió: >> I believe that there is a disconnect here. >> Assume a wireless infrastructure. >> Assume SLAAC / DAD. >> Assume that the malicious host has some way to guess when some other >> node is turn off / unavailable, etc. >> >> In that case, the malicious host >> 1) Switches its MAC address to that of some other host >> 2) uses DAD >> 3) Does bad things >> 4) turns off >> >> Note that if the site is not providing persistent logs of the IP >> anchoring, then step 1 (and the concomitant knowledge of some other >> MAC address) is also not needed, as after th attack there is no >> traceability. >> >> For a wired infrastructre, if logs are generated at the edge SAVI >> switch, then the log of the DAD binding, and what port it was received >> on, is indeed sufficient. >> That assumes logs and wired infrastructure. >> >> This is why I am asking that folks provide clarity on both the threats >> they believe need to be dealt with, and the assumptions that they are >> prepared to make. >> >> Yours, >> Joel >> >> PS: I tend to like combinations like logs+802.1x (plus simultaneous >> usage prevention), or logs+CGA. But I can not tell what assumptions >> the WG is prepared to make. >> >> Fred Baker wrote: >>> If it has correctly allocated the address, and then uses it to >>> perpetrate an attack, we can track the attack to the source. >>> Remember, the fundamental issue SAVI was trying to prevent was >>> perpetration of attacks that could not be racked to their source, >>> generally due to address spoofing. >>> >>> Not all attacks use improper addresses; those that use proper >>> addresses can be tracked to their source. We're trying to prevent >>> improper use of addresses. >>> >>> Just letting the thing fly fails to ensure that it can be tracked to >>> its source. >>> >>> On Jul 6, 2009, at 1:06 PM, marcelo bagnulo braun wrote: >>> >>>> Fred Baker escribió: >>>>> >>>>> On Jul 6, 2009, at 12:35 PM, marcelo bagnulo braun wrote: >>>>> >>>>>> Besides, if an attacker wants to use an address, it only needs to >>>>>> do a DAD procedure and the savi will let it use it, so i fail to >>>>>> see what attack we are preventing by this. >>>>> >>>>> If it uses a DAD procedure, it has allocated the address to itself. >>>>> In such a case, SAVI *should* allow it. >>>>> >>>> Right, so what kind of attack are we preventing by requiring an >>>> attacker to perform a DADprocedure before using an address? >>>> >>> >>> _______________________________________________ >>> savi mailing list >>> savi@ietf.org >>> https://www.ietf.org/mailman/listinfo/savi >>> >> > > From fred@cisco.com Tue Jul 7 08:32:44 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7CC733A6E96 for ; Tue, 7 Jul 2009 08:32:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.569 X-Spam-Level: X-Spam-Status: No, score=-106.569 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ID3S1NFnW6+4 for ; Tue, 7 Jul 2009 08:32:43 -0700 (PDT) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id 9210D3A6858 for ; Tue, 7 Jul 2009 08:32:43 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,363,1243814400"; d="scan'208";a="210504231" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-1.cisco.com with ESMTP; 07 Jul 2009 15:31:57 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id n67FVvu5022517; Tue, 7 Jul 2009 08:31:57 -0700 Received: from stealth-10-32-244-220.cisco.com (stealth-10-32-244-220.cisco.com [10.32.244.220]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n67FVvOR025527; Tue, 7 Jul 2009 15:31:57 GMT Message-Id: <427FA788-752C-4098-BBC1-C3D9C8840D79@cisco.com> From: Fred Baker To: "Joel M. Halpern" In-Reply-To: <4A53357E.8030203@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Tue, 7 Jul 2009 08:31:54 -0700 References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> <4A53357E.8030203@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1116; t=1246980717; x=1247844717; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Re=3A=20[savi]=20Suggested=20Voting=20Questions =20on=20Protecting=20Unused=20Addresses |Sender:=20; bh=TK+sC1BQCrEzqMJ02jdBBNPyyufWFni6WJiUVT+JHPM=; b=dndZMO9XX+i1Nvh8msrvG2EOUMe953MT60/NbRresNDTR5B44vxv0oLoBv eP8bVzSzSmpWEjWUy/zA4npx0aeYqIspeaA7BqPLgSVqV0J6WaHMh6o6K4Xi sQNqsEc6ch; Authentication-Results: sj-dkim-4; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 15:32:44 -0000 OK, I must be remembering an earlier version of the charter. At one point we were told that we were only working on switched Ethernet. That fact was used to shut me up during one of the BOFs. On Jul 7, 2009, at 4:46 AM, Joel M. Halpern wrote: > I rechecked the charter. There is nothing I could find in there > which says that SAVI shall build solutions which address only wired > ethernet. (It also does not say we will avoid thicknet, but I am > prepared to assume that, since it just is not in use anywhere.) > > Given that many corporations use wireless in their office > environments, without an explicit statement saying that is out of > scope, I do not see how I can assume that. > > I will readily agree that if that is out of scope, then we have > different assumptions that can be made. > > Yours, > Joel > > Fred Baker wrote: >> On Jul 6, 2009, at 4:18 PM, Joel M. Halpern wrote: >>> I believe that there is a disconnect here. >>> Assume a wireless infrastructure. >> The first disconnect is that we aren't allowed to work on wireless >> infrastructures. From christian.vogt@ericsson.com Tue Jul 7 13:19:15 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 610AA28C4D7 for ; Tue, 7 Jul 2009 13:19:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.558 X-Spam-Level: X-Spam-Status: No, score=-6.558 tagged_above=-999 required=5 tests=[AWL=0.041, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZyEnnUAIvAYe for ; Tue, 7 Jul 2009 13:19:14 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 45AC83A69FD for ; Tue, 7 Jul 2009 13:18:54 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n67KICVU030994; Tue, 7 Jul 2009 15:18:17 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.50]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 7 Jul 2009 15:17:20 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 7 Jul 2009 15:17:19 -0500 Message-Id: <57975A2E-FF4D-4E3D-9646-A7D6E59A4E90@ericsson.com> From: Christian Vogt To: Greg Daley In-Reply-To: <6983BF97BFC24D4EA551F14071232918011365C4@melmail.netstarnetworks.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Tue, 7 Jul 2009 13:17:19 -0700 References: <81955095-4CA3-41E8-8435-99B2AF644621@ericsson.com><4A4CEB54.2020303@it.uc3m.es><441506C7-017C-4A07-9F71-6F5D2E509C73@ericsson.com><4A4F0BD8.1020004@it.uc3m.es> <08E4A56C-AF29-4A78-B580-A07EAF47FE87@ericsson.com> <6983BF97BFC24D4EA551F14071232918011365C4@melmail.netstarnetworks.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 07 Jul 2009 20:17:19.0753 (UTC) FILETIME=[EDFC5790:01C9FF3F] Cc: SAVI Mailing List Subject: Re: [savi] Using shared secrets to identify other SAVI devices X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 07 Jul 2009 20:19:15 -0000 This is correct, Greg. My comments were related to somethings else. My comments were related to automatic configuration of SAVI devices regarding which ports attach to hosts, which attach to legacy switches, and which attach to other SAVI devices. Such configuration would be useful to avoid binding and logging redundancies across multiple SAVI devices. My point here was that automatic configuration does not work, even if it was protected by shared secrets, because there is no way to detect the existence of legacy switches in between two SAVI devices. I agree that shared secrets may be useful for other purposes. - Christian On Jul 7, 2009, Greg Daley wrote: > Hi Christian, > > Shared secrets make sense in order to prevent misconfiguration or > misbehaviour amongst the LAN. > > If there is no authentication, it is possible to trivially pretend > to be > a SAVI device (which defeats the purpose). > > While manual configuration would need to be minimal, if security is > required, it cannot be avoided. > > Greg From zhangdong_rh@huaweisymantec.com Wed Jul 8 18:01:55 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AE2F13A6FD4 for ; Wed, 8 Jul 2009 18:01:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.042 X-Spam-Level: *** X-Spam-Status: No, score=3.042 tagged_above=-999 required=5 tests=[AWL=-3.266, BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_BASE64_TEXT=1.753, MIME_CHARSET_FARAWAY=2.45, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MGsFa6xiswr8 for ; Wed, 8 Jul 2009 18:01:54 -0700 (PDT) Received: from mta1.huaweisymantec.com (unknown [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id 8AB373A6FC1 for ; Wed, 8 Jul 2009 18:01:54 -0700 (PDT) MIME-version: 1.0 Content-type: text/plain; charset=gb2312 Received: from hstml02-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KMH00KTQPJMT000@hstga01-in.huaweisymantec.com> for savi@ietf.org; Thu, 09 Jul 2009 09:02:11 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KMH00FLXPJME900@hstml02-in.huaweisymantec.com> for savi@ietf.org; Thu, 09 Jul 2009 09:02:10 +0800 (CST) Date: Thu, 09 Jul 2009 09:02:10 +0800 From: Dong Zhang To: Christian Vogt , marcelo bagnulo braun References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> <4A4F0DBD.90405@it.uc3m.es> Message-id: <200907090902099774677@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Content-transfer-encoding: base64 Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 01:01:55 -0000 Q2hyaXN0aWFuIHdyb3RlOg0KPkFic29sdXRlbHkuICBCdXQgbXkgcG9pbnQgaGVyZSBpcyB0aGlz OiAgT2NjYXNpb25hbGx5IG5vdCBoYXZpbmcgYQ0KPmJpbmRpbmcgaXMgT0sgaWYgdGhpcyBsZWFk cyB0byBsb3dlciBwcm90ZWN0aW9uIG9mIGEgcGFydGljdWxhciBhZGRyZXNzLg0KPkl0IGlzIG5v dCBPSyBpZiB0aGlzIHByZXZlbnRzIGEgaG9zdCBmcm9tIGNvbW11bmljYXRpbmcuDQoNCkkgYW0g bm90IHF1aXQgY2xlYXIgdGhhdCB3aGVuIGFuZCBob3cgdGhlIG9jY2FzaW9uYWwgY2FzZSBoYXBw ZW5zLiANCkNvdWxkIHlvdSBwbGVhc2UgZXhwbGFpbiB0aGF0Pw0KDQpUaHgNCg0KLS0tLS0tLS0t LS0tLS0tLS0tCQkJCSANCkRvbmcgWmhhbmcNCjIwMDktMDctMDkNCg0KLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ0Kt6K8/sjLo7pD aHJpc3RpYW4gVm9ndA0Kt6LLzcjVxtqjujIwMDktMDctMDYgMDY6MjY6NDgNCsrVvP7Iy6O6bWFy Y2VsbyBiYWdudWxvIGJyYXVuDQqzrcvNo7pTQVZJIE1haWxpbmcgTGlzdDsgR3VhbmcgWWFvDQrW 98zio7pSZTogW3NhdmldIFlvdXIgb3BpbmlvbiBvbiBhIGRpZmZlcmVudCB0cmFkZW9mZiBmb3Ig U0FWSQ0KDQoNCk9uIEp1bCA0LCAyMDA5LCBtYXJjZWxvIGJhZ251bG8gYnJhdW4gd3JvdGU6DQoN Cj4+IEFoLCBvay4gIFlvdSB3YW50IHRvIGluY3JlYXNlIHRoZSBwcm9iYWJpbGl0eSB0aGF0IFNB VkkgZGV2aWNlcyAgDQo+PiBoYXZlIGENCj4+IGJpbmRpbmcuICBBbmQgdGhlIG1vdGl2YXRpb24g Zm9yIHRoaXMgaXMgdG8gZW5hYmxlIFNBVkkgcHJvdGVjdGlvbiAgDQo+PiBmb3IgYQ0KPj4gbGFy Z2VyIHNldCBvZiBhZGRyZXNzZXMgLS0gbm90IHRvIGF2b2lkIGRyb3BwaW5nIGxlZ2l0aW1hdGUg cGFja2V0cy4NCj4NCj4gbW1tLCBpIHdvdWxkIHNheSB0byBpbmNyZWFzZSB0aGUgc2NvcGUgb2Yg cHJvdGVjdGlvbiBvZiB0aGUgIA0KPiBhZGRyZXNzZXMgdGhhdA0KPiBoYXZlIGEgYmluZGluZyBp biBhIFNBVkkgZGV2aWNlIEkgbWVhbiwgaWYgdGhlIERBRCBpcyBub3QgcmVjZWl2ZWQgIA0KPiBi eSBzb21lDQo+IFNBVkkgZGV2aWNlcywgdGhlbiB0aGUgYWRkcmVzcyB3aWxsIG5vdCBiZSBwcm90 ZWN0ZWQgaW4gdGhlc2UgZGV2aWNlcy4NCg0KWWVzLg0KDQo+PiBPZiBjb3Vyc2UsIGRpc3RyaWJ1 dGluZyBiaW5kaW5ncyBpbmNyZWFzZXMgbWVtb3J5IHJlcXVpcmVtZW50cyBmb3IgIA0KPj4gU0FW SQ0KPj4gZGV2aWNlcywgYW5kIGNvbnNlcXVlbnRseSBwcm9kdWN0aW9uIGNvc3RzLiAgVGhpcyBp cyBjbGVhcmx5IGENCj4+IGRpc2FkdmFudGFnZS4gIE9uIHRoZSBvdGhlciBoYW5kLCBJIGRvbid0 IHRoaW5rIHdlIGNhbiBhdm9pZCBiaW5kaW5nDQo+PiBkaXN0cmlidXRpb24gaW4gYW55IGNhc2Us IGJlY2F1c2UgaXQgaXMgcmVxdWlyZWQgZWl0aGVyOg0KPj4NCj4+IC0gdG8gYXZvaWQgZHJvcHBp bmcgbGVnaXRpbWF0ZSBwYWNrZXRzLCBvcg0KPj4NCj4+IC0gdG8gaW5jcmVhc2UgdGhlIHNldCBv ZiBhZGRyZXNzZXMgYmVpbmcgcHJvdGVjdGVkLg0KPj4NCj4+IFRoZSBmaXJzdCBhcHBsaWVzIGlm IFNBVkkgZGV2aWNlcyB3ZXJlIHRvIGRyb3AgcGFja2V0cyBmb3Igd2hpY2ggbm8NCj4+IGJpbmRp bmcgZXhpc3RzLiAgVGhlIHNlY29uZCBhcHBsaWVzIGlmIFNBVkkgZGV2aWNlcyB3ZXJlIHRvIGZv cndhcmQNCj4+IHRob3NlIHBhY2tldHMuDQo+Pg0KPj4gSW1wb3J0YW50bHksIGJpbmRpbmcgZGlz dHJpYnV0aW9uIGlzIGNydWNpYWwgaW4gdGhlIGZpcnN0IGNhc2UsICANCj4+IHdoZXJlYXMNCj4+ IG9uZSBtYXkgYXJndWUgdGhhdCBpdCBjb3VsZCBiZSBiZXN0LWVmZm9ydCBpbiB0aGUgc2Vjb25k IGNhc2UuDQo+Pg0KPg0KPiB3ZWxsLCBpIGFncmVlIGl0IGRlcGVuZHMgb24gdGhlIHRvcG9sb2d5 LCBidXQgd2UgZG9uJ3Qgd2FudCB0byBlbmQgIA0KPiB1cCB3aXRoDQo+IGEgdmVyeSB3ZWFrIHNv bHV0aW9uLCBzaW5jZSBub2JvZHkgd2lsbCBjYXJlIGFib3V0IGl0Lg0KDQpBYnNvbHV0ZWx5LiAg QnV0IG15IHBvaW50IGhlcmUgaXMgdGhpczogIE9jY2FzaW9uYWxseSBub3QgaGF2aW5nIGENCmJp bmRpbmcgaXMgT0sgaWYgdGhpcyBsZWFkcyB0byBsb3dlciBwcm90ZWN0aW9uIG9mIGEgcGFydGlj dWxhciBhZGRyZXNzLg0KSXQgaXMgbm90IE9LIGlmIHRoaXMgcHJldmVudHMgYSBob3N0IGZyb20g Y29tbXVuaWNhdGluZy4NCg0KRG8geW91IGFuZCB0aGUgd29ya2luZyBncm91cCBhZ3JlZSB3aXRo IHRoaXM/DQoNCi0gQ2hyaXN0aWFuDQoNCg0KDQpfX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fXw0Kc2F2aSBtYWlsaW5nIGxpc3QNCnNhdmlAaWV0Zi5vcmcNCmh0 dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vc2F2aQ0K From christian.vogt@ericsson.com Wed Jul 8 18:27:02 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 053DB3A6F2C for ; Wed, 8 Jul 2009 18:27:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.559 X-Spam-Level: X-Spam-Status: No, score=-6.559 tagged_above=-999 required=5 tests=[AWL=0.040, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kh66c7lIOMKs for ; Wed, 8 Jul 2009 18:27:00 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id C0FD33A6BD9 for ; Wed, 8 Jul 2009 18:26:59 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n691RLaG011660; Wed, 8 Jul 2009 20:27:22 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.53]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 8 Jul 2009 20:26:47 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 8 Jul 2009 20:26:46 -0500 Message-Id: From: Christian Vogt To: Dong Zhang In-Reply-To: <200907090902099774677@huaweisymantec.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 8 Jul 2009 18:26:45 -0700 References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> <4A4F0DBD.90405@it.uc3m.es> <200907090902099774677@huaweisymantec.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 09 Jul 2009 01:26:46.0558 (UTC) FILETIME=[5313B3E0:01CA0034] Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 01:27:02 -0000 On Jul 8, 2009, Dong Zhang wrote: >> Absolutely. But my point here is this: Occasionally not having a >> binding is OK if this leads to lower protection of a particular >> address. >> It is not OK if this prevents a host from communicating. > > I am not quit clear that when and how the occasional case happens. > Could you please explain that? Hi Dong Zhang - The situation referred to here occurs when a SAVI device does not see a successful DAD procedure or DHCP assignment for a particular address. If said address is legitimate, then a drop-by-default behavior of SAVI devices would cause loss of legitimate packets. A forward-by-default behavior would avoid such packet loss, albeit it would not protect said address from hijacking either. - Christian From christian.vogt@ericsson.com Wed Jul 8 18:59:46 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 16A8D3A6900 for ; Wed, 8 Jul 2009 18:59:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.56 X-Spam-Level: X-Spam-Status: No, score=-6.56 tagged_above=-999 required=5 tests=[AWL=0.039, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id F+24FF6MXaA3 for ; Wed, 8 Jul 2009 18:59:45 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id DF5113A67AC for ; Wed, 8 Jul 2009 18:59:44 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n69207rA031607 for ; Wed, 8 Jul 2009 21:00:11 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.50]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 8 Jul 2009 20:59:42 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 8 Jul 2009 20:59:42 -0500 Message-Id: From: Christian Vogt To: SAVI Mailing List Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 8 Jul 2009 18:59:41 -0700 X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 09 Jul 2009 01:59:42.0469 (UTC) FILETIME=[ECCFCB50:01CA0038] Subject: [savi] Suggested Consensus Questions on Protecting Unused Addresses - Take Two X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 01:59:46 -0000 Folks - Thank you for your comments on the consensus questions regarding the protection of unused addresses. I would like to make two suggestions to reflect your comments: First, a revision of the consensus questions. Second, a working assumption to help focussing our discussion. Regarding the consensus questions: Your comments indicate that the notion of "unused addresses" is insufficient for two reasons: First, the meaning of "unused" in the sense of "available for configuration" is difficult to determine from the perspective of a SAVI device. Second, in case SLAAC is a permitted address configuration method, the boundary between an address being unused and used is thin, since only the trans- mission of a DAD Neighbor Solicitation message distinguishes the two. These comments make perfect sense. The goal of revising the consensus questions is hence to avoid the term "unused address" altogether, and to ask in a manner less conceptual, and more oriented towards a SAVI device's operation. The revised consensus questions are as follows: (A) In networks where SLAAC is permitted for address configuration, how should a SAVI device treat packets with a source address for which neither a successful DAD procedure nor a DHCP assignment was seen? (A1) Discard the packet (A2) Forward and optionally log the packet (B) In networks where only DHCP is permitted for address configuration, how should a SAVI device treat packets with a source address for which no DHCP assignment was seen? (B1) Discard the packet (B2) Forward and optionally log the packet In these questions, a SAVI device sees a "successful DAD procedure" for an address if it sees a DAD Neighbor Solicitation message, but no responding DAD Neighbor Advertisement message, for this address. Our existing SAVI solution proposals relate to these consensus questions as follows: The FCFS and CPS solutions both use the combination of (A1) plus (B1), with different means to reduce the probability of dropping legitimate packets. The middle-ground solution we are considering now -- originally suggested in [1] by Marcelo, and slightly augmented in [2] by me with an alternative mode for DHCP-only networks -- uses the combination of (A2) plus (B1). I would like folks to consider in particular this combination of (A2) plus (B1) because it constitutes a reasonable compromise between two competing solutions. The proposed working assumption is that SAVI will operate exclusively in wired networks, with switch ports constituting the binding anchors. The goal of this working assumption is to relieve the discussion from considerations about scenarios where SAVI can only have limited benefit. Unprotected wireless networks are an example of those scenarios, where forgeable MAC addresses are the only possible binding anchors. We will re-evaluate at a later stage how well SAVI applies to other scenarios. Are above consensus questions and working assumption OK? Please provide your feedback. We extend the deadline for feedback until Sunday, July 11. - Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From zhangdong_rh@huaweisymantec.com Wed Jul 8 22:07:08 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F00813A689C for ; Wed, 8 Jul 2009 22:07:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.207 X-Spam-Level: X-Spam-Status: No, score=-1.207 tagged_above=-999 required=5 tests=[AWL=1.392, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jdH8rGBi6xtJ for ; Wed, 8 Jul 2009 22:07:08 -0700 (PDT) Received: from mta1.huaweisymantec.com (mta1.huaweisymantec.com [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id DF3493A6452 for ; Wed, 8 Jul 2009 22:07:07 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=gb2312 Received: from hstml01-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KMI00KGA0WKT030@hstga01-in.huaweisymantec.com> for savi@ietf.org; Thu, 09 Jul 2009 13:07:33 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KMI0005R0WKC510@hstml01-in.huaweisymantec.com> for savi@ietf.org; Thu, 09 Jul 2009 13:07:32 +0800 (CST) Date: Thu, 09 Jul 2009 13:07:32 +0800 From: Dong Zhang To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com> <006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn> <4A365F7E.8010302@it.uc3m.es> <9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com> <4A4C6EC3.4070906@it.uc3m.es> <018712EC-91BC-4E34-9194-A16B72564828@ericsson.com> <4A4F0DBD.90405@it.uc3m.es> <200907090902099774677@huaweisymantec.com> Message-id: <200907091307318936439@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 05:07:09 -0000 Hi Christian, >>> Absolutely. But my point here is this: Occasionally not having a >>> binding is OK if this leads to lower protection of a particular >>> address. >>> It is not OK if this prevents a host from communicating. >> >> I am not quit clear that when and how the occasional case happens. >> Could you please explain that? > >Hi Dong Zhang - > >The situation referred to here occurs when a SAVI device does not see a >successful DAD procedure or DHCP assignment for a particular address. > >If said address is legitimate, then a drop-by-default behavior of SAVI >devices would cause loss of legitimate packets. A forward-by-default >behavior would avoid such packet loss, albeit it would not protect said >address from hijacking either. > I know the problem. However, I want to make sure is how often can be called "occasionally". I have not a concept about that. Is there a cirterion or a ratio? I mean how many times these occasional cases happened can be tolerant, how many times can not be tolerant. Perhaps I miss something previously. Thank you From marcelo@it.uc3m.es Wed Jul 8 23:49:52 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DAA563A7010 for ; Wed, 8 Jul 2009 23:49:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.535 X-Spam-Level: X-Spam-Status: No, score=-6.535 tagged_above=-999 required=5 tests=[AWL=0.064, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id E2G4cOlJitMP for ; Wed, 8 Jul 2009 23:49:51 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id CAD7028C18B for ; Wed, 8 Jul 2009 23:48:55 -0700 (PDT) Received: from localhost (webcartero01.uc3m.es [163.117.136.131]) by smtp02.uc3m.es (Postfix) with ESMTP id 8734A6562A0 for ; Thu, 9 Jul 2009 08:49:11 +0200 (CEST) Received: from 219.pool85-53-147.dynamic.orange.es (219.pool85-53-147.dynamic.orange.es [85.53.147.219]) by webcartero01.uc3m.es (Horde MIME library) with HTTP; Thu, 09 Jul 2009 08:49:10 +0200 Message-ID: <20090709084910.2qvka4sbw4448k88@webcartero01.uc3m.es> Date: Thu, 09 Jul 2009 08:49:10 +0200 From: MARCELO BAGNULO BRAUN To: savi@ietf.org References: In-Reply-To: MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format="flowed" Content-Disposition: inline Content-Transfer-Encoding: 7bit User-Agent: Internet Messaging Program (IMP) H3 (4.0.4) X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16752.004 Subject: Re: [savi] Suggested Consensus Questions on Protecting Unused Addresses - Take Two X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 06:49:53 -0000 Christian Vogt dijo: > Folks - > > Thank you for your comments on the consensus questions regarding the > protection of unused addresses. I would like to make two suggestions to > reflect your comments: First, a revision of the consensus questions. > Second, a working assumption to help focussing our discussion. > > Regarding the consensus questions: Your comments indicate that the > notion of "unused addresses" is insufficient for two reasons: First, > the meaning of "unused" in the sense of "available for configuration" is > difficult to determine from the perspective of a SAVI device. Second, > in case SLAAC is a permitted address configuration method, the boundary > between an address being unused and used is thin, since only the trans- > mission of a DAD Neighbor Solicitation message distinguishes the two. > > These comments make perfect sense. The goal of revising the consensus > questions is hence to avoid the term "unused address" altogether, and to > ask in a manner less conceptual, and more oriented towards a SAVI > device's operation. The revised consensus questions are as follows: > > (A) In networks where SLAAC is permitted for address configuration, how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet i don't think this is acceptable > (A2) Forward and optionally log the packet I think this is ok, but we may want to do something else, like for instance, creating a binding. At this point, i am uncertain whether we should that or not, but i wouldn't discard it yet. > > (B) In networks where only DHCP is permitted for address configuration, > how should a SAVI device treat packets with a source address for > which no DHCP assignment was seen? > > (B1) Discard the packet In order to answer this question i would like to understand what is the impact of the SAVI state being lost in case of a reboot for example. I mean, in this case we don't have to worry about loosing the dhcp packets, cause the dhcp will retransmit until gets an address assigned, but we still have to understand the impact of the savi device loosing state. So, are we going to try to recover the state, are we going to assume that the state is stored in permanent memory and never gets lost or are we going to assume that if it gets lost, the host will have to renew their dhcp assigment.. or other option that i am missing? > (B2) Forward and optionally log the packet > > In these questions, a SAVI device sees a "successful DAD procedure" for > an address if it sees a DAD Neighbor Solicitation message, but no > responding DAD Neighbor Advertisement message, for this address. > > Our existing SAVI solution proposals relate to these consensus questions > as follows: The FCFS and CPS solutions both use the combination of (A1) > plus (B1), with different means to reduce the probability of dropping > legitimate packets. The middle-ground solution we are considering now -- > originally suggested in [1] by Marcelo, and slightly augmented in [2] by > me with an alternative mode for DHCP-only networks -- uses the > combination of (A2) plus (B1). I would like folks to consider in > particular this combination of (A2) plus (B1) because it constitutes a > reasonable compromise between two competing solutions. > > The proposed working assumption is that SAVI will operate exclusively in > wired networks, with switch ports constituting the binding anchors. The > goal of this working assumption is to relieve the discussion from > considerations about scenarios where SAVI can only have limited benefit. > Unprotected wireless networks are an example of those scenarios, where > forgeable MAC addresses are the only possible binding anchors. We will > re-evaluate at a later stage how well SAVI applies to other scenarios. > > Are above consensus questions and working assumption OK? Please provide > your feedback. We extend the deadline for feedback until Sunday, July 11. > > - Christian > > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html > [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > -- ---- MARCELO BAGNULO BRAUN WebCartero Universidad Carlos III de Madrid From alberto@it.uc3m.es Thu Jul 9 01:38:43 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A7E8928C18D for ; Thu, 9 Jul 2009 01:38:43 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vyd4WYNV4ND8 for ; Thu, 9 Jul 2009 01:38:42 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 6F0A628C17A for ; Thu, 9 Jul 2009 01:38:42 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp02.uc3m.es (Postfix) with ESMTP id DB2FC65A599; Thu, 9 Jul 2009 10:39:07 +0200 (CEST) From: =?iso-8859-15?Q?Alberto_Garc=EDa?= To: "'Dong Zhang'" , "'Christian Vogt'" References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> Date: Thu, 9 Jul 2009 10:39:06 +0200 Message-ID: <02895EC3C31D47DC827C98907BE26361@bombo> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <200907091307318936439@huaweisymantec.com> Thread-Index: AcoAUy6+0syG0LtCRlWGuq9a8N9VJQAExPWw X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16752.006 Cc: 'SAVI Mailing List' , 'Guang Yao' Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 08:38:43 -0000 Hi, Dropping packets when a binding does not exist can lead to some occasional but very problematic situations. I add one case that I think it has not been commented before: when many switches connect using a spanning tree protocol, the unavailability of a switch, or a link belonging to the spanning tree triggers the propagation of a Topology Change Notification (in RSTP jargon) frame, which is flooded either to a subset of the tree or to the whole spanning tree (depending on the location of the change, and the identity of the switches involved in the change -i.e. root or not). If a port of a switch is affected by the topology change, it must flush the addresses learned through that port (IEEE Std 802.1w-2001 also accepts to flush the address/port binding for all ports). This must result in flushing also SAVI bindings. Therefore, hosts may be connected to a switch that has been always available, so they won't send DADs again, but the SAVI binding for its address in other switches be flushed and its packets dropped. Although switches or links may fail occasionally, they certainly do, and I don't think it is acceptable to prevent communication in this case. RSTP is built to recover reasonably fast on this situation, so adding a SAVI solution with this approach defeats part of its purpose. Other occasional situations that make DAD signaling unreliable are layer-2 networks that are connected, networks that power up at the same time and RSTP takes more time to make the network functional than hosts to detect the switches and send DAD. Too many "occasionals", from my point of view, affecting to basic functionality. Regards, Alberto | -----Mensaje original----- | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de Dong | Zhang | Enviado el: jueves, 09 de julio de 2009 7:08 | Para: Christian Vogt | CC: SAVI Mailing List; Guang Yao | Asunto: Re: [savi] Your opinion on a different tradeoff for SAVI | | Hi Christian, | >>> Absolutely. But my point here is this: Occasionally not having a | >>> binding is OK if this leads to lower protection of a particular | >>> address. | >>> It is not OK if this prevents a host from communicating. | >> | >> I am not quit clear that when and how the occasional case happens. | >> Could you please explain that? | > | >Hi Dong Zhang - | > | >The situation referred to here occurs when a SAVI device does not see a | >successful DAD procedure or DHCP assignment for a particular address. | > | >If said address is legitimate, then a drop-by-default behavior of SAVI | >devices would cause loss of legitimate packets. A forward-by-default | >behavior would avoid such packet loss, albeit it would not protect said | >address from hijacking either. | > | I know the problem. However, I want to make sure is how often can be called | "occasionally". | I have not a concept about that. Is there a cirterion or a ratio? I mean how many | times these | occasional cases happened can be tolerant, how many times can not be tolerant. | Perhaps I miss | something previously. | | Thank you | | | | _______________________________________________ | savi mailing list | savi@ietf.org | https://www.ietf.org/mailman/listinfo/savi From christian.vogt@ericsson.com Thu Jul 9 12:12:46 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D51993A6808 for ; Thu, 9 Jul 2009 12:12:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.412 X-Spam-Level: X-Spam-Status: No, score=-6.412 tagged_above=-999 required=5 tests=[AWL=-0.112, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lNzO-gg0LbDJ for ; Thu, 9 Jul 2009 12:12:46 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 01CBE3A67DF for ; Thu, 9 Jul 2009 12:12:45 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n69JD6wo003826; Thu, 9 Jul 2009 14:13:09 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.53]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Thu, 9 Jul 2009 14:12:31 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Thu, 9 Jul 2009 14:12:31 -0500 Message-Id: <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> From: Christian Vogt To: Dong Zhang , =?ISO-8859-1?Q?Alberto_Garc=EDa?= In-Reply-To: <02895EC3C31D47DC827C98907BE26361@bombo> Content-Type: text/plain; charset=ISO-8859-1; format=flowed; delsp=yes Content-Transfer-Encoding: quoted-printable Mime-Version: 1.0 (Apple Message framework v935.3) Date: Thu, 9 Jul 2009 12:12:30 -0700 References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 09 Jul 2009 19:12:31.0502 (UTC) FILETIME=[353BD2E0:01CA00C9] Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 19:12:46 -0000 Thank you, Alberto, for these comments. In addition, I would like to re-emphasize the following: A drop-by-default behavior, in which SAVI devices drop packets for which they have no binding, doesn't have a benefit in the first place if used in networks that permit SLAAC. The reason is that, in those networks, a malicious host can create a binding by itself, by sending a DAD Neighbor Solicitation message. Therefore, rather than pondering whether occasional loss of legitimate packets is a show-stopper or not for using the drop-by-default behavior in networks that permit SLAAC, I suggest we rather agree that the drop- by-default behavior just doesn't make sense in those networks. - Christian On Jul 9, 2009, Alberto Garc=EDa wrote: > Hi, Dropping packets when a binding does not exist can lead to some > occasional but very problematic situations. I add one case that I =20 > think > it has not been commented before: when many switches connect using a > spanning tree protocol, the unavailability of a switch, or a link > belonging to the spanning tree triggers the propagation of a Topology > Change Notification (in RSTP jargon) frame, which is flooded either =20= > to a > subset of the tree or to the whole spanning tree (depending on the > location of the change, and the identity of the switches involved in =20= > the > change -i.e. root or not). If a port of a switch is affected by the > topology change, it must flush the addresses learned through that port > (IEEE Std 802.1w-2001 also accepts to flush the address/port binding =20= > for > all ports). This must result in flushing also SAVI bindings. =20 > Therefore, > hosts may be connected to a switch that has been always available, so > they won't send DADs again, but the SAVI binding for its address in > other switches be flushed and its packets dropped. Although switches =20= > or > links may fail occasionally, they certainly do, and I don't think it =20= > is > acceptable to prevent communication in this case. RSTP is built to > recover reasonably fast on this situation, so adding a SAVI solution > with this approach defeats part of its purpose. > > Other occasional situations that make DAD signaling unreliable are > layer-2 networks that are connected, networks that power up at the =20 > same > time and RSTP takes more time to make the network functional than =20 > hosts > to detect the switches and send DAD. > > Too many "occasionals", from my point of view, affecting to basic > functionality. > > Regards, > Alberto From christian.vogt@ericsson.com Thu Jul 9 13:23:32 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 192B03A6D26 for ; Thu, 9 Jul 2009 13:23:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.559 X-Spam-Level: X-Spam-Status: No, score=-6.559 tagged_above=-999 required=5 tests=[AWL=0.040, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QLOdnj9ODqjq for ; Thu, 9 Jul 2009 13:23:31 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id 3C6FE3A6CC5 for ; Thu, 9 Jul 2009 13:23:31 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n69KNoRN012436; Thu, 9 Jul 2009 15:23:54 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Thu, 9 Jul 2009 15:23:53 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Thu, 9 Jul 2009 15:23:52 -0500 Message-Id: <1DE52B73-301C-4134-AB96-5AF5475BA54F@ericsson.com> From: Christian Vogt To: Marcelo Bagnulo Braun , SAVI Mailing List In-Reply-To: <20090709084910.2qvka4sbw4448k88@webcartero01.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Thu, 9 Jul 2009 13:23:52 -0700 References: <20090709084910.2qvka4sbw4448k88@webcartero01.uc3m.es> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 09 Jul 2009 20:23:52.0999 (UTC) FILETIME=[2D346B70:01CA00D3] Subject: Re: [savi] Suggested Consensus Questions on Protecting Unused Addresses - Take Two X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 09 Jul 2009 20:23:32 -0000 On Jul 8, 2009, MARCELO BAGNULO BRAUN wrote: >> (B) In networks where only DHCP is permitted for address >> configuration, >> how should a SAVI device treat packets with a source address for >> which no DHCP assignment was seen? >> >> (B1) Discard the packet > > In order to answer this question i would like to understand what is > the > impact of the SAVI state being lost in case of a reboot for example. > > I mean, in this case we don't have to worry about loosing the dhcp > packets, cause the dhcp will retransmit until gets an address > assigned, > but we still have to understand the impact of the savi device loosing > state. So, are we going to try to recover the state, are we going to > assume that the state is stored in permanent memory and never gets > lost > or are we going to assume that if it gets lost, the host will have to > renew their dhcp assigment.. or other option that i am missing? Yes, we would have to require either non-volatile binding state, or renewal of DHCP leases by hosts. A question to the working group regarding the latter: What is the behavior of existing DHCP client implementations in the case of state loss in a SAVI device? Would it automatically renew its DHCP leases? Remember that, through manual configuration, one can ensure that only SAVI devices directly attached to a host can drop packets from that host. So if such a SAVI device loses state due to a reboot, the attached host will notice this because its link goes down and back up. Would DHCP client implementations then renew their DHCP leases? - Christian From elevyabe@cisco.com Fri Jul 10 02:56:33 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6E8063A6DC3 for ; Fri, 10 Jul 2009 02:56:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.39 X-Spam-Level: X-Spam-Status: No, score=-10.39 tagged_above=-999 required=5 tests=[AWL=0.209, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2AdYaM8UDHn8 for ; Fri, 10 Jul 2009 02:56:32 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id F2E813A686D for ; Fri, 10 Jul 2009 02:56:31 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,377,1243814400"; d="scan'208";a="44814697" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 10 Jul 2009 09:56:50 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6A9uoSf022730; Fri, 10 Jul 2009 11:56:50 +0200 Received: from xbh-ams-332.emea.cisco.com (xbh-ams-332.cisco.com [144.254.231.87]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6A9uoRg027431; Fri, 10 Jul 2009 09:56:50 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-332.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 10 Jul 2009 11:56:50 +0200 Received: from [144.254.53.107] ([144.254.53.107]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 10 Jul 2009 11:56:49 +0200 Message-ID: <4A571061.3040101@cisco.com> Date: Fri, 10 Jul 2009 11:56:49 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> In-Reply-To: <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 10 Jul 2009 09:56:49.0986 (UTC) FILETIME=[BE8DFA20:01CA0144] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3517; t=1247219810; x=1248083810; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Your=20opinion=20on=20a=20diff erent=20tradeoff=20for=20SAVI |Sender:=20; bh=Lq2nalFwVcJgn4GUGgfuKN4HvRmGkg3wVSDImDAQf/I=; b=MQD0xWBtuoHfEwsX5fcTchTynnSOH6dIuO6Wdf23Q0V3mNz9vYWR95HBdk +wrWAB93xNgXy4CoygJ5JAX9uVaIQgrdzXc90F08/AfZ/+2uX/gN+RqxjoPN uUohzDTHcJ; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: SAVI Mailing List , =?ISO-8859-1?Q?Alberto_?=, =?ISO-8859-1?Q?Garc=EDa?= , Guang Yao Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jul 2009 09:56:33 -0000 Christian, Christian Vogt a écrit : > Thank you, Alberto, for these comments. In addition, I would like to > re-emphasize the following: > > A drop-by-default behavior, in which SAVI devices drop packets for which > they have no binding, doesn't have a benefit in the first place if used > in networks that permit SLAAC. The reason is that, in those networks, a > malicious host can create a binding by itself, by sending a DAD Neighbor > Solicitation message. > > Therefore, rather than pondering whether occasional loss of legitimate > packets is a show-stopper or not for using the drop-by-default behavior > in networks that permit SLAAC, I suggest we rather agree that the drop- > by-default behavior just doesn't make sense in those networks. > Let me play devil advocate here. Forcing the attacker to "register" (it is really what it would be if we were dropping packets without a binding) his binding prior to sending traffic would have some benefits. It would make a lot easier for the switch to control/limit the number of bindings allowed (from a given mac or from a given port). Some attacks rely on using diferent L3 addresses for each packets. On such attack could actually target the logging mechanism which has been proposed here. One way to mitigate it is to keep a state per L3 address, and limit the number of such state till we start dropping. The binding table seems to be the right place for these state. So I am not sure it make no sense as what you claim. Eric > - Christian > > > > On Jul 9, 2009, Alberto García wrote: > >> Hi, Dropping packets when a binding does not exist can lead to some >> occasional but very problematic situations. I add one case that I think >> it has not been commented before: when many switches connect using a >> spanning tree protocol, the unavailability of a switch, or a link >> belonging to the spanning tree triggers the propagation of a Topology >> Change Notification (in RSTP jargon) frame, which is flooded either to a >> subset of the tree or to the whole spanning tree (depending on the >> location of the change, and the identity of the switches involved in the >> change -i.e. root or not). If a port of a switch is affected by the >> topology change, it must flush the addresses learned through that port >> (IEEE Std 802.1w-2001 also accepts to flush the address/port binding for >> all ports). This must result in flushing also SAVI bindings. Therefore, >> hosts may be connected to a switch that has been always available, so >> they won't send DADs again, but the SAVI binding for its address in >> other switches be flushed and its packets dropped. Although switches or >> links may fail occasionally, they certainly do, and I don't think it is >> acceptable to prevent communication in this case. RSTP is built to >> recover reasonably fast on this situation, so adding a SAVI solution >> with this approach defeats part of its purpose. >> >> Other occasional situations that make DAD signaling unreliable are >> layer-2 networks that are connected, networks that power up at the same >> time and RSTP takes more time to make the network functional than hosts >> to detect the switches and send DAD. >> >> Too many "occasionals", from my point of view, affecting to basic >> functionality. >> >> Regards, >> Alberto > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From alberto@it.uc3m.es Fri Jul 10 03:39:24 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C9AAA3A6979 for ; Fri, 10 Jul 2009 03:39:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Iwg+CsiihPT for ; Fri, 10 Jul 2009 03:39:23 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 6F44F3A6924 for ; Fri, 10 Jul 2009 03:39:23 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp01.uc3m.es (Postfix) with ESMTP id AAA17BA6BE1; Fri, 10 Jul 2009 12:39:49 +0200 (CEST) From: =?iso-8859-15?Q?Alberto_Garc=EDa?= To: "'Eric Levy-Abegnoli'" , "'Christian Vogt'" References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> <4A571061.3040101@cisco.com> Date: Fri, 10 Jul 2009 12:39:44 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 Thread-Index: AcoBRL8obsQQc5EUQ0CGgFjitau69wAAsVEg X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <4A571061.3040101@cisco.com> X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16754.006 Cc: 'SAVI Mailing List' , 'Guang Yao' Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jul 2009 10:39:24 -0000 Hi | -----Mensaje original----- | De: Eric Levy-Abegnoli [mailto:elevyabe@cisco.com] | Enviado el: viernes, 10 de julio de 2009 11:57 | Para: Christian Vogt | CC: Dong Zhang; Alberto Garc=EDa; SAVI Mailing List; Guang Yao | Asunto: Re: [savi] Your opinion on a different tradeoff for SAVI | =20 | Christian, | Christian Vogt a =E9crit : | > Thank you, Alberto, for these comments. In addition, I would like = to | > re-emphasize the following: | > | > A drop-by-default behavior, in which SAVI devices drop packets for which | > they have no binding, doesn't have a benefit in the first place if = used | > in networks that permit SLAAC. The reason is that, in those = networks, a | > malicious host can create a binding by itself, by sending a DAD Neighbor | > Solicitation message. | > | > Therefore, rather than pondering whether occasional loss of = legitimate | > packets is a show-stopper or not for using the drop-by-default = behavior | > in networks that permit SLAAC, I suggest we rather agree that the = drop- | > by-default behavior just doesn't make sense in those networks. | > | Let me play devil advocate here. Forcing the attacker to "register" = (it | is really what it would be if we were dropping packets without a | binding) his binding prior to sending traffic would have some = benefits. | It would make a lot easier for the switch to control/limit the number = of | bindings allowed (from a given mac or from a given port). Why? It seems that what you need for the control you want is to have an "unbounded address" table in which you register the addresses being forwarded for which there is no binding. Then, apply for this unbounded address table any kind of limitation you want, as you suggest. This unbounded address table would have for an attacker exactly the same addresses as the binding table in the case you suggest. >From my point of view, the nice thing of DAD is that you give the opportunity to other hosts in the network to stop address configuration = in a host, and this could make a SAVI switch aware that it is not a good idea = to create a binding for the attacker. Yes, this is nice. The problem is = that if you want to obtain this (increased security), you have to scarify the communication of legitimate users that may suffer from its binding state = not being created, or lost during its communication, due to many reasons = being stated in the mailing list.=20 I don't think that this basic functionality could be compromised.=20 If the kind of situation that you mentioned is to be further protected, = by checking if a different binding for this address exists in other = switches, a SAVI protocol should be the option.=20 Regards, Alberto | Some attacks rely on using diferent L3 addresses for each packets. On | such attack could actually target the logging mechanism which has = been | proposed here. One way to mitigate it is to keep a state per L3 = address, | and limit the number of | such state till we start dropping. The binding table seems to be the | right place for these state. | So I am not sure it make no sense as what you claim. | Eric | =20 | > - Christian | > | > | > | > On Jul 9, 2009, Alberto Garc=EDa wrote: | > | >> Hi, Dropping packets when a binding does not exist can lead to = some | >> occasional but very problematic situations. I add one case that I think | >> it has not been commented before: when many switches connect using = a | >> spanning tree protocol, the unavailability of a switch, or a link | >> belonging to the spanning tree triggers the propagation of a = Topology | >> Change Notification (in RSTP jargon) frame, which is flooded = either to a | >> subset of the tree or to the whole spanning tree (depending on the | >> location of the change, and the identity of the switches involved = in the | >> change -i.e. root or not). If a port of a switch is affected by = the | >> topology change, it must flush the addresses learned through that = port | >> (IEEE Std 802.1w-2001 also accepts to flush the address/port = binding for | >> all ports). This must result in flushing also SAVI bindings. Therefore, | >> hosts may be connected to a switch that has been always available, = so | >> they won't send DADs again, but the SAVI binding for its address = in | >> other switches be flushed and its packets dropped. Although = switches or | >> links may fail occasionally, they certainly do, and I don't think = it is | >> acceptable to prevent communication in this case. RSTP is built to | >> recover reasonably fast on this situation, so adding a SAVI = solution | >> with this approach defeats part of its purpose. | >> | >> Other occasional situations that make DAD signaling unreliable are | >> layer-2 networks that are connected, networks that power up at the same | >> time and RSTP takes more time to make the network functional than hosts | >> to detect the switches and send DAD. | >> | >> Too many "occasionals", from my point of view, affecting to basic | >> functionality. | >> | >> Regards, | >> Alberto | > | > | > | > _______________________________________________ | > savi mailing list | > savi@ietf.org | > https://www.ietf.org/mailman/listinfo/savi | > From elevyabe@cisco.com Fri Jul 10 05:10:28 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1143528C10B for ; Fri, 10 Jul 2009 05:10:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.257 X-Spam-Level: X-Spam-Status: No, score=-10.257 tagged_above=-999 required=5 tests=[AWL=0.042, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 930n8wDwR+Hm for ; Fri, 10 Jul 2009 05:10:25 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 9013F3A696F for ; Fri, 10 Jul 2009 05:10:24 -0700 (PDT) X-IronPort-AV: E=Sophos;i="4.42,378,1243814400"; d="scan'208";a="44832322" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 10 Jul 2009 12:10:34 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6ACAYxp002236; Fri, 10 Jul 2009 14:10:34 +0200 Received: from xbh-ams-332.emea.cisco.com (xbh-ams-332.cisco.com [144.254.231.87]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6ACAXgF015600; Fri, 10 Jul 2009 12:10:33 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-332.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 10 Jul 2009 14:10:34 +0200 Received: from [144.254.53.107] ([144.254.53.107]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 10 Jul 2009 14:10:33 +0200 Message-ID: <4A572FB8.8040409@cisco.com> Date: Fri, 10 Jul 2009 14:10:32 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: =?ISO-8859-15?Q?Alberto_Garc=EDa?= References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> <4A571061.3040101@cisco.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 10 Jul 2009 12:10:33.0548 (UTC) FILETIME=[6CF860C0:01CA0157] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=6133; t=1247227834; x=1248091834; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Your=20opinion=20on=20a=20diff erent=20tradeoff=20for=20SAVI |Sender:=20; bh=UCAM0jb+fIu+fsnJEkm4dEzSJVMYnScJATUcNSth64o=; b=g1kuOyB4mg3fOnyEHRwmgtFiOEOdHIzY808dEDh4A2W302tFDvYgyq0l8n NPAZgltAxo0eTpb9m3riWuHiftqVE30ZL2miEXtvVgF20ha5xHxR5vRzej0X evQ3Mn/w6t; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: 'SAVI Mailing List' , 'Christian Vogt' , 'Guang Yao' Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 10 Jul 2009 12:10:28 -0000 Alberto , Alberto García a écrit : > Hi > > | -----Mensaje original----- > | De: Eric Levy-Abegnoli [mailto:elevyabe@cisco.com] > | Enviado el: viernes, 10 de julio de 2009 11:57 > | Para: Christian Vogt > | CC: Dong Zhang; Alberto García; SAVI Mailing List; Guang Yao > | Asunto: Re: [savi] Your opinion on a different tradeoff for SAVI > | > | Christian, > | Christian Vogt a écrit : > | > Thank you, Alberto, for these comments. In addition, I would like to > | > re-emphasize the following: > | > > | > A drop-by-default behavior, in which SAVI devices drop packets for > which > | > they have no binding, doesn't have a benefit in the first place if used > | > in networks that permit SLAAC. The reason is that, in those networks, > a > | > malicious host can create a binding by itself, by sending a DAD > Neighbor > | > Solicitation message. > | > > | > Therefore, rather than pondering whether occasional loss of legitimate > | > packets is a show-stopper or not for using the drop-by-default behavior > | > in networks that permit SLAAC, I suggest we rather agree that the drop- > | > by-default behavior just doesn't make sense in those networks. > | > > | Let me play devil advocate here. Forcing the attacker to "register" (it > | is really what it would be if we were dropping packets without a > | binding) his binding prior to sending traffic would have some benefits. > | It would make a lot easier for the switch to control/limit the number of > | bindings allowed (from a given mac or from a given port). > > Why? It seems that what you need for the control you want is to have an > "unbounded address" table in which you register the addresses being > forwarded for which there is no binding. Then, apply for this unbounded > address table any kind of limitation you want, as you suggest. This > unbounded address table would have for an attacker exactly the same > addresses as the binding table in the case you suggest. > I am sure one can invent many ways of doing the same thing. Your way has issues by using data traffic as control traffic. These are often kept separated, for good reasons. My point was to suggest that the question might be more complex than no binding-drop/binding no-drop.. The policy could be drop-if-no-binding and drop-if-limit-reached. It does not address the concerns raised about dropping improperly, but I think it does address -to some extend- the point of attackers creating bindings prior to launch an attack. Eric > >From my point of view, the nice thing of DAD is that you give the > opportunity to other hosts in the network to stop address configuration in a > host, and this could make a SAVI switch aware that it is not a good idea to > create a binding for the attacker. Yes, this is nice. The problem is that if > you want to obtain this (increased security), you have to scarify the > communication of legitimate users that may suffer from its binding state not > being created, or lost during its communication, due to many reasons being > stated in the mailing list. > I don't think that this basic functionality could be compromised. > > If the kind of situation that you mentioned is to be further protected, by > checking if a different binding for this address exists in other switches, a > SAVI protocol should be the option. > > Regards, > Alberto > > | Some attacks rely on using diferent L3 addresses for each packets. On > | such attack could actually target the logging mechanism which has been > | proposed here. One way to mitigate it is to keep a state per L3 address, > | and limit the number of > | such state till we start dropping. The binding table seems to be the > | right place for these state. > | So I am not sure it make no sense as what you claim. > | Eric > | > | > - Christian > | > > | > > | > > | > On Jul 9, 2009, Alberto García wrote: > | > > | >> Hi, Dropping packets when a binding does not exist can lead to some > | >> occasional but very problematic situations. I add one case that I > think > | >> it has not been commented before: when many switches connect using a > | >> spanning tree protocol, the unavailability of a switch, or a link > | >> belonging to the spanning tree triggers the propagation of a Topology > | >> Change Notification (in RSTP jargon) frame, which is flooded either to > a > | >> subset of the tree or to the whole spanning tree (depending on the > | >> location of the change, and the identity of the switches involved in > the > | >> change -i.e. root or not). If a port of a switch is affected by the > | >> topology change, it must flush the addresses learned through that port > | >> (IEEE Std 802.1w-2001 also accepts to flush the address/port binding > for > | >> all ports). This must result in flushing also SAVI bindings. > Therefore, > | >> hosts may be connected to a switch that has been always available, so > | >> they won't send DADs again, but the SAVI binding for its address in > | >> other switches be flushed and its packets dropped. Although switches > or > | >> links may fail occasionally, they certainly do, and I don't think it > is > | >> acceptable to prevent communication in this case. RSTP is built to > | >> recover reasonably fast on this situation, so adding a SAVI solution > | >> with this approach defeats part of its purpose. > | >> > | >> Other occasional situations that make DAD signaling unreliable are > | >> layer-2 networks that are connected, networks that power up at the > same > | >> time and RSTP takes more time to make the network functional than > hosts > | >> to detect the switches and send DAD. > | >> > | >> Too many "occasionals", from my point of view, affecting to basic > | >> functionality. > | >> > | >> Regards, > | >> Alberto > | > > | > > | > > | > _______________________________________________ > | > savi mailing list > | > savi@ietf.org > | > https://www.ietf.org/mailman/listinfo/savi > | > > > > From zhangdong_rh@huaweisymantec.com Fri Jul 10 18:54:44 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1F4183A6987 for ; Fri, 10 Jul 2009 18:54:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.063 X-Spam-Level: X-Spam-Status: No, score=0.063 tagged_above=-999 required=5 tests=[AWL=-0.042, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_43=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EkCuDbZBmvLn for ; Fri, 10 Jul 2009 18:54:43 -0700 (PDT) Received: from mta2.huaweisymantec.com (unknown [218.17.155.15]) by core3.amsl.com (Postfix) with ESMTP id A91373A68E5 for ; Fri, 10 Jul 2009 18:53:52 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=gb2312 Received: from hstml02-in.huaweisymantec.com ([172.26.3.42]) by hstga02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KML0056BHAAYW30@hstga02-in.huaweisymantec.com> for savi@ietf.org; Sat, 11 Jul 2009 09:54:11 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KML008OMHAAEE00@hstml02-in.huaweisymantec.com> for savi@ietf.org; Sat, 11 Jul 2009 09:54:10 +0800 (CST) Date: Sat, 11 Jul 2009 09:54:10 +0800 From: Dong Zhang To: "Joel M. Halpern" , Fred Baker References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> Message-id: <200907110954097455072@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2009 01:54:44 -0000 Joel wrote: >PS: I tend to like combinations like logs+802.1x (plus simultaneous >usage prevention), or logs+CGA. But I can not tell what assumptions the >WG is prepared to make. Imho, CGA makes it easier to do the source address check.:) I agree CGA is a good thing used here when the source address is configured by CGA. ------------------ Dong Zhang 2009-07-11 From zhangdong_rh@huaweisymantec.com Fri Jul 10 20:56:11 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0D8343A67D8 for ; Fri, 10 Jul 2009 20:56:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.287 X-Spam-Level: X-Spam-Status: No, score=-1.287 tagged_above=-999 required=5 tests=[AWL=1.312, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id r+W4WCN8Qn-4 for ; Fri, 10 Jul 2009 20:56:10 -0700 (PDT) Received: from mta1.huaweisymantec.com (mta1.huaweisymantec.com [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id 2EC563A67D0 for ; Fri, 10 Jul 2009 20:56:10 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=gb2312 Received: from hstml02-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KML0081LMYAZM60@hstga01-in.huaweisymantec.com> for savi@ietf.org; Sat, 11 Jul 2009 11:56:34 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KML008TTMYAEE00@hstml02-in.huaweisymantec.com> for savi@ietf.org; Sat, 11 Jul 2009 11:56:34 +0800 (CST) Date: Sat, 11 Jul 2009 11:56:33 +0800 From: Dong Zhang To: MARCELO BAGNULO BRAUN , "savi@ietf.org" References: <20090709084910.2qvka4sbw4448k88@webcartero01.uc3m.es> Message-id: <200907111156330859482@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Subject: Re: [savi] Suggested Consensus Questions on Protecting UnusedAddresses - Take Two X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2009 03:56:11 -0000 Hi, >> (A2) Forward and optionally log the packet > >I think this is ok, but we may want to do something else, like for >instance, creating a binding. At this point, i am uncertain whether we >should that or not, but i wouldn't discard it yet. (A2) is ok. And I also agree creating a binding for this case. But this kind binding should have something different with the regular bindings. For example, setting a status mark in this special kind binding to indicate the binding is suspicious temporarily. Once makeing sure the binding is true, then change the suspicious into the regular status. About the way how to figure out the binding is true, I have not thought it up. ------------------ Dong Zhang 2009-07-11 From marcelo@it.uc3m.es Sat Jul 11 00:55:09 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCA823A67FE for ; Sat, 11 Jul 2009 00:55:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.239 X-Spam-Level: X-Spam-Status: No, score=-6.239 tagged_above=-999 required=5 tests=[AWL=-0.240, BAYES_00=-2.599, J_CHICKENPOX_43=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 8BWcySr9gGEq for ; Sat, 11 Jul 2009 00:55:09 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 178F93A67F8 for ; Sat, 11 Jul 2009 00:55:08 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (219.pool85-53-147.dynamic.orange.es [85.53.147.219]) by smtp01.uc3m.es (Postfix) with ESMTP id 47F72B48E5C; Sat, 11 Jul 2009 09:55:34 +0200 (CEST) Message-ID: <4A584577.8030901@it.uc3m.es> Date: Sat, 11 Jul 2009 09:55:35 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.21 (Macintosh/20090302) MIME-Version: 1.0 To: Dong Zhang References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> <200907110954097455072@huaweisymantec.com> In-Reply-To: <200907110954097455072@huaweisymantec.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16756.005 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2009 07:55:10 -0000 Dong Zhang escribió: > Joel wrote: > >> PS: I tend to like combinations like logs+802.1x (plus simultaneous >> usage prevention), or logs+CGA. But I can not tell what assumptions the >> WG is prepared to make. >> > Imho, CGA makes it easier to do the source address check.:) > I agree CGA is a good thing used here when the source address is configured > by CGA. > please check the send savi draft about how to use CGAs and SeND for SAVI Regards, marcelo > ------------------ > Dong Zhang > 2009-07-11 > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > From zhangdong_rh@huaweisymantec.com Sat Jul 11 01:29:46 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E70293A63EB for ; Sat, 11 Jul 2009 01:29:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.004 X-Spam-Level: X-Spam-Status: No, score=-0.004 tagged_above=-999 required=5 tests=[AWL=-0.109, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_43=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id D+5ftfMoWLvL for ; Sat, 11 Jul 2009 01:29:46 -0700 (PDT) Received: from mta2.huaweisymantec.com (unknown [218.17.155.15]) by core3.amsl.com (Postfix) with ESMTP id CF9FD3A6B2B for ; Sat, 11 Jul 2009 01:29:12 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=gb2312 Received: from hstml02-in.huaweisymantec.com ([172.26.3.42]) by hstga02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KML005VSZL7YW50@hstga02-in.huaweisymantec.com> for savi@ietf.org; Sat, 11 Jul 2009 16:29:31 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KML008BMZL5EG10@hstml02-in.huaweisymantec.com> for savi@ietf.org; Sat, 11 Jul 2009 16:29:30 +0800 (CST) Date: Sat, 11 Jul 2009 16:29:20 +0800 From: Dong Zhang To: marcelo bagnulo braun References: <5479153C-54D8-4074-A43E-C1E9D6E6FC68@ericsson.com> <4A5176C3.7000506@joelhalpern.com> <262796CF-7EB9-49BD-A099-A335DFA6DF98@cisco.com> <4A525206.9000000@it.uc3m.es> <870EEC89-7363-42BD-AB54-660463026EDB@cisco.com> <4A525956.9080009@it.uc3m.es> <2D01CB4E-E0F7-4CFA-B7EA-2F7F623D3740@cisco.com> <4A528654.3020704@joelhalpern.com> <200907110954097455072@huaweisymantec.com> <4A584577.8030901@it.uc3m.es> Message-id: <200907111629198513730@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Suggested Voting Questions on Protecting Unused Addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2009 08:29:47 -0000 marcelo bagnulo braun 2009-07-11 Wrote: >Dong Zhang escribi? >> Joel wrote: >> >>> PS: I tend to like combinations like logs+802.1x (plus simultaneous >>> usage prevention), or logs+CGA. But I can not tell what assumptions the >>> WG is prepared to make. >>> >> Imho, CGA makes it easier to do the source address check.:) >> I agree CGA is a good thing used here when the source address is configured >> by CGA. >> > >please check the send savi draft about how to use CGAs and SeND for SAVI > I mean CGA provides good features for savi. Yse, after you published this draft, I already have read it. Thank you for the reminder.:) ------------------ Dong Zhang 2009-07-11 From christian.vogt@ericsson.com Sat Jul 11 16:52:13 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B64E3A6C0E for ; Sat, 11 Jul 2009 16:52:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id jdysBfg5s45m for ; Sat, 11 Jul 2009 16:52:12 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id 957413A69DB for ; Sat, 11 Jul 2009 16:52:12 -0700 (PDT) Received: from compute2.internal (compute2.internal [10.202.2.42]) by out1.messagingengine.com (Postfix) with ESMTP id 1011B3B0870; Sat, 11 Jul 2009 19:52:42 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute2.internal (MEProxy); Sat, 11 Jul 2009 19:52:41 -0400 X-Sasl-enc: fXABy+91oFZqUWZ/xF58H4FATFR4ULvLBBLxF5pMmiKx 1247356361 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 1FFE2634E; Sat, 11 Jul 2009 19:52:40 -0400 (EDT) Message-Id: <7FE63818-8A8C-4607-B6B5-ADE2362FC5FE@ericsson.com> From: Christian Vogt To: Eric Levy-Abegnoli In-Reply-To: <4A571061.3040101@cisco.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Sat, 11 Jul 2009 16:52:38 -0700 References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> <4A571061.3040101@cisco.com> X-Mailer: Apple Mail (2.935.3) Cc: SAVI Mailing List , Guang Yao , =?ISO-8859-1?Q?Alberto_Garc=EDa?= Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 11 Jul 2009 23:52:13 -0000 Eric - > Let me play devil advocate here. Forcing the attacker to > "register" (it > is really what it would be if we were dropping packets without a > binding) his binding prior to sending traffic would have some > benefits. > It would make a lot easier for the switch to control/limit the > number of > bindings allowed (from a given mac or from a given port). You are proposing to limit the number of IP addresses a host can use. That's interesting. Have you made some analysis on potential drawbacks this could have? One drawback would, of course, be a risk of dropping legitimate packets after loss of DAD packets; we discussed this before. Are there other drawbacks? Perhaps a need to manually configure switch ports according to whether they attach to a host directly, or to a port trunk? Port trunks clearly would need higher limits on the number of permitted IP addresses than ports that attach to hosts directly. - Christian From zhangdong_rh@huaweisymantec.com Sat Jul 11 21:04:28 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AC5373A68B9 for ; Sat, 11 Jul 2009 21:04:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.35 X-Spam-Level: X-Spam-Status: No, score=-1.35 tagged_above=-999 required=5 tests=[AWL=1.248, BAYES_00=-2.599, HTML_MESSAGE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V29V-rSF-h3s for ; Sat, 11 Jul 2009 21:04:28 -0700 (PDT) Received: from mta2.huaweisymantec.com (mta2.huaweisymantec.com [218.17.155.15]) by core3.amsl.com (Postfix) with ESMTP id D49043A6895 for ; Sat, 11 Jul 2009 21:04:27 -0700 (PDT) MIME-version: 1.0 Content-type: multipart/alternative; boundary="Boundary_(ID_zhryB5Vi2Nq5TsOflI+nhg)" Received: from hstml01-in.huaweisymantec.com ([172.26.3.42]) by hstga02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KMN005YTI07ZD30@hstga02-in.huaweisymantec.com> for savi@ietf.org; Sun, 12 Jul 2009 12:04:55 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KMN005XNI061U00@hstml01-in.huaweisymantec.com> for savi@ietf.org; Sun, 12 Jul 2009 12:04:55 +0800 (CST) Date: Sun, 12 Jul 2009 12:04:54 +0800 From: Dong Zhang To: marcelo Message-id: <200907121204540943699@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Cc: savi Subject: [savi] Another possible DoS attack for FCFS X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 12 Jul 2009 04:04:28 -0000 This is a multi-part message in MIME format. --Boundary_(ID_zhryB5Vi2Nq5TsOflI+nhg) Content-type: text/plain; charset=gb2312 Content-transfer-encoding: 7BIT Hi Marcelo, The fcfs draft shows: "If a valid entry is found and the layer-2 information of the received data packet does not match the information contained in the existing matching entry, then the FCFS SAVI performs a Neighbor Unreachability Detection procedure" Suppose that There is a binding of host A's information in savi device. An attacker sends packets with A's IP address and its own MAC address. Therefore, each time the savi device receives the spoofing packets sent by the attacker, it will generate the NUD msg to host A and A will give response as well. Thus, it forms a kind of amplification DoS attack. I read the security consideration carefully again. It indicates two kind DoS attack, but not includes this type above. Perhaps, I miss something. Regards. 2009-07-12 Dong Zhang --Boundary_(ID_zhryB5Vi2Nq5TsOflI+nhg) Content-type: text/html; charset=gb2312 Content-transfer-encoding: 7BIT
Hi Marcelo,
 
The fcfs draft shows:
      "If a valid entry is found and the layer-2 information of the
      received data packet does not match the information contained in
      the existing matching entry, then the FCFS SAVI performs a
      Neighbor Unreachability Detection procedure"
Suppose that There is a binding of host A's information in savi device. An attacker
sends packets with A's IP address and its own MAC address. Therefore, each time
the savi device receives the spoofing packets sent by the attacker, it will generate
the NUD msg to host A and A will give response as well. Thus, it forms a kind of
amplification DoS attack.
 
I read the security consideration carefully again. It indicates two kind DoS attack,
but not includes this type above. Perhaps, I miss something.
 
 
Regards.
 
2009-07-12
Dong Zhang
 
 --Boundary_(ID_zhryB5Vi2Nq5TsOflI+nhg)-- From christian.vogt@ericsson.com Mon Jul 13 22:04:58 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BA3443A6ADE for ; Mon, 13 Jul 2009 22:04:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Br1FdAp29qZZ for ; Mon, 13 Jul 2009 22:04:57 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id 5D60A3A6A21 for ; Mon, 13 Jul 2009 22:04:57 -0700 (PDT) Received: from compute2.internal (compute2.internal [10.202.2.42]) by out1.messagingengine.com (Postfix) with ESMTP id F0A093B07D6 for ; Tue, 14 Jul 2009 01:04:18 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute2.internal (MEProxy); Tue, 14 Jul 2009 01:04:18 -0400 X-Sasl-enc: d9gf6wywR3oPs2sjRvWw+KipNCt2D76a0BLimfeDPpQy 1247547858 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 7172114CCC for ; Tue, 14 Jul 2009 01:04:18 -0400 (EDT) Message-Id: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> From: Christian Vogt To: SAVI Mailing List Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 13 Jul 2009 21:54:52 -0700 X-Mailer: Apple Mail (2.935.3) Subject: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2009 05:04:58 -0000 Folks - As announced earlier, we will have a consensus call on how SAVI devices should treat source addresses for which no configuration signaling was seen. Consensus questions for this were proposed on July 8, and the feedback received from the working group indicates that those are OK. I would hence like to initiate the consensus call. To participate in the consensus call, please answer by Sunday, July 19, the following two questions (A) and (B), using one of the two possible answers provided for each question: (A) In networks where SLAAC is permitted for address configuration, how should a SAVI device treat packets with a source address for which neither a successful DAD procedure nor a DHCP assignment was seen? (A1) Discard the packet (A2) Forward and optionally log the packet (B) In networks where only DHCP is permitted for address configuration, how should a SAVI device treat packets with a source address for which no DHCP assignment was seen? (B1) Discard the packet (B2) Forward and optionally log the packet In these questions, a SAVI device sees a "successful DAD procedure" for an address if it sees a DAD Neighbor Solicitation message, but no responding DAD Neighbor Advertisement message, for this address. Please recall the relationship of our two main SAVI solution proposals to these consensus questions: The FCFS and CPS solutions both use the combination of (A1) plus (B1), with different means to reduce the probability of dropping legitimate packets. The middle-ground solution we are considering now -- originally suggested in [1] by Marcelo, and slightly augmented in [2] by me with an alternative mode for DHCP-only networks -- uses the combination of (A2) plus (B1). I would like folks to consider in particular this combination of (A2) plus (B1) because it constitutes a reasonable compromise between two competing solutions. Please also recall our working assumption that SAVI will operate exclusively in wired networks, with switch ports constituting the binding anchors. The goal of this working assumption is to relieve the discussion from considerations about scenarios where SAVI can only have limited benefit. Unprotected wireless networks are an example of those scenarios, where forgeable MAC addresses are the only possible binding anchors. We will re-evaluate at a later stage how well SAVI applies to other scenarios. - Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From christian.vogt@ericsson.com Mon Jul 13 22:28:06 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 162C43A6830 for ; Mon, 13 Jul 2009 22:28:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id O1LhkCAHj6L8 for ; Mon, 13 Jul 2009 22:28:04 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id EE7FC3A67D9 for ; Mon, 13 Jul 2009 22:28:03 -0700 (PDT) Received: from compute1.internal (compute1.internal [10.202.2.41]) by out1.messagingengine.com (Postfix) with ESMTP id F228B3B10CE for ; Tue, 14 Jul 2009 01:27:38 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute1.internal (MEProxy); Tue, 14 Jul 2009 01:27:38 -0400 X-Sasl-enc: 9F7o7QubxGMXQdV9HStbw2VWpgHEsU3ZpwEv+un5SAPU 1247549258 Received: from [10.0.1.2] (99-28-160-42.lightspeed.miamfl.sbcglobal.net [99.28.160.42]) by mail.messagingengine.com (Postfix) with ESMTPSA id 7FB7F14CCC for ; Tue, 14 Jul 2009 01:27:38 -0400 (EDT) Message-Id: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> From: Christian Vogt To: SAVI Mailing List Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 13 Jul 2009 22:27:37 -0700 X-Mailer: Apple Mail (2.935.3) Subject: [savi] SAVI agenda at IETF 75 - Please request slots by July 19 X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2009 05:28:06 -0000 Hi folks - For those of you who wish to present at the SAVI session at IETF 75, please send me a note. Please do so before Sunday, July 19. The SAVI session at IETF 75 is currently scheduled for 9:00 am on Thursday, July 30, in room Cabaret of the IETF conference hotel. - Christian From fred@cisco.com Tue Jul 14 01:46:00 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7BADB3A6A18 for ; Tue, 14 Jul 2009 01:46:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.33 X-Spam-Level: X-Spam-Status: No, score=-105.33 tagged_above=-999 required=5 tests=[AWL=1.270, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fx4jLVYSWh2z for ; Tue, 14 Jul 2009 01:45:59 -0700 (PDT) Received: from rtp-iport-2.cisco.com (rtp-iport-2.cisco.com [64.102.122.149]) by core3.amsl.com (Postfix) with ESMTP id E0ECB3A6A0C for ; Tue, 14 Jul 2009 01:45:58 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEADniW0pAZnme/2dsb2JhbAC2Kogjj34FhAg X-IronPort-AV: E=Sophos;i="4.42,396,1243814400"; d="scan'208";a="50290767" Received: from rtp-dkim-1.cisco.com ([64.102.121.158]) by rtp-iport-2.cisco.com with ESMTP; 14 Jul 2009 08:45:35 +0000 Received: from rtp-core-1.cisco.com (rtp-core-1.cisco.com [64.102.124.12]) by rtp-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6E8jZB8021890; Tue, 14 Jul 2009 04:45:35 -0400 Received: from [192.239.36.242] (rtp-vpn2-1202.cisco.com [10.82.244.178]) by rtp-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6E8jZrI007962; Tue, 14 Jul 2009 08:45:35 GMT Message-Id: <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> From: Fred Baker To: Christian Vogt In-Reply-To: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Tue, 14 Jul 2009 04:45:35 -0400 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=3369; t=1247561136; x=1248425136; c=relaxed/simple; s=rtpdkim1001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Re=3A=20[savi]=20Consensus=20call=20on=20=22unr egistered=22=20source=20addresses |Sender:=20 |To:=20Christian=20Vogt=20; bh=HN5sp4UzGe1M64Do2uZX+BkmDjGvMnsGq0hMrNmMzlQ=; b=Gk/nGJ0RxXqXMxDsP7kXby/p85C69Ieyd9tjIHYTSpBZ1O2l261IIFUFtJ 8Z/rLn8GX5iyVnEsSOc8RyjhaWRlzroEwYb1d6u8wX1Z2XbbBVD/eIPaoVyn fiXURCkSda; Authentication-Results: rtp-dkim-1; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/rtpdkim1001 verified; ); Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2009 08:46:00 -0000 I would like to postpone the consensus call until the working group discussion in Sweden has past. I believe that (a) we fundamentally do not have consensus re FCFS vs control-plane- based technologies that monitor DHCP or ND, and that (b) we are more likely to have consensus, or at least our viewpoints will be better-informed, after we have had a chance to discuss them face to face. On Jul 14, 2009, at 12:54 AM, Christian Vogt wrote: > Folks - > > As announced earlier, we will have a consensus call on how SAVI > devices > should treat source addresses for which no configuration signaling was > seen. Consensus questions for this were proposed on July 8, and the > feedback received from the working group indicates that those are OK. > > I would hence like to initiate the consensus call. To participate in > the consensus call, please answer by Sunday, July 19, the following > two > questions (A) and (B), using one of the two possible answers provided > for each question: > > (A) In networks where SLAAC is permitted for address configuration, > how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet > (A2) Forward and optionally log the packet > > (B) In networks where only DHCP is permitted for address > configuration, > how should a SAVI device treat packets with a source address for > which no DHCP assignment was seen? > > (B1) Discard the packet > (B2) Forward and optionally log the packet > > In these questions, a SAVI device sees a "successful DAD procedure" > for > an address if it sees a DAD Neighbor Solicitation message, but no > responding DAD Neighbor Advertisement message, for this address. > > Please recall the relationship of our two main SAVI solution proposals > to these consensus questions: The FCFS and CPS solutions both use the > combination of (A1) plus (B1), with different means to reduce the > probability of dropping legitimate packets. The middle-ground > solution > we are considering now -- originally suggested in [1] by Marcelo, and > slightly augmented in [2] by me with an alternative mode for DHCP-only > networks -- uses the combination of (A2) plus (B1). I would like > folks > to consider in particular this combination of (A2) plus (B1) because > it > constitutes a reasonable compromise between two competing solutions. > > Please also recall our working assumption that SAVI will operate > exclusively in wired networks, with switch ports constituting the > binding anchors. The goal of this working assumption is to relieve > the > discussion from considerations about scenarios where SAVI can only > have > limited benefit. Unprotected wireless networks are an example of those > scenarios, where forgeable MAC addresses are the only possible binding > anchors. We will re-evaluate at a later stage how well SAVI applies > to > other scenarios. > > - Christian > > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html > [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From xiayangsong@huawei.com Tue Jul 14 07:38:33 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9A3D83A63C9 for ; Tue, 14 Jul 2009 07:38:33 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.592 X-Spam-Level: X-Spam-Status: No, score=-0.592 tagged_above=-999 required=5 tests=[AWL=-0.097, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NYtnVs1yZyXS for ; Tue, 14 Jul 2009 07:38:33 -0700 (PDT) Received: from szxga04-in.huawei.com (unknown [119.145.14.67]) by core3.amsl.com (Postfix) with ESMTP id CEEFE28C226 for ; Tue, 14 Jul 2009 07:38:32 -0700 (PDT) Received: from huawei.com (szxga04-in [172.24.2.12]) by szxga04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KMR00KEUZUDGS@szxga04-in.huawei.com> for savi@ietf.org; Tue, 14 Jul 2009 22:20:37 +0800 (CST) Received: from huawei.com ([172.24.1.24]) by szxga04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KMR009V8ZUD8G@szxga04-in.huawei.com> for savi@ietf.org; Tue, 14 Jul 2009 22:20:37 +0800 (CST) Received: from X24512z ([10.124.12.62]) by szxml04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTPA id <0KMR00GGEZUBVV@szxml04-in.huawei.com> for savi@ietf.org; Tue, 14 Jul 2009 22:20:37 +0800 (CST) Date: Tue, 14 Jul 2009 09:20:34 -0500 From: Frank Xia To: Christian Vogt , SAVI Mailing List Message-id: <001601ca048e$421a08b0$3e0c7c0a@china.huawei.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Mailer: Microsoft Outlook Express 6.00.2900.3138 Content-type: text/plain; format=flowed; charset=iso-8859-1; reply-type=response Content-transfer-encoding: 7BIT X-Priority: 3 X-MSMail-priority: Normal References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> Subject: Re: [savi] SAVI agenda at IETF 75 - Please request slots by July 19 X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2009 14:38:33 -0000 Hi Christian We would like 10 minutes for our draft "SAVI for Delegated IPv6 Prefixes" http://tools.ietf.org/id/draft-kaippallimalil-savi-dhcp-pd-00.txt which seems to be covered by current charter. Please check the charter "Solutions are preferably based on observing user traffic,.., and DHCP Prefix Delegation protocols" BR Frank ----- Original Message ----- From: "Christian Vogt" To: "SAVI Mailing List" Sent: Tuesday, July 14, 2009 12:27 AM Subject: [savi] SAVI agenda at IETF 75 - Please request slots by July 19 > Hi folks - > > For those of you who wish to present at the SAVI session at IETF 75, > please send me a note. Please do so before Sunday, July 19. > > The SAVI session at IETF 75 is currently scheduled for 9:00 am on > Thursday, July 30, in room Cabaret of the IETF conference hotel. > > - Christian > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From christian.vogt@ericsson.com Tue Jul 14 10:12:14 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 883DE3A6EE4 for ; Tue, 14 Jul 2009 10:12:14 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.561 X-Spam-Level: X-Spam-Status: No, score=-6.561 tagged_above=-999 required=5 tests=[AWL=0.038, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h9gab98m6IX7 for ; Tue, 14 Jul 2009 10:12:13 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id CC04B3A6816 for ; Tue, 14 Jul 2009 10:12:13 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n6EHBWIv001078; Tue, 14 Jul 2009 12:11:34 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 14 Jul 2009 12:11:17 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Tue, 14 Jul 2009 12:11:17 -0500 Message-Id: <6F6CC890-9554-4E27-A270-040DDDB9D084@ericsson.com> From: Christian Vogt To: Fred Baker , SAVI Mailing List In-Reply-To: <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Tue, 14 Jul 2009 10:11:17 -0700 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 14 Jul 2009 17:11:17.0403 (UTC) FILETIME=[199926B0:01CA04A6] Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2009 17:12:14 -0000 Fred - We had a thorough discussion on the available solution options on this mailing list. In this discussion, three solution options have been identified -- FCFS, CPS, and a middle-ground approach -- and the properties of those have been analyzed. Which aspects, do you think, have not been sufficiently illuminated? What do other working group members think? Is more discussion needed before a consensus call can be made? - Christian On Jul 14, 2009, Fred Baker wrote: > I would like to postpone the consensus call until the working group > discussion in Sweden has past. I believe that > > (a) we fundamentally do not have consensus re FCFS vs > control-plane-based technologies that monitor DHCP or ND, and that > > (b) we are more likely to have consensus, or at least our viewpoints > will be better-informed, after we have had a chance to discuss them > face > to face. From jmh@joelhalpern.com Tue Jul 14 10:36:37 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4EAC528C26E for ; Tue, 14 Jul 2009 10:36:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.867 X-Spam-Level: X-Spam-Status: No, score=-2.867 tagged_above=-999 required=5 tests=[AWL=-0.602, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 92xUeQAopFV8 for ; Tue, 14 Jul 2009 10:36:36 -0700 (PDT) Received: from morbo.mail.tigertech.net (morbo.mail.tigertech.net [67.131.251.54]) by core3.amsl.com (Postfix) with ESMTP id 7A57B28C1B8 for ; Tue, 14 Jul 2009 10:36:36 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by morbo.tigertech.net (Postfix) with ESMTP id 36953A38A9 for ; Tue, 14 Jul 2009 10:35:26 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 1B8F6430332; Tue, 14 Jul 2009 10:30:17 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-172.clppva.btas.verizon.net [71.161.52.172]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 565B143033B; Tue, 14 Jul 2009 10:30:16 -0700 (PDT) Message-ID: <4A5CC0A4.3090206@joelhalpern.com> Date: Tue, 14 Jul 2009 13:30:12 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> <6F6CC890-9554-4E27-A270-040DDDB9D084@ericsson.com> In-Reply-To: <6F6CC890-9554-4E27-A270-040DDDB9D084@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 14 Jul 2009 17:36:37 -0000 I do not think that the properties of the solutions have been analyzed. More importantly, I do not think that the problem we are trying to solve is agreed. As such, adopting a specific approach to specific pieces seems very odd. Yours, Joel Christian Vogt wrote: > Fred - > > We had a thorough discussion on the available solution options on this > mailing list. In this discussion, three solution options have been > identified -- FCFS, CPS, and a middle-ground approach -- and the > properties of those have been analyzed. Which aspects, do you think, > have not been sufficiently illuminated? > > What do other working group members think? Is more discussion needed > before a consensus call can be made? > > - Christian > > > > On Jul 14, 2009, Fred Baker wrote: > >> I would like to postpone the consensus call until the working group >> discussion in Sweden has past. I believe that >> >> (a) we fundamentally do not have consensus re FCFS vs >> control-plane-based technologies that monitor DHCP or ND, and that >> >> (b) we are more likely to have consensus, or at least our viewpoints >> will be better-informed, after we have had a chance to discuss them face >> to face. > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From zhangdong_rh@huaweisymantec.com Tue Jul 14 22:58:25 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8C72E3A688D for ; Tue, 14 Jul 2009 22:58:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.358 X-Spam-Level: X-Spam-Status: No, score=-0.358 tagged_above=-999 required=5 tests=[AWL=0.137, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id DKCAi-9rBfb4 for ; Tue, 14 Jul 2009 22:58:24 -0700 (PDT) Received: from mta1.huaweisymantec.com (unknown [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id 990103A6860 for ; Tue, 14 Jul 2009 22:58:24 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=gb2312 Received: from hstml01-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KMS00I1YYJKX830@hstga01-in.huaweisymantec.com> for savi@ietf.org; Wed, 15 Jul 2009 10:50:08 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KMS00A3XYJJLC10@hstml01-in.huaweisymantec.com> for savi@ietf.org; Wed, 15 Jul 2009 10:50:08 +0800 (CST) Date: Wed, 15 Jul 2009 10:50:08 +0800 From: Dong Zhang To: Christian Vogt , SAVI Mailing List References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> Message-id: <200907151050081554172@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Cc: Padmanabha Nallur 73868 Subject: Re: [savi] SAVI agenda at IETF 75 - Please request slots by July 19 X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2009 05:58:25 -0000 Hi Christian, May I ask for a time slot to depict the use cases of http://tools.ietf.org/id/draft-dong-savi-cga-header-02.txt if possible. Although the proposal may beyond the charter now, we would like to share our consideration with everyone. Many thanks. Christian Vogt 2009-07-14 Wrote: >Hi folks - > >For those of you who wish to present at the SAVI session at IETF 75, >please send me a note. Please do so before Sunday, July 19. > >The SAVI session at IETF 75 is currently scheduled for 9:00 am on >Thursday, July 30, in room Cabaret of the IETF conference hotel. > >- Christian > > >_______________________________________________ >savi mailing list >savi@ietf.org >https://www.ietf.org/mailman/listinfo/savi ------------------ Dong Zhang From alberto@it.uc3m.es Wed Jul 15 02:35:26 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0E17D3A6B8A for ; Wed, 15 Jul 2009 02:35:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MMAOJZmUu4CZ for ; Wed, 15 Jul 2009 02:35:25 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id F1BC73A6B28 for ; Wed, 15 Jul 2009 02:35:24 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp02.uc3m.es (Postfix) with ESMTP id 9233F65A300; Wed, 15 Jul 2009 11:33:57 +0200 (CEST) From: =?iso-8859-15?Q?Alberto_Garc=EDa?= To: "'Dong Zhang'" , "'Christian Vogt'" , "'SAVI Mailing List'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> Date: Wed, 15 Jul 2009 11:33:55 +0200 Message-ID: <75998D9056424F94A34294F878EF8958@bombo> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <200907151050081554172@huaweisymantec.com> Thread-Index: AcoFEVo8qDR10jbiRTK4y3xSbCUFawAHSYHQ X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16764.006 Cc: 'Padmanabha Nallur 73868' Subject: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2009 09:35:26 -0000 Hi, I have joined lately to the list, so I don't know if this has been debated before, but some questions arise to me: Why do you need something different to RFC 5533 (Shim6) to transport "out of the link" CGA-related information? What does this type of solutions has to do with SAVI, considering that the charter says: "No changes to hosts are allowed."? Isn't your solution proposing a change to hosts? Regards Alberto From christian.vogt@ericsson.com Wed Jul 15 09:42:09 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D1EC928C136 for ; Wed, 15 Jul 2009 09:42:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.562 X-Spam-Level: X-Spam-Status: No, score=-6.562 tagged_above=-999 required=5 tests=[AWL=0.037, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ycbPBY7lMiwN for ; Wed, 15 Jul 2009 09:42:09 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id 092A328C12E for ; Wed, 15 Jul 2009 09:42:08 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n6FGfWik006256; Wed, 15 Jul 2009 11:41:36 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.53]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 15 Jul 2009 11:41:21 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 15 Jul 2009 11:41:20 -0500 Message-Id: <794F47D7-800C-4D9F-86C3-8AB88DC0D9A2@ericsson.com> From: Christian Vogt To: "Joel M. Halpern" In-Reply-To: <4A5CC0A4.3090206@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 15 Jul 2009 09:41:20 -0700 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> <6F6CC890-9554-4E27-A270-040DDDB9D084@ericsson.com> <4A5CC0A4.3090206@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 15 Jul 2009 16:41:20.0869 (UTC) FILETIME=[15319150:01CA056B] Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2009 16:42:09 -0000 On Jul 14, 2009, Joel M. Halpern wrote: > I do not think that the properties of the solutions have been > analyzed. > More importantly, I do not think that the problem we are trying to > solve > is agreed. Joel - I will be happy to postpone the consensus call if folks prefer more discussion to better understand the consequences of our various alternatives. Yet the question we are trying to answer, and the background for it, should be clear by now. As per our charter: The problem that SAVI is to solve is insufficiencies of ingress filtering in combatting IP source address spoofing. Hence the charter specifies the goal to "prevent nodes attached to the same IP link from spoofing each other's IP addresses." What the charter doesn't specify is whether hosts should be prevented from using, without explicit (self-) assignment, IP addresses not in use by any other host on the same IP link. This is the question on which we currently have a consensus call. For an analysis of the various alternatives with respect to this consensus call, please see [1] and the subsequent discussion. - Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From jmh@joelhalpern.com Wed Jul 15 10:43:25 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4696328C13C for ; Wed, 15 Jul 2009 10:43:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.825 X-Spam-Level: X-Spam-Status: No, score=-2.825 tagged_above=-999 required=5 tests=[AWL=-0.560, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id i1ngzvZMQpVu for ; Wed, 15 Jul 2009 10:43:24 -0700 (PDT) Received: from morbo.mail.tigertech.net (morbo.mail.tigertech.net [67.131.251.54]) by core3.amsl.com (Postfix) with ESMTP id 9BDD028C17B for ; Wed, 15 Jul 2009 10:43:24 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by morbo.tigertech.net (Postfix) with ESMTP id 85036A37B1 for ; Wed, 15 Jul 2009 10:37:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 6C0264303E9; Wed, 15 Jul 2009 10:37:25 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-172.clppva.btas.verizon.net [71.161.52.172]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id C1E35430363; Wed, 15 Jul 2009 10:37:24 -0700 (PDT) Message-ID: <4A5E13D1.6010309@joelhalpern.com> Date: Wed, 15 Jul 2009 13:37:21 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> <6F6CC890-9554-4E27-A270-040DDDB9D084@ericsson.com> <4A5CC0A4.3090206@joelhalpern.com> <794F47D7-800C-4D9F-86C3-8AB88DC0D9A2@ericsson.com> In-Reply-To: <794F47D7-800C-4D9F-86C3-8AB88DC0D9A2@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 15 Jul 2009 17:43:25 -0000 Interesting. Given how you are describe it, you are saying that preventing use of unassigned addresses is a charter extension. If so, we should first figure out if we want to do that at all, and then determine which cases we think we can / should solve. ? Joel Christian Vogt wrote: > On Jul 14, 2009, Joel M. Halpern wrote: > >> I do not think that the properties of the solutions have been analyzed. >> More importantly, I do not think that the problem we are trying to solve >> is agreed. > > > Joel - > > I will be happy to postpone the consensus call if folks prefer more > discussion to better understand the consequences of our various > alternatives. Yet the question we are trying to answer, and the > background for it, should be clear by now. > > As per our charter: The problem that SAVI is to solve is > insufficiencies of ingress filtering in combatting IP source address > spoofing. Hence the charter specifies the goal to "prevent nodes > attached to the same IP link from spoofing each other's IP addresses." > > What the charter doesn't specify is whether hosts should be prevented > from using, without explicit (self-) assignment, IP addresses not in use > by any other host on the same IP link. This is the question on which we > currently have a consensus call. > > For an analysis of the various alternatives with respect to this > consensus call, please see [1] and the subsequent discussion. > > - Christian > > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html > > > > From christian.vogt@ericsson.com Wed Jul 15 19:14:36 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B1E563A6FAA for ; Wed, 15 Jul 2009 19:14:36 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.565 X-Spam-Level: X-Spam-Status: No, score=-6.565 tagged_above=-999 required=5 tests=[AWL=0.034, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C6tOq6ZCVt89 for ; Wed, 15 Jul 2009 19:14:36 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id 8FB4D3A6FAF for ; Wed, 15 Jul 2009 19:13:57 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n6G2DoXq023151; Wed, 15 Jul 2009 21:13:50 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.56]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 15 Jul 2009 21:12:44 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Wed, 15 Jul 2009 21:12:43 -0500 Message-Id: <69EB9233-3FBD-4404-94ED-5BA8F056FB7E@ericsson.com> From: Christian Vogt To: "Joel M. Halpern" In-Reply-To: <4A5E13D1.6010309@joelhalpern.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 15 Jul 2009 19:12:43 -0700 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4F836792-A51D-4434-88E9-C47B886D01B5@cisco.com> <6F6CC890-9554-4E27-A270-040DDDB9D084@ericsson.com> <4A5CC0A4.3090206@joelhalpern.com> <794F47D7-800C-4D9F-86C3-8AB88DC0D9A2@ericsson.com> <4A5E13D1.6010309@joelhalpern.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 16 Jul 2009 02:12:43.0798 (UTC) FILETIME=[E7696360:01CA05BA] Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2009 02:14:36 -0000 Joel - > Interesting. Given how you are describe it, you are saying that > preventing use of unassigned addresses is a charter extension. Yes, strictly speaking, preventing use of unregistered addresses goes beyond our charter. Whether it requires a charter extension would have to be discussed with the area directors. The charter was deliberately written to give the working group liberties with respect to the design of a SAVI solution. So we may find that no charter extension is needed. Otherwise, I don't think a charter extension would be a big deal. > If so, we should first figure out if we want to do that at all, and > then > determine which cases we think we can / should solve. Agreed. And this is what we are doing right now; it is the topic of the ongoing consensus call. The reason we are already now thinking of specific cases in which use of unregistered addresses should be prevented -- rather than first only thinking of whether we want to prevent such use in general -- is that the benefits and costs of doing it strongly depend on the permitted address configuration methods. - Christian From zhangdong_rh@huaweisymantec.com Wed Jul 15 20:22:09 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1AA6C3A6A0A for ; Wed, 15 Jul 2009 20:22:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.214 X-Spam-Level: X-Spam-Status: No, score=-0.214 tagged_above=-999 required=5 tests=[AWL=-0.019, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bEIFm0CtzVfr for ; Wed, 15 Jul 2009 20:22:08 -0700 (PDT) Received: from mta1.huaweisymantec.com (unknown [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id 484D53A698A for ; Wed, 15 Jul 2009 20:22:08 -0700 (PDT) MIME-version: 1.0 Content-transfer-encoding: 7BIT Content-type: text/plain; charset=gb2312 Received: from hstml01-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KMU004FDRQZW950@hstga01-in.huaweisymantec.com> for savi@ietf.org; Thu, 16 Jul 2009 10:18:36 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KMU005ZXRQZAT00@hstml01-in.huaweisymantec.com> for savi@ietf.org; Thu, 16 Jul 2009 10:18:35 +0800 (CST) Date: Thu, 16 Jul 2009 10:18:35 +0800 From: Dong Zhang To: =?gb2312?B?QWxiZXJ0b19HYXJj7WE=?= , 'Christian Vogt' , 'SAVI Mailing List' References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> Message-id: <200907161018350396693@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Cc: 'Padmanabha Nallur 73868' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2009 03:22:09 -0000 Hi Alberto, Thanks for your questions. Alberto 2009-07-15 Wrote: >Hi, >I have joined lately to the list, so I don't know if this has been debated >before, but some questions arise to me: > >Why do you need something different to RFC 5533 (Shim6) to transport "out of >the link" CGA-related information? Because CGA has the good characteristic to prove the address ownership, we should use it if possible. I do not think it is a conflict. The difference is just how to use CGA. For instance, the CGA proposal can be used in e2e, even between the host and the first-hop router. It can depend on the destination option header. > >What does this type of solutions has to do with SAVI, considering that the >charter says: "No changes to hosts are allowed."? Isn't your solution >proposing a change to hosts? Yes, the CGA proposal does not fit for the current charter quit well to some extend. The reason why we put the CGA-related info in the extension header is that it has the ability to provide a basic security for the source address like AH & ESP. The we get the whole security in IP layer, including integrity, confidentiality and authentication. > >Regards >Alberto > ------------------ Dong Zhang 2009-07-16 From alberto@it.uc3m.es Thu Jul 16 02:24:25 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 31F6D3A6CBB for ; Thu, 16 Jul 2009 02:24:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2wQLCcFbjfgw for ; Thu, 16 Jul 2009 02:24:24 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id 0F46A3A6A38 for ; Thu, 16 Jul 2009 02:24:02 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp03.uc3m.es (Postfix) with ESMTP id 6C03D731F09; Thu, 16 Jul 2009 11:24:20 +0200 (CEST) From: =?iso-8859-15?Q?Alberto_Garc=EDa?= To: "'Dong Zhang'" , "'Christian Vogt'" , "'SAVI Mailing List'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> Date: Thu, 16 Jul 2009 11:24:19 +0200 Message-ID: <16C7F3CCDE434470AF2D409B79B70A8E@bombo> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <200907161018350396693@huaweisymantec.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Thread-Index: AcoFu7xSKhqSZ5v1QjCQSHj9z6tDhwAOKtaQ X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16766.005 Cc: 'Padmanabha Nallur 73868' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2009 09:24:25 -0000 Hi | -----Mensaje original----- | De: Dong Zhang [mailto:zhangdong_rh@huaweisymantec.com] | Enviado el: jueves, 16 de julio de 2009 4:19 | Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | CC: 'Padmanabha Nallur 73868' | Asunto: Re: About draft-dong-savi-cga-header-02.txt | | Hi Alberto, | | Thanks for your questions. | Alberto 2009-07-15 Wrote: | >Hi, | >I have joined lately to the list, so I don't know if this has been debated | >before, but some questions arise to me: | > | >Why do you need something different to RFC 5533 (Shim6) to transport "out of | >the link" CGA-related information? | Because CGA has the good characteristic to prove the address ownership, we | should use it if possible. I agree | I do not think it is a conflict. The difference is just how to | use CGA. For instance, the CGA proposal can be used in e2e, even between the | host | and the first-hop router. It can depend on the destination option header. Shim6 allows transporting CGA information end-to-end. It does that now, in a standard way. Why you should want to generate a yet-another-protocol to transport CGA information end-to-end? Besides, what does such a protocol would have to do with SAVI? If you want to use CGAs for providing security in the link of the host and the first-hop router, you should probably use the SEND protocol (see draft-ietf-savi-send-00). Do you think there is something in the SEND protocol that does not suit with binding IPv6 addresses and link layer anchors, that could be improved? And if you want to use the CGA for address validation further than the first hop routers, I see some reasons why you should not: at that point you need to validate prefixes, not host addresses, and CGA provides no protection for prefixes: any host can generate a valid CGA with whichever prefix it wanted. So just validating a CGA does not assure that the host is authorized to use that prefix. | > | >What does this type of solutions has to do with SAVI, considering that the | >charter says: "No changes to hosts are allowed."? Isn't your solution | >proposing a change to hosts? | Yes, the CGA proposal does not fit for the current charter quit well to some | extend. | The reason why we put the CGA-related info in the extension header is that it | has | the ability to provide a basic security for the source address like AH & ESP. The The CGA security model does not have much relationship with AH & ESP. Well, all use keys, but besides that... | we | get the whole security in IP layer, including integrity, confidentiality and | authentication. I think this is completely different stuff than SAVI. Regards, Alberto | > | >Regards | >Alberto | > | | | ------------------ | Dong Zhang | 2009-07-16 From elevyabe@cisco.com Thu Jul 16 06:02:27 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 805C93A6924 for ; Thu, 16 Jul 2009 06:02:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.411 X-Spam-Level: X-Spam-Status: No, score=-10.411 tagged_above=-999 required=5 tests=[AWL=0.188, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MmHH9bLCrDBI for ; Thu, 16 Jul 2009 06:02:26 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 1A0663A67F9 for ; Thu, 16 Jul 2009 06:02:25 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AlkAAPPAXkqQ/uCKe2dsb2JhbACZPAEBFiQGnXWII5EPBYQL X-IronPort-AV: E=Sophos;i="4.42,411,1243814400"; d="scan'208";a="45240786" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 16 Jul 2009 13:01:08 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6GD18Xn006055; Thu, 16 Jul 2009 15:01:08 +0200 Received: from xbh-ams-102.cisco.com (xbh-ams-102.cisco.com [144.254.73.132]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6GD18XX014805; Thu, 16 Jul 2009 13:01:08 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-102.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 16 Jul 2009 15:01:08 +0200 Received: from [144.254.53.99] ([144.254.53.99]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 16 Jul 2009 15:01:06 +0200 Message-ID: <4A5F2492.5010505@cisco.com> Date: Thu, 16 Jul 2009 15:01:06 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> <4A571061.3040101@cisco.com> <7FE63818-8A8C-4607-B6B5-ADE2362FC5FE@ericsson.com> In-Reply-To: <7FE63818-8A8C-4607-B6B5-ADE2362FC5FE@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 16 Jul 2009 13:01:06.0777 (UTC) FILETIME=[7B64E490:01CA0615] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1492; t=1247749268; x=1248613268; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Your=20opinion=20on=20a=20diff erent=20tradeoff=20for=20SAVI |Sender:=20; bh=1Sk1wq5naHohDIlzCPIS32dbpzCJn3yaAqWrQS2/zVo=; b=nQp7G+s14+rLzIm2ARUd6Io9uSbGuOACDxdabt7ZYVWXZ6jtLIUzXx+Ib3 ZUnJcScFOPyUX3fVKQGZ8Do3MJNM7CwKWNz8ij8ly+cw+IMGdNHaqvr5IEw3 tuDAI4rtja; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: SAVI Mailing List , Guang Yao , =?ISO-8859-1?Q?Alberto_Garc=EDa?= Subject: Re: [savi] Your opinion on a different tradeoff for SAVI X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2009 13:02:27 -0000 Christian, Christian Vogt a écrit : > Eric - > >> Let me play devil advocate here. Forcing the attacker to "register" (it >> is really what it would be if we were dropping packets without a >> binding) his binding prior to sending traffic would have some benefits. >> It would make a lot easier for the switch to control/limit the number of >> bindings allowed (from a given mac or from a given port). > > You are proposing to limit the number of IP addresses a host can use. that would have a couple a benefits: protection against an attacker trying to fill the switch binding table, as well as preventing an attacker from (dad-)registering one distinct address per packet sent, just for the sake of not being catched. It has also the potential of controling number of addresses per node/mac/port, but this goal is different, and is not what I had in mind). > That's interesting. Have you made some analysis on potential drawbacks > this could have? One drawback would, of course, be a risk of dropping > legitimate packets after loss of DAD packets; we discussed this before. > Are there other drawbacks? Perhaps a need to manually configure switch > ports according to whether they attach to a host directly, or to a port > trunk? Port trunks clearly would need higher limits on the number of > permitted IP addresses than ports that attach to hosts directly Yes if the limit is per-port. No if the limit is per mac. Eric > . > > - Christian > > > From christian.vogt@ericsson.com Thu Jul 16 10:06:04 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BE5E03A6809 for ; Thu, 16 Jul 2009 10:06:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.566 X-Spam-Level: X-Spam-Status: No, score=-6.566 tagged_above=-999 required=5 tests=[AWL=0.033, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YOEL9j91TNDS for ; Thu, 16 Jul 2009 10:06:03 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id D3DE93A6938 for ; Thu, 16 Jul 2009 10:06:03 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n6GH6Kef006022; Thu, 16 Jul 2009 12:06:21 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Thu, 16 Jul 2009 12:05:43 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Thu, 16 Jul 2009 12:05:42 -0500 Message-Id: From: Christian Vogt To: Eric Levy-Abegnoli In-Reply-To: <4A5F2492.5010505@cisco.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Thu, 16 Jul 2009 10:05:43 -0700 References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> <4A571061.3040101@cisco.com> <7FE63818-8A8C-4607-B6B5-ADE2362FC5FE@ericsson.com> <4A5F2492.5010505@cisco.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 16 Jul 2009 17:05:42.0968 (UTC) FILETIME=[A715EB80:01CA0637] Cc: SAVI Mailing List , Guang Yao , =?ISO-8859-1?Q?Alberto_Garc=EDa?= Subject: [savi] Limiting # IP addresses per binding anchor X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Jul 2009 17:06:04 -0000 Forked from thread "Your opinion on a different tradeoff for SAVI". On Jul 16, 2009, Eric Levy-Abegnoli wrote: >> You are proposing to limit the number of IP addresses a host can use. > > > that would have a couple a benefits: protection against an attacker > trying to fill the switch binding table, as well as preventing an > attacker from (dad-)registering one distinct address per packet sent, > just for the sake of not being catched. It has also the potential of > controling number of addresses per node/mac/port, but this goal is > different, and is not what I had in mind). Yes, but let's be careful. Benefit #2 is certainly an advantage, i.e., preventing an attacker from registering a arbitrary amount of IP addresses. It basically provides you a means to protect unregistered IP addresses. But for benefits #1 and #3, things are a bit different: Benefit #1, preventing an attacker from filling the binding table, is something that you also get when unregistered IP addresses are not protected. And benefit #3, controlling the number of addresses per binding anchor, is not a goal of SAVI. So let's focus on benefit #2. >> That's interesting. Have you made some analysis on potential >> drawbacks >> this could have? One drawback would, of course, be a risk of >> dropping >> legitimate packets after loss of DAD packets; we discussed this >> before. >> Are there other drawbacks? Perhaps a need to manually configure >> switch >> ports according to whether they attach to a host directly, or to a >> port >> trunk? Port trunks clearly would need higher limits on the number of >> permitted IP addresses than ports that attach to hosts directly > > Yes if the limit is per-port. No if the limit is per mac. Right. But let's focus on ports as binding anchors for now. That's our working assumption, because MAC addresses as binding anchors are spoofable without link-layer protection, and hence significantly reduce the benefit of SAVI in the first place. This includes any extra benefits you may get from limiting the number of IP addresses per binding anchor. My conclusion is that a limit on the number of IP addresses per binding anchor can provide a means for protecting unregistered IP addresses in networks where SLAAC is permitted. The cost of this is careful manual configuration in the case where binding anchors are switch ports. Careful, because misconfiguration can have the consequence of preventing legitimate communications. Agree? - Christian From zhangdong_rh@huaweisymantec.com Thu Jul 16 23:51:05 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 257A53A6359 for ; Thu, 16 Jul 2009 23:51:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.663 X-Spam-Level: X-Spam-Status: No, score=0.663 tagged_above=-999 required=5 tests=[AWL=-0.895, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4165UOHR1mgE for ; Thu, 16 Jul 2009 23:51:04 -0700 (PDT) Received: from mta2.huaweisymantec.com (unknown [218.17.155.15]) by core3.amsl.com (Postfix) with ESMTP id 2AE123A6D34 for ; Thu, 16 Jul 2009 23:51:04 -0700 (PDT) MIME-version: 1.0 Content-type: text/plain; charset=gb2312 Received: from hstml01-in.huaweisymantec.com ([172.26.3.42]) by hstga02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KMW00EZBZ03SG70@hstga02-in.huaweisymantec.com> for savi@ietf.org; Fri, 17 Jul 2009 14:50:27 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KMW00MF8Z02TL10@hstml01-in.huaweisymantec.com> for savi@ietf.org; Fri, 17 Jul 2009 14:50:27 +0800 (CST) Date: Fri, 17 Jul 2009 14:50:26 +0800 From: Dong Zhang To: =?gb2312?B?QWxiZXJ0b19HYXJj7WE=?= , 'Christian Vogt' , 'SAVI Mailing List' References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> Message-id: <200907171450265993512@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Content-transfer-encoding: base64 Cc: 'Padmanabha Nallur 73868' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2009 06:51:05 -0000 QWxiZXJ0b19HYXJj7WEgMjAwOS0wNy0xNiBXcm90ZToNCj58ICBJIGRvIG5vdCB0aGluayBpdCBp cyBhIGNvbmZsaWN0LiBUaGUgZGlmZmVyZW5jZSBpcyBqdXN0IGhvdyB0bw0KPnwgIHVzZSBDR0Eu IEZvciBpbnN0YW5jZSwgdGhlIENHQSBwcm9wb3NhbCBjYW4gYmUgdXNlZCBpbiBlMmUsIGV2ZW4g YmV0d2Vlbg0KPnRoZQ0KPnwgIGhvc3QNCj58ICBhbmQgdGhlIGZpcnN0LWhvcCByb3V0ZXIuIEl0 IGNhbiBkZXBlbmQgb24gdGhlIGRlc3RpbmF0aW9uIG9wdGlvbiBoZWFkZXIuDQo+DQo+U2hpbTYg YWxsb3dzIHRyYW5zcG9ydGluZyBDR0EgaW5mb3JtYXRpb24gZW5kLXRvLWVuZC4gSXQgZG9lcyB0 aGF0IG5vdywgaW4gYQ0KPnN0YW5kYXJkIHdheS4gV2h5IHlvdSBzaG91bGQgd2FudCB0byBnZW5l cmF0ZSBhIHlldC1hbm90aGVyLXByb3RvY29sIHRvDQo+dHJhbnNwb3J0IENHQSBpbmZvcm1hdGlv biBlbmQtdG8tZW5kPw0KVGhhbmsgeW91IGZvciB0aGUgaW5mb3JtYXRpb24uDQpXZSB3aWxsIHJl YWQgU2hpbTYuIElmIGl0IHJlYWxseSBkb2VzIHRoZSByZWxhdGl2ZSBqb2IsIHdlIHdpbGwgYmUg Z2xhZCB0byB1c2UgaXQuDQo+DQo+QmVzaWRlcywgd2hhdCBkb2VzIHN1Y2ggYSBwcm90b2NvbCB3 b3VsZCBoYXZlIHRvIGRvIHdpdGggU0FWST8NCj5JZiB5b3Ugd2FudCB0byB1c2UgQ0dBcyBmb3Ig cHJvdmlkaW5nIHNlY3VyaXR5IGluIHRoZSBsaW5rIG9mIHRoZSBob3N0IGFuZA0KPnRoZSBmaXJz dC1ob3Agcm91dGVyLCB5b3Ugc2hvdWxkIHByb2JhYmx5IHVzZSB0aGUgU0VORCBwcm90b2NvbCAo c2VlDQo+ZHJhZnQtaWV0Zi1zYXZpLXNlbmQtMDApLiBEbyB5b3UgdGhpbmsgdGhlcmUgaXMgc29t ZXRoaW5nIGluIHRoZSBTRU5EDQo+cHJvdG9jb2wgdGhhdCBkb2VzIG5vdCBzdWl0IHdpdGggYmlu ZGluZyBJUHY2IGFkZHJlc3NlcyBhbmQgbGluayBsYXllcg0KPmFuY2hvcnMsIHRoYXQgY291bGQg YmUgaW1wcm92ZWQ/DQo+QW5kIGlmIHlvdSB3YW50IHRvIHVzZSB0aGUgQ0dBIGZvciBhZGRyZXNz IHZhbGlkYXRpb24gZnVydGhlciB0aGFuIHRoZSBmaXJzdA0KPmhvcCByb3V0ZXJzLCBJIHNlZSBz b21lIHJlYXNvbnMgd2h5IHlvdSBzaG91bGQgbm90OiAgYXQgdGhhdCBwb2ludCB5b3UgbmVlZA0K PnRvIHZhbGlkYXRlIHByZWZpeGVzLCBub3QgaG9zdCBhZGRyZXNzZXMsIGFuZCBDR0EgcHJvdmlk ZXMgbm8gcHJvdGVjdGlvbiBmb3INCj5wcmVmaXhlczogYW55IGhvc3QgY2FuIGdlbmVyYXRlIGEg dmFsaWQgQ0dBIHdpdGggd2hpY2hldmVyIHByZWZpeCBpdCB3YW50ZWQuDQo+U28ganVzdCB2YWxp ZGF0aW5nIGEgQ0dBIGRvZXMgbm90IGFzc3VyZSB0aGF0IHRoZSBob3N0IGlzIGF1dGhvcml6ZWQg dG8gdXNlDQo+dGhhdCBwcmVmaXguDQpJbiB0aGUgQ0dBLXJlbGF0ZWQgaW5mb3JtYXRpb24sIGl0 IGNvbnRhaW5zIHRoZSBzaWduYXR1cmUuIFdlIHRoaW5rIGl0IGNhbiANCnByb3RlY3QgdGhlIHBy ZWZpeC4gUmlnaHQ/IA0KPg0KPnwgID4NCj58ICA+V2hhdCBkb2VzIHRoaXMgdHlwZSBvZiBzb2x1 dGlvbnMgaGFzIHRvIGRvIHdpdGggU0FWSSwgY29uc2lkZXJpbmcgdGhhdA0KPnRoZQ0KPnwgID5j aGFydGVyIHNheXM6ICJObyBjaGFuZ2VzIHRvIGhvc3RzIGFyZSBhbGxvd2VkLiI/IElzbid0IHlv dXIgc29sdXRpb24NCj58ICA+cHJvcG9zaW5nIGEgY2hhbmdlIHRvIGhvc3RzPw0KPnwgIFllcywg dGhlIENHQSBwcm9wb3NhbCBkb2VzIG5vdCBmaXQgZm9yIHRoZSBjdXJyZW50IGNoYXJ0ZXIgcXVp dCB3ZWxsIHRvDQo+c29tZQ0KPnwgIGV4dGVuZC4NCj58ICBUaGUgcmVhc29uIHdoeSB3ZSBwdXQg dGhlIENHQS1yZWxhdGVkIGluZm8gaW4gdGhlIGV4dGVuc2lvbiBoZWFkZXIgaXMNCj50aGF0IGl0 DQo+fCAgaGFzDQo+fCAgdGhlIGFiaWxpdHkgdG8gcHJvdmlkZSBhIGJhc2ljIHNlY3VyaXR5IGZv ciB0aGUgc291cmNlIGFkZHJlc3MgbGlrZSBBSCAmDQo+RVNQLiBUaGUNCj4NCj5UaGUgQ0dBIHNl Y3VyaXR5IG1vZGVsIGRvZXMgbm90IGhhdmUgbXVjaCByZWxhdGlvbnNoaXAgd2l0aCBBSCAmIEVT UC4gV2VsbCwNCj5hbGwgdXNlIGtleXMsIGJ1dCBiZXNpZGVzIHRoYXQuLi4NCkkgbWVhbiBpZiB3 ZSBjb3VsZCB0YWtlIHRoZSBDR0EtcmVsYXRlZCBpbmZvcm1hdGlvbiBpbiB0aGUgZXh0ZW5zaW9u IGhlYWRlciwgDQp0aGUgcGFja2V0IHdpbGwgaGF2ZSBBSCwgRVNQIGFuZCBDR0EgZm9yIHRoZSBi YXNpYyBzZWN1cml0eSBjaGFyYWN0ZXJpc3RpY3MsIA0KaW5jbHVkaW5nIGludGVncml0eSwgY29u ZmlkZW50aWFsaXR5LCBhbmQgYXV0aGVudGljYXRpb24uDQo+DQo+fCAgd2UNCj58ICBnZXQgdGhl IHdob2xlIHNlY3VyaXR5IGluIElQIGxheWVyLCBpbmNsdWRpbmcgaW50ZWdyaXR5LCBjb25maWRl bnRpYWxpdHkNCj5hbmQNCj58ICBhdXRoZW50aWNhdGlvbi4NCj4NCj5JIHRoaW5rIHRoaXMgaXMg Y29tcGxldGVseSBkaWZmZXJlbnQgc3R1ZmYgdGhhbiBTQVZJLiANCkluIGFueSBjYXNlLCB3ZSBh cmUgdHJ5aW5nIHRvIHNlZSBpZiBzb21lb25lIGVsc2UgaXMgaW1wZXJzb25hdGluZyAob3IgdXNp bmcpIA0KdGhlIGFkZHJlc3MuIFNvIHNhdmkgaXMgdGhlIGNsb3Nlc3QgaW4gdGhlIGN1cnJlbnQg V0dzLiBPZiBjb3Vyc2UsIHdlIGFyZSBvcGVuIHRvDQpsb29raW5nIGF0IHRoaXMgYW5kIGxvb2tp bmcgZm9yIGludGVyc2V0IGluIGFueSByZWxhdGVkIFdHLg0KPg0KPlJlZ2FyZHMsDQo+QWxiZXJ0 bw0KPg0KDQpUaGFua3MNCi0tLS0tLS0tLS0tLS0tLS0tLQkJCQkgDQpEb25nIFpoYW5nICAgICAg ICAgICANCjIwMDktMDctMTcNCg== From alberto@it.uc3m.es Fri Jul 17 01:16:27 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 614D03A683B for ; Fri, 17 Jul 2009 01:16:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id R4g8ADQ7fM-1 for ; Fri, 17 Jul 2009 01:16:26 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 1FFD33A696D for ; Fri, 17 Jul 2009 01:16:25 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp02.uc3m.es (Postfix) with ESMTP id 45D976C1473; Fri, 17 Jul 2009 10:16:57 +0200 (CEST) From: =?utf-8?Q?Alberto_Garc=C3=ADa?= To: "'Dong Zhang'" , "'Christian Vogt'" , "'SAVI Mailing List'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com><200907151050081554172@huaweisymantec.com><75998D9056424F94A34294F878EF8958@bombo><200907161018350396693@huaweisymantec.com><16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> Date: Fri, 17 Jul 2009 10:16:54 +0200 Message-ID: <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <200907171450265993512@huaweisymantec.com> Thread-Index: AcoGqwvDagW6cGwuQQuV2gX+Ke2fjQAA4UEg X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16768.004 Cc: 'Padmanabha Nallur 73868' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2009 08:16:27 -0000 Hi | -----Mensaje original----- | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de = Dong | Zhang | Enviado el: viernes, 17 de julio de 2009 8:50 | Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | CC: 'Padmanabha Nallur 73868' | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Alberto_Garc=E9=9F=86 2009-07-16 Wrote: | >| I do not think it is a conflict. The difference is just how to | >| use CGA. For instance, the CGA proposal can be used in e2e, even = between | >the | >| host | >| and the first-hop router. It can depend on the destination option = header. | > | >Shim6 allows transporting CGA information end-to-end. It does that = now, in a | >standard way. Why you should want to generate a yet-another-protocol = to | >transport CGA information end-to-end? | Thank you for the information. | We will read Shim6. If it really does the relative job, we will be = glad to use it. | > | >Besides, what does such a protocol would have to do with SAVI? | >If you want to use CGAs for providing security in the link of the = host and | >the first-hop router, you should probably use the SEND protocol (see | >draft-ietf-savi-send-00). Do you think there is something in the = SEND | >protocol that does not suit with binding IPv6 addresses and link = layer | >anchors, that could be improved? | >And if you want to use the CGA for address validation further than = the first | >hop routers, I see some reasons why you should not: at that point = you need | >to validate prefixes, not host addresses, and CGA provides no = protection for | >prefixes: any host can generate a valid CGA with whichever prefix it = wanted. | >So just validating a CGA does not assure that the host is authorized = to use | >that prefix. | In the CGA-related information, it contains the signature. We think = it can | protect the prefix. Right? Well, it does not prove that a host has been legitimately assigned a = prefix.=20 CGAs, with a protocol transporting signatures made with the private key, = only assure that once a host generates a given address, it is very very = difficult for another host to use the same address. And yes, the = protection includes the prefix: it is just not enough to find a key pair = whose hash generates a given interface identifier, and then you can = impersonate any host with the same interface identifier in any network = (i.e. with any prefix). But that says nothing about the legitimacy of ah host to use that = prefix. For example, give the prefix of your network, and I can generate = immediately an CGA that claims to belong to your prefix: CGA =3D hash ( = prefix | public key | etc). And I can use from my network, if the router = (and some routers above) does not check source prefixes. Looking only at = the CGA nobody can know if my host is authorized to use a prefix or not. So, CGA does not add anything to prefix protection. You have to provide = other means to protect that.=20 | > | >| > | >| >What does this type of solutions has to do with SAVI, = considering that | >the | >| >charter says: "No changes to hosts are allowed."? Isn't your = solution | >| >proposing a change to hosts? | >| Yes, the CGA proposal does not fit for the current charter quit = well to | >some | >| extend. | >| The reason why we put the CGA-related info in the extension = header is | >that it | >| has | >| the ability to provide a basic security for the source address = like AH & | >ESP. The | > | >The CGA security model does not have much relationship with AH & = ESP. Well, | >all use keys, but besides that... | I mean if we could take the CGA-related information in the extension = header, | the packet will have AH, ESP and CGA for the basic security = characteristics, | including integrity, confidentiality, and authentication. This is completely different stuff. It seems like generating an = opportunistic IKE security context (a la SSL) for a communication, = starting with the public/private key pair associated to the CGAs of two = hosts. Then you should look at = http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt Regards Alberto | > | >| we | >| get the whole security in IP layer, including integrity, = confidentiality | >and | >| authentication. | > | >I think this is completely different stuff than SAVI. | In any case, we are trying to see if someone else is impersonating = (or using) | the address. So savi is the closest in the current WGs. Of course, we = are open to | looking at this and looking for interset in any related WG. | > | >Regards, | >Alberto | > | =20 | Thanks | ------------------ | Dong Zhang | 2009-07-17 From jmh@joelhalpern.com Fri Jul 17 09:06:21 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 969BC3A6AC6 for ; Fri, 17 Jul 2009 09:06:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.775 X-Spam-Level: X-Spam-Status: No, score=-2.775 tagged_above=-999 required=5 tests=[AWL=-0.510, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GietgLLVz0zf for ; Fri, 17 Jul 2009 09:06:20 -0700 (PDT) Received: from morbo.mail.tigertech.net (morbo.mail.tigertech.net [67.131.251.54]) by core3.amsl.com (Postfix) with ESMTP id C29133A6972 for ; Fri, 17 Jul 2009 09:06:20 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by morbo.tigertech.net (Postfix) with ESMTP id C8957A395D for ; Fri, 17 Jul 2009 08:36:59 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 9DDAA438016 for ; Fri, 17 Jul 2009 08:31:38 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-248.clppva.btas.verizon.net [71.161.52.248]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 1A24B438010 for ; Fri, 17 Jul 2009 08:31:37 -0700 (PDT) Message-ID: <4A609952.9040304@joelhalpern.com> Date: Fri, 17 Jul 2009 11:31:30 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: SAVI Mailing List Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: [savi] Threats draft X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2009 16:06:21 -0000 After some discussion, I have provided some input, and with Fred and Danny there is now a revision of the savie threats draft. It will be posted properly when the repository reopens. In the meantime, it can be fetched from: ftp://ftpeng.cisco.com/fred/savi/savi-threat-01.txt And a diff of this against the previous published version can be found at: ftp://ftpeng.cisco.com/fred/savi/Diff-savi-threat-00.txt-savi-threat-01.txt.html The major change is a rewrite of section 6 to describe the relationship of general spoof prevention to the threats, and to talk about the applicability of host specific spoof prevention. This section probably needs elaboration, and input is solicited. Text was added in the topology section talking about the impact of IPv6. The purpose of this is to raise the fact that SLAAC complicates things and that the 64 bit ID introduces additional threat complications. There is some additional text in the introduction and in section 8 about the relationship of this work to BCP 38. In particular, this raises the perspective that because SAIV has local value to the deploying site, it may address some of the deployment difficulties of pure BCP 38. There is text to address Marcelo's comments about router attacks and Mobile IP. I am not sure this fully addresse hsi concerns, but it is a start. There are other minor corrections and clarifications, as indicated in the diff. (If the provided diff does not work for you, tools.ietf.org has a very nice diff tool as well.) Yours, Joel M. Halpern From elevyabe@cisco.com Fri Jul 17 09:07:51 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 610A73A6E06 for ; Fri, 17 Jul 2009 09:07:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.424 X-Spam-Level: X-Spam-Status: No, score=-10.424 tagged_above=-999 required=5 tests=[AWL=0.175, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 08z6PfxG1PM8 for ; Fri, 17 Jul 2009 09:07:50 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 0CA453A67E6 for ; Fri, 17 Jul 2009 09:07:49 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AnsAAMA+YEqQ/uCKe2dsb2JhbACZRwEBFiQGnjGII5BtBYQN X-IronPort-AV: E=Sophos;i="4.42,418,1243814400"; d="scan'208";a="45321342" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 17 Jul 2009 16:08:22 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6HG8MZl026299; Fri, 17 Jul 2009 18:08:22 +0200 Received: from xbh-ams-102.cisco.com (xbh-ams-102.cisco.com [144.254.73.132]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6HG8Mf7009191; Fri, 17 Jul 2009 16:08:22 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-102.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Fri, 17 Jul 2009 18:08:22 +0200 Received: from [144.254.53.99] ([144.254.53.99]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Fri, 17 Jul 2009 18:08:22 +0200 Message-ID: <4A60A1F4.6060102@cisco.com> Date: Fri, 17 Jul 2009 18:08:20 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <4BDE4243-4EAC-4D81-B827-7ED8A55787BE@ericsson.com><006901c9ed90$47b64190$d722c4b0$@tsinghua.edu.cn><4A365F7E.8010302@it.uc3m.es><9129FB66-4564-4EC2-891F-B03EB01A1156@ericsson.com><4A4C6EC3.4070906@it.uc3m.es><018712EC-91BC-4E34-9194-A16B72564828@ericsson.com><4A4F0DBD.90405@it.uc3m.es><200907090902099774677@huaweisymantec.com> <200907091307318936439@huaweisymantec.com> <02895EC3C31D47DC827C98907BE26361@bombo> <9166E76A-0E78-48C0-A929-A2F7A766F13F@ericsson.com> <4A571061.3040101@cisco.com> <7FE63818-8A8C-4607-B6B5-ADE2362FC5FE@ericsson.com> <4A5F2492.5010505@cisco.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 17 Jul 2009 16:08:22.0098 (UTC) FILETIME=[CE949320:01CA06F8] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=2663; t=1247846902; x=1248710902; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20Limiting=20#=20IP=20addresses=20per=20b inding=20anchor |Sender:=20; bh=IvKOC6G7jEQhrlAsd5ypnNIcsdFbB4ysYOmx0L2ohoM=; b=XGNRSyt9xXKpe3j7H1L1mRRnclVZkRDfGvO40PoGuVOz750Izl1pcSNkjd 3+rKd+9AMz9Ve6lEJs19L4XHdIj8SyU5/LQ60CI3P8xSwyvCAcm4VRd86NBI xrej5Uoruc; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: SAVI Mailing List , Guang Yao , =?ISO-8859-1?Q?Alberto_Garc=EDa?= Subject: Re: [savi] Limiting # IP addresses per binding anchor X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2009 16:07:51 -0000 Christian Vogt a écrit : > Forked from thread "Your opinion on a different tradeoff for SAVI". > > > On Jul 16, 2009, Eric Levy-Abegnoli wrote: > >>> You are proposing to limit the number of IP addresses a host can use. >> >> >> that would have a couple a benefits: protection against an attacker >> trying to fill the switch binding table, as well as preventing an >> attacker from (dad-)registering one distinct address per packet sent, >> just for the sake of not being catched. It has also the potential of >> controling number of addresses per node/mac/port, but this goal is >> different, and is not what I had in mind). > > Yes, but let's be careful. Benefit #2 is certainly an advantage, i.e., > preventing an attacker from registering a arbitrary amount of IP > addresses. It basically provides you a means to protect unregistered IP > addresses. But for benefits #1 and #3, things are a bit different: > Benefit #1, preventing an attacker from filling the binding table, is > something that you also get when unregistered IP addresses are not > protected. And benefit #3, controlling the number of addresses per > binding anchor, is not a goal of SAVI. > > So let's focus on benefit #2. > >>> That's interesting. Have you made some analysis on potential drawbacks >>> this could have? One drawback would, of course, be a risk of dropping >>> legitimate packets after loss of DAD packets; we discussed this before. >>> Are there other drawbacks? Perhaps a need to manually configure switch >>> ports according to whether they attach to a host directly, or to a port >>> trunk? Port trunks clearly would need higher limits on the number of >>> permitted IP addresses than ports that attach to hosts directly >> >> Yes if the limit is per-port. No if the limit is per mac. > > Right. But let's focus on ports as binding anchors for now. That's our > working assumption, because MAC addresses as binding anchors are > spoofable without link-layer protection, and hence significantly reduce > the benefit of SAVI in the first place. This includes any extra > benefits you may get from limiting the number of IP addresses per > binding anchor. > > My conclusion is that a limit on the number of IP addresses per binding > anchor can provide a means for protecting unregistered IP addresses in > networks where SLAAC is permitted. The cost of this is careful manual > configuration in the case where binding anchors are switch ports. > Careful, because misconfiguration can have the consequence of preventing > legitimate communications. Agree? Yes, absolutely. Eric > > - Christian > > > From christian.vogt@ericsson.com Fri Jul 17 13:39:02 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 047223A6F00 for ; Fri, 17 Jul 2009 13:39:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.568 X-Spam-Level: X-Spam-Status: No, score=-6.568 tagged_above=-999 required=5 tests=[AWL=0.031, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Drpslo20fnzo for ; Fri, 17 Jul 2009 13:39:01 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id F38DE3A6F03 for ; Fri, 17 Jul 2009 13:38:57 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n6HKdS0A021880 for ; Fri, 17 Jul 2009 15:39:30 -0500 Received: from eusrcmw750.eamcs.ericsson.se ([138.85.77.50]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 17 Jul 2009 15:39:13 -0500 Received: from [155.53.229.43] ([155.53.229.43]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.1830); Fri, 17 Jul 2009 15:39:13 -0500 Message-Id: <26B5280E-404C-4A9A-8524-E267EEBF3E04@ericsson.com> From: Christian Vogt To: SAVI Mailing List In-Reply-To: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Fri, 17 Jul 2009 13:39:13 -0700 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 17 Jul 2009 20:39:13.0369 (UTC) FILETIME=[A517BC90:01CA071E] Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 17 Jul 2009 20:39:02 -0000 Everybody - This is a reminder of our ongoing consensus call on the protection of unregistered IP addresses. Please send your feedback -- either by answering the consensus questions, or by stating that you want more discussion prior to making a decision. The feedback we have received so far is insufficient to make a conclusion. The consensus call will continue until Sunday, July 19. - Christian On Jul 13, 2009, Christian Vogt wrote: > Folks - > > As announced earlier, we will have a consensus call on how SAVI > devices > should treat source addresses for which no configuration signaling was > seen. Consensus questions for this were proposed on July 8, and the > feedback received from the working group indicates that those are OK. > > I would hence like to initiate the consensus call. To participate in > the consensus call, please answer by Sunday, July 19, the following > two > questions (A) and (B), using one of the two possible answers provided > for each question: > > (A) In networks where SLAAC is permitted for address configuration, > how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet > (A2) Forward and optionally log the packet > > (B) In networks where only DHCP is permitted for address > configuration, > how should a SAVI device treat packets with a source address for > which no DHCP assignment was seen? > > (B1) Discard the packet > (B2) Forward and optionally log the packet > > In these questions, a SAVI device sees a "successful DAD procedure" > for > an address if it sees a DAD Neighbor Solicitation message, but no > responding DAD Neighbor Advertisement message, for this address. > > Please recall the relationship of our two main SAVI solution proposals > to these consensus questions: The FCFS and CPS solutions both use the > combination of (A1) plus (B1), with different means to reduce the > probability of dropping legitimate packets. The middle-ground > solution > we are considering now -- originally suggested in [1] by Marcelo, and > slightly augmented in [2] by me with an alternative mode for DHCP-only > networks -- uses the combination of (A2) plus (B1). I would like > folks > to consider in particular this combination of (A2) plus (B1) because > it > constitutes a reasonable compromise between two competing solutions. > > Please also recall our working assumption that SAVI will operate > exclusively in wired networks, with switch ports constituting the > binding anchors. The goal of this working assumption is to relieve > the > discussion from considerations about scenarios where SAVI can only > have > limited benefit. Unprotected wireless networks are an example of those > scenarios, where forgeable MAC addresses are the only possible binding > anchors. We will re-evaluate at a later stage how well SAVI applies > to > other scenarios. > > - Christian > > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html > [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From zhangdong_rh@huaweisymantec.com Sun Jul 19 19:40:58 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E6B273A6CF1 for ; Sun, 19 Jul 2009 19:40:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 4.158 X-Spam-Level: **** X-Spam-Status: No, score=4.158 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, HELO_MISMATCH_COM=0.553, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753, RDNS_NONE=0.1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mZJcRty7FLam for ; Sun, 19 Jul 2009 19:40:57 -0700 (PDT) Received: from mta1.huaweisymantec.com (unknown [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id E414C3A6CDD for ; Sun, 19 Jul 2009 19:40:44 -0700 (PDT) MIME-version: 1.0 Content-type: text/plain; charset=gb2312 Received: from hstml01-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KN2000707FMLE10@hstga01-in.huaweisymantec.com> for savi@ietf.org; Mon, 20 Jul 2009 10:40:34 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KN2005WX7FLXC00@hstml01-in.huaweisymantec.com> for savi@ietf.org; Mon, 20 Jul 2009 10:40:34 +0800 (CST) Date: Mon, 20 Jul 2009 10:40:33 +0800 From: Dong Zhang To: =?gb2312?B?QWxiZXJ0b19HYXJjqKph?= , 'Christian Vogt' , 'SAVI Mailing List' References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> Message-id: <200907201040329011805@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Content-transfer-encoding: base64 Cc: 'Padmanabha Nallur 73868' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 02:40:59 -0000 SGkgQWxiZXJ0bywNClBsZWFzZSBjaGVjayBpbmxpbmUuDQoNClRoYW5rIHlvdS4NCg0KQWxiZXJ0 b19HYXJjqKphIDIwMDktMDctMTcgV3JvdGU6DQo+SGkNCj4NCj58ICAtLS0tLU1lbnNhamUgb3Jp Z2luYWwtLS0tLQ0KPnwgIERlOiBzYXZpLWJvdW5jZXNAaWV0Zi5vcmcgW21haWx0bzpzYXZpLWJv dW5jZXNAaWV0Zi5vcmddIEVuIG5vbWJyZSBkZSBEb25nDQo+fCAgWmhhbmcNCj58ICBFbnZpYWRv IGVsOiB2aWVybmVzLCAxNyBkZSBqdWxpbyBkZSAyMDA5IDg6NTANCj58ICBQYXJhOiBBbGJlcnRv X0dhcmM/OyAnQ2hyaXN0aWFuIFZvZ3QnOyAnU0FWSSBNYWlsaW5nIExpc3QnDQo+fCAgQ0M6ICdQ YWRtYW5hYmhhIE5hbGx1ciA3Mzg2OCcNCj58ICBBc3VudG86IFJlOiBbc2F2aV0gQWJvdXQgZHJh ZnQtZG9uZy1zYXZpLWNnYS1oZWFkZXItMDIudHh0DQo+fCAgDQo+fCAgQWxiZXJ0b19HYXJj7WEg MjAwOS0wNy0xNiBXcm90ZToNCj58ICA+fCAgSSBkbyBub3QgdGhpbmsgaXQgaXMgYSBjb25mbGlj dC4gVGhlIGRpZmZlcmVuY2UgaXMganVzdCBob3cgdG8NCj58ICA+fCAgdXNlIENHQS4gRm9yIGlu c3RhbmNlLCB0aGUgQ0dBIHByb3Bvc2FsIGNhbiBiZSB1c2VkIGluIGUyZSwgZXZlbiBiZXR3ZWVu DQo+fCAgPnRoZQ0KPnwgID58ICBob3N0DQo+fCAgPnwgIGFuZCB0aGUgZmlyc3QtaG9wIHJvdXRl ci4gSXQgY2FuIGRlcGVuZCBvbiB0aGUgZGVzdGluYXRpb24gb3B0aW9uIGhlYWRlci4NCj58ICA+ DQo+fCAgPlNoaW02IGFsbG93cyB0cmFuc3BvcnRpbmcgQ0dBIGluZm9ybWF0aW9uIGVuZC10by1l bmQuIEl0IGRvZXMgdGhhdCBub3csIGluIGENCj58ICA+c3RhbmRhcmQgd2F5LiBXaHkgeW91IHNo b3VsZCB3YW50IHRvIGdlbmVyYXRlIGEgeWV0LWFub3RoZXItcHJvdG9jb2wgdG8NCj58ICA+dHJh bnNwb3J0IENHQSBpbmZvcm1hdGlvbiBlbmQtdG8tZW5kPw0KPnwgIFRoYW5rIHlvdSBmb3IgdGhl IGluZm9ybWF0aW9uLg0KPnwgIFdlIHdpbGwgcmVhZCBTaGltNi4gSWYgaXQgcmVhbGx5IGRvZXMg dGhlIHJlbGF0aXZlIGpvYiwgd2Ugd2lsbCBiZSBnbGFkIHRvIHVzZSBpdC4NCj58ICA+DQo+fCAg PkJlc2lkZXMsIHdoYXQgZG9lcyBzdWNoIGEgcHJvdG9jb2wgd291bGQgaGF2ZSB0byBkbyB3aXRo IFNBVkk/DQo+fCAgPklmIHlvdSB3YW50IHRvIHVzZSBDR0FzIGZvciBwcm92aWRpbmcgc2VjdXJp dHkgaW4gdGhlIGxpbmsgb2YgdGhlIGhvc3QgYW5kDQo+fCAgPnRoZSBmaXJzdC1ob3Agcm91dGVy LCB5b3Ugc2hvdWxkIHByb2JhYmx5IHVzZSB0aGUgU0VORCBwcm90b2NvbCAoc2VlDQo+fCAgPmRy YWZ0LWlldGYtc2F2aS1zZW5kLTAwKS4gRG8geW91IHRoaW5rIHRoZXJlIGlzIHNvbWV0aGluZyBp biB0aGUgU0VORA0KPnwgID5wcm90b2NvbCB0aGF0IGRvZXMgbm90IHN1aXQgd2l0aCBiaW5kaW5n IElQdjYgYWRkcmVzc2VzIGFuZCBsaW5rIGxheWVyDQo+fCAgPmFuY2hvcnMsIHRoYXQgY291bGQg YmUgaW1wcm92ZWQ/DQo+fCAgPkFuZCBpZiB5b3Ugd2FudCB0byB1c2UgdGhlIENHQSBmb3IgYWRk cmVzcyB2YWxpZGF0aW9uIGZ1cnRoZXIgdGhhbiB0aGUgZmlyc3QNCj58ICA+aG9wIHJvdXRlcnMs IEkgc2VlIHNvbWUgcmVhc29ucyB3aHkgeW91IHNob3VsZCBub3Q6ICBhdCB0aGF0IHBvaW50IHlv dSBuZWVkDQo+fCAgPnRvIHZhbGlkYXRlIHByZWZpeGVzLCBub3QgaG9zdCBhZGRyZXNzZXMsIGFu ZCBDR0EgcHJvdmlkZXMgbm8gcHJvdGVjdGlvbiBmb3INCj58ICA+cHJlZml4ZXM6IGFueSBob3N0 IGNhbiBnZW5lcmF0ZSBhIHZhbGlkIENHQSB3aXRoIHdoaWNoZXZlciBwcmVmaXggaXQgd2FudGVk Lg0KPnwgID5TbyBqdXN0IHZhbGlkYXRpbmcgYSBDR0EgZG9lcyBub3QgYXNzdXJlIHRoYXQgdGhl IGhvc3QgaXMgYXV0aG9yaXplZCB0byB1c2UNCj58ICA+dGhhdCBwcmVmaXguDQo+fCAgSW4gdGhl IENHQS1yZWxhdGVkIGluZm9ybWF0aW9uLCBpdCBjb250YWlucyB0aGUgc2lnbmF0dXJlLiBXZSB0 aGluayBpdCBjYW4NCj58ICBwcm90ZWN0IHRoZSBwcmVmaXguIFJpZ2h0Pw0KPg0KPldlbGwsIGl0 IGRvZXMgbm90IHByb3ZlIHRoYXQgYSBob3N0IGhhcyBiZWVuIGxlZ2l0aW1hdGVseSBhc3NpZ25l ZCBhIHByZWZpeC4gDQo+Q0dBcywgd2l0aCBhIHByb3RvY29sIHRyYW5zcG9ydGluZyBzaWduYXR1 cmVzIG1hZGUgd2l0aCB0aGUgcHJpdmF0ZSBrZXksIG9ubHkgYXNzdXJlIHRoYXQgb25jZSBhIGhv c3QgZ2VuZXJhdGVzIGEgZ2l2ZW4gYWRkcmVzcywgaXQgaXMgdmVyeSB2ZXJ5IGRpZmZpY3VsdCBm b3IgYW5vdGhlciBob3N0IHRvIHVzZSB0aGUgc2FtZSBhZGRyZXNzLiBBbmQgeWVzLCB0aGUgcHJv dGVjdGlvbiBpbmNsdWRlcyB0aGUgcHJlZml4OiBpdCBpcyBqdXN0IG5vdCBlbm91Z2ggdG8gZmlu ZCBhIGtleSBwYWlyIHdob3NlIGhhc2ggZ2VuZXJhdGVzIGEgZ2l2ZW4gaW50ZXJmYWNlIGlkZW50 aWZpZXIsIGFuZCB0aGVuIHlvdSBjYW4gaW1wZXJzb25hdGUgYW55IGhvc3Qgd2l0aCB0aGUgc2Ft ZSBpbnRlcmZhY2UgaWRlbnRpZmllciBpbiBhbnkgbmV0d29yayAoaS5lLiB3aXRoIGFueSBwcmVm aXgpLg0KW0RvbmddIFdlbGwsIHllcywgd2UgYWdyZWUgd2l0aCB0aGlzLiBDR0EgZG9lcyBub3Qg ZG8gaWRlbnRpdHkgYXV0aGVudGljYXRpb24uIFdlIG9ubHkgdmFsaWRhdGUgdGhlIGFkZHJlc3Mg c28gdGhhdCBzb21lb25lIGVsc2UgY2Fubm90IHVzZSB0aGlzIElQIGFkZHJlc3MuIFdlIGRvIG5v dCBjaGVjayBmb3IgdGhlIElQIGFkZHJlc3MgYmluZGluZyB3aXRoIGEgaG9zdCAgb3IgYSB1c2Vy IG9yIHNvbWUgb3RoZXIgaGlnaGVyIGxldmVsIGVudGl0eSBhbmQgdmFsaWRhdGUgdGhhdC4gDQoN Ckp1c3QgdGhlIGZhY3QgdGhhdCBzb21lb25lIGVsc2UgY2Fubm90IHVzZSB0aGUgc2FtZSBhZGRy ZXNzIHdvdWxkIGdpdmUgdGhlIGJlbmVmaXRzIG1lbnRpb25lZCBpbiB0aGUgdXNlIGNhc2VzIHdp dGhpbiB0aGUgZHJhZnQuIA0KDQpJTUhPLCB3ZSBkb24ndCB0aGluayBldmVuIFNBVkkgc29sdXRp b25zIG5lZWQgdG8gdmFsaWRhdGUgdGhlIGJpbmRpbmcgb2YgSVAgYWRkcmVzcyB3aXRoIHVzZXJz IGV0Yy4sIG9ubHkgY2hlY2sgaWYgYSBjZXJ0YWluIElQIGFkZHJlc3MgaXMgdXNlZCBvbiBhIHNw ZWNpZmljIGxpbmsuDQo+DQo+QnV0IHRoYXQgc2F5cyBub3RoaW5nIGFib3V0IHRoZSBsZWdpdGlt YWN5IG9mIGFoIGhvc3QgdG8gdXNlIHRoYXQgcHJlZml4Lg0KPkZvciBleGFtcGxlLCBnaXZlIHRo ZSBwcmVmaXggb2YgeW91ciBuZXR3b3JrLCBhbmQgSSBjYW4gZ2VuZXJhdGUgaW1tZWRpYXRlbHkg YW4gQ0dBIHRoYXQgY2xhaW1zIHRvIGJlbG9uZyB0byB5b3VyIHByZWZpeDogQ0dBID0gaGFzaCAo IHByZWZpeCB8IHB1YmxpYyBrZXkgfCBldGMpLiBBbmQgSSBjYW4gdXNlIGZyb20gbXkgbmV0d29y aywgaWYgdGhlIHJvdXRlciAoYW5kIHNvbWUgcm91dGVycyBhYm92ZSkgZG9lcyBub3QgY2hlY2sg c291cmNlIHByZWZpeGVzLiBMb29raW5nIG9ubHkgYXQgdGhlIENHQSBub2JvZHkgY2FuIGtub3cg aWYgbXkgaG9zdCBpcyBhdXRob3JpemVkIHRvIHVzZSBhIHByZWZpeCBvciBub3QuDQo+U28sIENH QSBkb2VzIG5vdCBhZGQgYW55dGhpbmcgdG8gcHJlZml4IHByb3RlY3Rpb24uIFlvdSBoYXZlIHRv IHByb3ZpZGUgb3RoZXIgbWVhbnMgdG8gcHJvdGVjdCB0aGF0LiANCkkgZ3Vlc3MgdGhlIGluZ3Jl c3MgZmlsdGVyaW5nIGNvdWxkIGRvIHRoaXMuIEFuZCBzYXZpIHNvbHV0aW9ucyBhcmUgdGhlIGNv bXBsZW1lbnQgZm9yIGluZ3Jlc3MgZmlsdGVyaW5nLiBUaGlzIHBvaW50IGhhcyBiZWVuIGRpc2N1 c3NlZCBiZWZvcmUuDQo+DQo+DQo+fCAgPg0KPnwgID58ICA+DQo+fCAgPnwgID5XaGF0IGRvZXMg dGhpcyB0eXBlIG9mIHNvbHV0aW9ucyBoYXMgdG8gZG8gd2l0aCBTQVZJLCBjb25zaWRlcmluZyB0 aGF0DQo+fCAgPnRoZQ0KPnwgID58ICA+Y2hhcnRlciBzYXlzOiAiTm8gY2hhbmdlcyB0byBob3N0 cyBhcmUgYWxsb3dlZC4iPyBJc24ndCB5b3VyIHNvbHV0aW9uDQo+fCAgPnwgID5wcm9wb3Npbmcg YSBjaGFuZ2UgdG8gaG9zdHM/DQo+fCAgPnwgIFllcywgdGhlIENHQSBwcm9wb3NhbCBkb2VzIG5v dCBmaXQgZm9yIHRoZSBjdXJyZW50IGNoYXJ0ZXIgcXVpdCB3ZWxsIHRvDQo+fCAgPnNvbWUNCj58 ICA+fCAgZXh0ZW5kLg0KPnwgID58ICBUaGUgcmVhc29uIHdoeSB3ZSBwdXQgdGhlIENHQS1yZWxh dGVkIGluZm8gaW4gdGhlIGV4dGVuc2lvbiBoZWFkZXIgaXMNCj58ICA+dGhhdCBpdA0KPnwgID58 ICBoYXMNCj58ICA+fCAgdGhlIGFiaWxpdHkgdG8gcHJvdmlkZSBhIGJhc2ljIHNlY3VyaXR5IGZv ciB0aGUgc291cmNlIGFkZHJlc3MgbGlrZSBBSCAmDQo+fCAgPkVTUC4gVGhlDQo+fCAgPg0KPnwg ID5UaGUgQ0dBIHNlY3VyaXR5IG1vZGVsIGRvZXMgbm90IGhhdmUgbXVjaCByZWxhdGlvbnNoaXAg d2l0aCBBSCAmIEVTUC4gV2VsbCwNCj58ICA+YWxsIHVzZSBrZXlzLCBidXQgYmVzaWRlcyB0aGF0 Li4uDQo+fCAgSSBtZWFuIGlmIHdlIGNvdWxkIHRha2UgdGhlIENHQS1yZWxhdGVkIGluZm9ybWF0 aW9uIGluIHRoZSBleHRlbnNpb24gaGVhZGVyLA0KPnwgIHRoZSBwYWNrZXQgd2lsbCBoYXZlIEFI LCBFU1AgYW5kIENHQSBmb3IgdGhlIGJhc2ljIHNlY3VyaXR5IGNoYXJhY3RlcmlzdGljcywNCj58 ICBpbmNsdWRpbmcgaW50ZWdyaXR5LCBjb25maWRlbnRpYWxpdHksIGFuZCBhdXRoZW50aWNhdGlv bi4NCj4NCj5UaGlzIGlzIGNvbXBsZXRlbHkgZGlmZmVyZW50IHN0dWZmLiBJdCBzZWVtcyBsaWtl IGdlbmVyYXRpbmcgYW4gb3Bwb3J0dW5pc3RpYyBJS0Ugc2VjdXJpdHkgY29udGV4dCAoYSBsYSBT U0wpIGZvciBhIGNvbW11bmljYXRpb24sIHN0YXJ0aW5nIHdpdGggdGhlIHB1YmxpYy9wcml2YXRl IGtleSBwYWlyIGFzc29jaWF0ZWQgdG8gdGhlIENHQXMgb2YgdHdvIGhvc3RzLiBUaGVuIHlvdSBz aG91bGQgbG9vayBhdCBodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaWQvZHJhZnQtbGFnYW5pZXItaWtl LWlwdjYtY2dhLTAyLnR4dA0KSSBhbSBhIGxpdHRsZSBjb25mdXNlZCBoZXJlLiBJIGhhdmUgYWxy ZWFkeSBrbm93biB0aGlzIGRyYWZ0IGJlZm9yZS4gQXJlIHlvdSBjb21wYXJpbmcgaXQgd2l0aCBt eSBhbm90aGVyIGRyYWZ0LCBodHRwOi8vdG9vbHMuaWV0Zi5vcmcvaWQvZHJhZnQtemhhbmctc2hl bi1zYS1jZ2EtMDAudHh0ID8gDQoNCg0KLS0tLS0tLS0tLS0tLS0tLS0tCQkJCSANCkRvbmcgWmhh bmcNCjIwMDktMDctMjANCg== From pekkas@netcore.fi Sun Jul 19 22:31:55 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8598328C15E for ; Sun, 19 Jul 2009 22:31:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id n3gxkGzccVgt for ; Sun, 19 Jul 2009 22:31:54 -0700 (PDT) Received: from netcore.fi (eunet-gw.ipv6.netcore.fi [IPv6:2001:670:86:3001::1]) by core3.amsl.com (Postfix) with ESMTP id 38CB928C121 for ; Sun, 19 Jul 2009 22:31:53 -0700 (PDT) Received: from netcore.fi (localhost [127.0.0.1]) by netcore.fi (8.13.8/8.13.8) with ESMTP id n6K5VPgt022620 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 20 Jul 2009 08:31:25 +0300 Received: from localhost (pekkas@localhost) by netcore.fi (8.13.8/8.13.8/Submit) with ESMTP id n6K5VPqc022616; Mon, 20 Jul 2009 08:31:25 +0300 Date: Mon, 20 Jul 2009 08:31:25 +0300 (EEST) From: Pekka Savola To: Christian Vogt In-Reply-To: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> Message-ID: References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> User-Agent: Alpine 2.00 (LRH 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Virus-Scanned: clamav-milter 0.95.2 at otso.netcore.fi X-Virus-Status: Clean Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 05:31:55 -0000 This is a bit late, but: On Mon, 13 Jul 2009, Christian Vogt wrote: > I would hence like to initiate the consensus call. To participate in > the consensus call, please answer by Sunday, July 19, the following two > questions (A) and (B), using one of the two possible answers provided > for each question: > > (A) In networks where SLAAC is permitted for address configuration, how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet > (A2) Forward and optionally log the packet This begs the question of 'seen' when? How long should a SAVI device remember these exchanges? Is the assumption that these are kept in volatile memory, so when the device reboots, the information is lost? What happens immediately after SAVI device reboot assuming the connected hosts do not re-issue DAD procedure, with A1 such hosts would be blackholed if this information is only kept in memory until they issue DAD? The network should not break if SAVI device reboots. With sufficient constraints (e.g. the use of non-volatile memory) it may be possible to achieve this with A1. However, A2 seems a more robust and more likely achievable approach at the moment. > (B) In networks where only DHCP is permitted for address configuration, > how should a SAVI device treat packets with a source address for > which no DHCP assignment was seen? > > (B1) Discard the packet > (B2) Forward and optionally log the packet In this case I suppose SAVI device would need to be manually configured to behave in this manner (i.e. it could not figure this out reliably on its own)? In that case, B1 would seem to be fine. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From yaoa02@mails.tsinghua.edu.cn Sun Jul 19 23:59:26 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6A3683A6ADE for ; Sun, 19 Jul 2009 23:59:26 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.001 X-Spam-Level: X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id pEZCRa+MhKrl for ; Sun, 19 Jul 2009 23:59:25 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 8238F3A68AC for ; Sun, 19 Jul 2009 23:59:25 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MSmqI-0004Qr-GR; Mon, 20 Jul 2009 14:59:22 +0800 From: "Guang Yao" To: "'Pekka Savola'" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> In-Reply-To: Date: Mon, 20 Jul 2009 14:59:17 +0800 Message-ID: <010e01ca0907$992acae0$cb8060a0$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoI+2155Mxp4lJNRC2gZsu1Qj54FwACahJg Content-Language: zh-cn Cc: 'SAVI Mailing List' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 06:59:26 -0000 > -----Original Message----- > From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf Of > Pekka Savola > Sent: Monday, July 20, 2009 1:31 PM > To: Christian Vogt > Cc: SAVI Mailing List > Subject: Re: [savi] Consensus call on "unregistered" source addresses > > This is a bit late, but: > > On Mon, 13 Jul 2009, Christian Vogt wrote: > > This begs the question of 'seen' when? How long should a SAVI device > remember these exchanges? Is the assumption that these are kept in > volatile memory, so when the device reboots, the information is lost? > > What happens immediately after SAVI device reboot assuming the > connected hosts do not re-issue DAD procedure, with A1 such hosts > would be blackholed if this information is only kept in memory until > they issue DAD? [Guang Yao] I think maybe the connected hosts must re-perform DAD procedure. There is no assurance that their previous addresses wouldn't be used during the period of their reboot. If they insist to use their previous address, it can cause address conflict. Even use default-forwarding policy, their address may be bound by another host, And they will still be separated. And according to RFC4862, they MUST perform DAD again when interface is re-initialized. If they are directly connected to switch, their interfaces will surely be re-initialized. That's why I insist to set up binding only for directly connected hosts. > > The network should not break if SAVI device reboots. With sufficient > constraints (e.g. the use of non-volatile memory) it may be possible > to achieve this with A1. However, A2 seems a more robust and more > likely achievable approach at the moment. > From marcelo@it.uc3m.es Mon Jul 20 00:04:04 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 690543A6A24 for ; Mon, 20 Jul 2009 00:04:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.166 X-Spam-Level: X-Spam-Status: No, score=-6.166 tagged_above=-999 required=5 tests=[AWL=0.433, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id t0iciJCl9re7 for ; Mon, 20 Jul 2009 00:04:03 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 49F7F3A68AC for ; Mon, 20 Jul 2009 00:04:03 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (192.pool85-53-144.dynamic.orange.es [85.53.144.192]) by smtp02.uc3m.es (Postfix) with ESMTP id 8BBD66C1390; Mon, 20 Jul 2009 09:04:00 +0200 (CEST) Message-ID: <4A6416E0.8090004@it.uc3m.es> Date: Mon, 20 Jul 2009 09:04:00 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Pekka Savola References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16774.005 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 07:04:04 -0000 Pekka Savola escribió: > This is a bit late, but: > > On Mon, 13 Jul 2009, Christian Vogt wrote: >> I would hence like to initiate the consensus call. To participate in >> the consensus call, please answer by Sunday, July 19, the following two >> questions (A) and (B), using one of the two possible answers provided >> for each question: >> >> (A) In networks where SLAAC is permitted for address configuration, how >> should a SAVI device treat packets with a source address for which >> neither a successful DAD procedure nor a DHCP assignment was seen? >> >> (A1) Discard the packet >> (A2) Forward and optionally log the packet > > This begs the question of 'seen' when? How long should a SAVI device > remember these exchanges? Is the assumption that these are kept in > volatile memory, so when the device reboots, the information is lost? > > What happens immediately after SAVI device reboot assuming the > connected hosts do not re-issue DAD procedure, with A1 such hosts > would be blackholed if this information is only kept in memory until > they issue DAD? > > The network should not break if SAVI device reboots. With sufficient > constraints (e.g. the use of non-volatile memory) it may be possible > to achieve this with A1. However, A2 seems a more robust and more > likely achievable approach at the moment. > >> (B) In networks where only DHCP is permitted for address configuration, >> how should a SAVI device treat packets with a source address for >> which no DHCP assignment was seen? >> >> (B1) Discard the packet >> (B2) Forward and optionally log the packet > > In this case I suppose SAVI device would need to be manually > configured to behave in this manner (i.e. it could not figure this out > reliably on its own)? In that case, B1 would seem to be fine. Why are you not concerned about the SAVI device rebooting and loosing its state (only learnt through the DHCP msg exchange snooping) and blocking legit nodes out of the network in this case? I mean, isn't a similar problem that you mentioned in the above case also possible here? Thanks, marcelo From pekkas@netcore.fi Mon Jul 20 00:08:35 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8339B3A6AF1 for ; Mon, 20 Jul 2009 00:08:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.599 X-Spam-Level: X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 95khEsY4Rzqu for ; Mon, 20 Jul 2009 00:08:33 -0700 (PDT) Received: from netcore.fi (eunet-gw.ipv6.netcore.fi [IPv6:2001:670:86:3001::1]) by core3.amsl.com (Postfix) with ESMTP id 315AB3A6A24 for ; Mon, 20 Jul 2009 00:08:31 -0700 (PDT) Received: from netcore.fi (localhost [127.0.0.1]) by netcore.fi (8.13.8/8.13.8) with ESMTP id n6K78LH2025302 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Mon, 20 Jul 2009 10:08:21 +0300 Received: from localhost (pekkas@localhost) by netcore.fi (8.13.8/8.13.8/Submit) with ESMTP id n6K78Llx025299; Mon, 20 Jul 2009 10:08:21 +0300 Date: Mon, 20 Jul 2009 10:08:21 +0300 (EEST) From: Pekka Savola To: Guang Yao In-Reply-To: <010e01ca0907$992acae0$cb8060a0$@tsinghua.edu.cn> Message-ID: References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <010e01ca0907$992acae0$cb8060a0$@tsinghua.edu.cn> User-Agent: Alpine 2.00 (LRH 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-Virus-Scanned: clamav-milter 0.95.2 at otso.netcore.fi X-Virus-Status: Clean Cc: 'SAVI Mailing List' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 07:08:35 -0000 On Mon, 20 Jul 2009, Guang Yao wrote: > And according to RFC4862, they MUST perform DAD again when interface > is re-initialized. If they are directly connected to switch, their > interfaces will surely be re-initialized. That's why I insist to set > up binding only for directly connected hosts. But as far as I know, we have not (at least yet) restricted SAVI solution to only directly connected hosts. And hence the problem with DAD reinitialization assumption. Marcelo: yes, losing DHCP binding information is a similar concern. Maybe I was thinking that some switches which do perform that snooping already store information in non-volatile media. I agree that these should be treated similarly. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From yaoa02@mails.tsinghua.edu.cn Mon Jul 20 00:10:27 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5AB773A6B4E for ; Mon, 20 Jul 2009 00:10:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.299 X-Spam-Level: X-Spam-Status: No, score=-1.299 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wue1qkeJo2Db for ; Mon, 20 Jul 2009 00:10:26 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id F0B683A6AF1 for ; Mon, 20 Jul 2009 00:10:25 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MSn0m-0004fC-1S; Mon, 20 Jul 2009 15:10:12 +0800 From: "Guang Yao" To: "'marcelo bagnulo braun'" , "'Pekka Savola'" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> In-Reply-To: <4A6416E0.8090004@it.uc3m.es> Date: Mon, 20 Jul 2009 15:10:06 +0800 Message-ID: <011001ca0909$1c4a2fa0$54de8ee0$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoJCEg/Wv/UR/OKRtuGH51BX6lY4AAAH9pg Content-Language: zh-cn Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 07:10:27 -0000 > -----Original Message----- > From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf = Of > marcelo bagnulo braun > Sent: Monday, July 20, 2009 3:04 PM > To: Pekka Savola > Cc: SAVI Mailing List; Christian Vogt > Subject: Re: [savi] Consensus call on "unregistered" source addresses >=20 > Pekka Savola escribi=F3: > > This is a bit late, but: > > > > On Mon, 13 Jul 2009, Christian Vogt wrote: > >> I would hence like to initiate the consensus call. To participate = in > >> the consensus call, please answer by Sunday, July 19, the following = two > >> questions (A) and (B), using one of the two possible answers = provided > >> for each question: > >> > >> (A) In networks where SLAAC is permitted for address configuration, = how > >> should a SAVI device treat packets with a source address for = which > >> neither a successful DAD procedure nor a DHCP assignment was > seen? > >> > >> (A1) Discard the packet > >> (A2) Forward and optionally log the packet > > > > This begs the question of 'seen' when? How long should a SAVI = device > > remember these exchanges? Is the assumption that these are kept in > > volatile memory, so when the device reboots, the information is = lost? > > > > What happens immediately after SAVI device reboot assuming the > > connected hosts do not re-issue DAD procedure, with A1 such hosts > > would be blackholed if this information is only kept in memory until > > they issue DAD? > > > > The network should not break if SAVI device reboots. With = sufficient > > constraints (e.g. the use of non-volatile memory) it may be possible > > to achieve this with A1. However, A2 seems a more robust and more > > likely achievable approach at the moment. > > > >> (B) In networks where only DHCP is permitted for address = configuration, > >> how should a SAVI device treat packets with a source address = for > >> which no DHCP assignment was seen? > >> > >> (B1) Discard the packet > >> (B2) Forward and optionally log the packet > > > > In this case I suppose SAVI device would need to be manually > > configured to behave in this manner (i.e. it could not figure this = out > > reliably on its own)? In that case, B1 would seem to be fine. > Why are you not concerned about the SAVI device rebooting and loosing > its state (only learnt through the DHCP msg exchange snooping) and > blocking legit nodes out of the network in this case? >=20 > I mean, isn't a similar problem that you mentioned in the above case > also possible here? >=20 [Guang Yao]=20 In RFC3315, when the interface is re-initialized, it must send a CONFIRM to the server to check whether the assigned DHCP address is still valid. This message can be used to re-bind address. > Thanks, marcelo >=20 >=20 >=20 > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From marcelo@it.uc3m.es Mon Jul 20 01:01:23 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2447B28C121 for ; Mon, 20 Jul 2009 01:01:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TI-xr3qFoD0D for ; Mon, 20 Jul 2009 01:01:16 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id F05233A6D1A for ; Mon, 20 Jul 2009 01:01:15 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id A49C6656572; Mon, 20 Jul 2009 10:00:29 +0200 (CEST) Message-ID: <4A64241D.5040405@it.uc3m.es> Date: Mon, 20 Jul 2009 10:00:29 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Guang Yao References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <011001ca0909$1c4a2fa0$54de8ee0$@tsinghua.edu.cn> In-Reply-To: <011001ca0909$1c4a2fa0$54de8ee0$@tsinghua.edu.cn> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16774.005 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 08:01:23 -0000 Guang Yao escribió: > >> -----Original Message----- >> From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf Of >> marcelo bagnulo braun >> Sent: Monday, July 20, 2009 3:04 PM >> To: Pekka Savola >> Cc: SAVI Mailing List; Christian Vogt >> Subject: Re: [savi] Consensus call on "unregistered" source addresses >> >> Pekka Savola escribió: >> >>> This is a bit late, but: >>> >>> On Mon, 13 Jul 2009, Christian Vogt wrote: >>> >>>> I would hence like to initiate the consensus call. To participate in >>>> the consensus call, please answer by Sunday, July 19, the following two >>>> questions (A) and (B), using one of the two possible answers provided >>>> for each question: >>>> >>>> (A) In networks where SLAAC is permitted for address configuration, how >>>> should a SAVI device treat packets with a source address for which >>>> neither a successful DAD procedure nor a DHCP assignment was >>>> >> seen? >> >>>> (A1) Discard the packet >>>> (A2) Forward and optionally log the packet >>>> >>> This begs the question of 'seen' when? How long should a SAVI device >>> remember these exchanges? Is the assumption that these are kept in >>> volatile memory, so when the device reboots, the information is lost? >>> >>> What happens immediately after SAVI device reboot assuming the >>> connected hosts do not re-issue DAD procedure, with A1 such hosts >>> would be blackholed if this information is only kept in memory until >>> they issue DAD? >>> >>> The network should not break if SAVI device reboots. With sufficient >>> constraints (e.g. the use of non-volatile memory) it may be possible >>> to achieve this with A1. However, A2 seems a more robust and more >>> likely achievable approach at the moment. >>> >>> >>>> (B) In networks where only DHCP is permitted for address configuration, >>>> how should a SAVI device treat packets with a source address for >>>> which no DHCP assignment was seen? >>>> >>>> (B1) Discard the packet >>>> (B2) Forward and optionally log the packet >>>> >>> In this case I suppose SAVI device would need to be manually >>> configured to behave in this manner (i.e. it could not figure this out >>> reliably on its own)? In that case, B1 would seem to be fine. >>> >> Why are you not concerned about the SAVI device rebooting and loosing >> its state (only learnt through the DHCP msg exchange snooping) and >> blocking legit nodes out of the network in this case? >> >> I mean, isn't a similar problem that you mentioned in the above case >> also possible here? >> >> > [Guang Yao] > In RFC3315, when the interface is re-initialized, it must send a CONFIRM > to the server to check whether the assigned DHCP address is still valid. > This message can be used to re-bind address. > I guess the question is what it means an interface being reinitialized in the context of RFC4862 and RFC3315. Each time the link is down is the interface reinitialized? Is this true for wifi links that are very flappy? Regards, marcelo > >> Thanks, marcelo >> >> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> > > > > From yaoa02@mails.tsinghua.edu.cn Mon Jul 20 03:16:52 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B54B928C0CF for ; Mon, 20 Jul 2009 03:16:52 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.949 X-Spam-Level: X-Spam-Status: No, score=-1.949 tagged_above=-999 required=5 tests=[AWL=0.650, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tdVGj78HcNms for ; Mon, 20 Jul 2009 03:16:51 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id AEC2A28C123 for ; Mon, 20 Jul 2009 03:16:51 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MSoOE-0006KG-In; Mon, 20 Jul 2009 16:38:31 +0800 From: "Guang Yao" To: "'Pekka Savola'" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <010e01ca0907$992acae0$cb8060a0$@tsinghua.edu.cn> In-Reply-To: Date: Mon, 20 Jul 2009 16:38:25 +0800 Message-ID: <011101ca0915$73106d20$59314760$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoJCOpfk0Szd9GjTi+nJJiw2+GxKQAAEBUg Content-Language: zh-cn Cc: 'SAVI Mailing List' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 10:16:52 -0000 > -----Original Message----- > From: Pekka Savola [mailto:pekkas@netcore.fi] > Sent: Monday, July 20, 2009 3:08 PM > To: Guang Yao > Cc: 'SAVI Mailing List' > Subject: RE: [savi] Consensus call on "unregistered" source addresses > > On Mon, 20 Jul 2009, Guang Yao wrote: > > And according to RFC4862, they MUST perform DAD again when interface > > is re-initialized. If they are directly connected to switch, their > > interfaces will surely be re-initialized. That's why I insist to set > > up binding only for directly connected hosts. > > But as far as I know, we have not (at least yet) restricted SAVI > solution to only directly connected hosts. And hence the problem with > DAD reinitialization assumption. > [Guang Yao] Sure there is no that restriction. However, design a solution also for not directly connected hosts has other problems: 1: Memory cost. 2: The mechanism to remove binding when remote host leaves. I just suggest a solution designed only for directly connected hosts is stable and more simple. > Marcelo: yes, losing DHCP binding information is a similar concern. > Maybe I was thinking that some switches which do perform that snooping > already store information in non-volatile media. I agree that these > should be treated similarly. > > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From elevyabe@cisco.com Mon Jul 20 03:18:23 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D30B3A6D1E for ; Mon, 20 Jul 2009 03:18:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -10.599 X-Spam-Level: X-Spam-Status: No, score=-10.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LWdLPE1IzsMt for ; Mon, 20 Jul 2009 03:18:16 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 73DA73A6D1C for ; Mon, 20 Jul 2009 03:18:16 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AkUAAEfgY0qQ/uCKe2dsb2JhbACZWwEBFiQGm3SII44jBYQM X-IronPort-AV: E=Sophos;i="4.43,233,1246838400"; d="scan'208";a="45422719" Received: from ams-dkim-1.cisco.com ([144.254.224.138]) by ams-iport-1.cisco.com with ESMTP; 20 Jul 2009 10:15:00 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6KAF1FI008483; Mon, 20 Jul 2009 12:15:01 +0200 Received: from xbh-ams-102.cisco.com (xbh-ams-102.cisco.com [144.254.73.132]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6KAF0O7000719; Mon, 20 Jul 2009 10:15:00 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-102.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 20 Jul 2009 12:15:00 +0200 Received: from [144.254.53.99] ([144.254.53.99]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 20 Jul 2009 12:15:00 +0200 Message-ID: <4A6443A5.5080302@cisco.com> Date: Mon, 20 Jul 2009 12:15:01 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> In-Reply-To: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 20 Jul 2009 10:15:00.0405 (UTC) FILETIME=[F0A03650:01CA0922] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=4123; t=1248084901; x=1248948901; c=relaxed/simple; s=amsdkim1002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Consensus=20call=20on=20=22unr egistered=22=20source=20addresses |Sender:=20; bh=NqIu62jmVhGutgoVXVrQkuDDC2a6Yk/S4GqsaVkRJkU=; b=E0T7Equx8dybXJufjHArw42a+TeaijwSz9y3ZsPDjaSBfCMXfPBK6HprLp AjersXO4qzG+ZKFik7uMXNKGxGMWK+hJjQvjRi2jGey1RgZqizRDhdlbanhB REDU+iUxTr; Authentication-Results: ams-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim1002 verified; ); Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 10:18:23 -0000 Sorry for the late response, see inline ... Christian Vogt a écrit : > Folks - > > As announced earlier, we will have a consensus call on how SAVI devices > should treat source addresses for which no configuration signaling was > seen. Consensus questions for this were proposed on July 8, and the > feedback received from the working group indicates that those are OK. > > I would hence like to initiate the consensus call. To participate in > the consensus call, please answer by Sunday, July 19, the following two > questions (A) and (B), using one of the two possible answers provided > for each question: > > (A) In networks where SLAAC is permitted for address configuration, how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet > (A2) Forward and optionally log the packet > The logging looks like the poor-man solution, and it carries its own issues and caveats. It basically says "we can't rely on the accuracy of the binding table, so let's log to let the final word to a human". However logging carries it's own serious issues: it forces to take high level hence slow actions in the data path, which makes the switch either a lot more vulnerable, or likely to fail to log important informations. It is also likely to generate amount of information out of reach of many network operators. Using the logging as the excuse for failing to build an accurate binding table sounds dangerous: it suggests we expect a lot of false positive, which will make the log analysis hard, and will be exploited by attackers. I'll prefer that we make assumptions on what it takes to build an accurate binding table (non-volatile memory, maybe some assumption on DAD, snooping on other NDP packets, etc), and when these assumptions are true, we drop & log. All devices are not equal (hardware/software wise, but also deployment-wise), so would be acceptable to habe those which can't verifyi the assumptions to not drop/log in my opinion. Eric > (B) In networks where only DHCP is permitted for address configuration, > how should a SAVI device treat packets with a source address for > which no DHCP assignment was seen? > > (B1) Discard the packet > (B2) Forward and optionally log the packet > > In these questions, a SAVI device sees a "successful DAD procedure" for > an address if it sees a DAD Neighbor Solicitation message, but no > responding DAD Neighbor Advertisement message, for this address. > > Please recall the relationship of our two main SAVI solution proposals > to these consensus questions: The FCFS and CPS solutions both use the > combination of (A1) plus (B1), with different means to reduce the > probability of dropping legitimate packets. The middle-ground solution > we are considering now -- originally suggested in [1] by Marcelo, and > slightly augmented in [2] by me with an alternative mode for DHCP-only > networks -- uses the combination of (A2) plus (B1). I would like folks > to consider in particular this combination of (A2) plus (B1) because it > constitutes a reasonable compromise between two competing solutions. > > Please also recall our working assumption that SAVI will operate > exclusively in wired networks, with switch ports constituting the > binding anchors. The goal of this working assumption is to relieve the > discussion from considerations about scenarios where SAVI can only have > limited benefit. Unprotected wireless networks are an example of those > scenarios, where forgeable MAC addresses are the only possible binding > anchors. We will re-evaluate at a later stage how well SAVI applies to > other scenarios. > > - Christian > > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html > [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From alberto@it.uc3m.es Mon Jul 20 03:50:21 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5E3E43A67AC for ; Mon, 20 Jul 2009 03:50:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id j5GCGp6dbU7E for ; Mon, 20 Jul 2009 03:50:20 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id C91E83A659B for ; Mon, 20 Jul 2009 03:50:19 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp01.uc3m.es (Postfix) with ESMTP id F09A7B49FD9; Mon, 20 Jul 2009 12:49:16 +0200 (CEST) From: =?iso-8859-15?Q?Alberto_Garc=EDa?= To: "'Eric Levy-Abegnoli'" , "'Christian Vogt'" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6443A5.5080302@cisco.com> Date: Mon, 20 Jul 2009 12:49:13 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-15" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <4A6443A5.5080302@cisco.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Thread-Index: AcoJI2qSHcUKttXYRUCdkHYHXbQQCwAATDQg X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16774.006 Cc: 'SAVI Mailing List' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 10:50:21 -0000 Hi | -----Mensaje original----- | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de Eric | Levy-Abegnoli | Enviado el: lunes, 20 de julio de 2009 12:15 | Para: Christian Vogt | CC: SAVI Mailing List | Asunto: Re: [savi] Consensus call on "unregistered" source addresses | =20 | Sorry for the late response, see inline ... | =20 | Christian Vogt a =E9crit : | > Folks - | > | > As announced earlier, we will have a consensus call on how SAVI = devices | > should treat source addresses for which no configuration signaling = was | > seen. Consensus questions for this were proposed on July 8, and = the | > feedback received from the working group indicates that those are = OK. | > | > I would hence like to initiate the consensus call. To participate = in | > the consensus call, please answer by Sunday, July 19, the following = two | > questions (A) and (B), using one of the two possible answers = provided | > for each question: | > | > (A) In networks where SLAAC is permitted for address configuration, = how | > should a SAVI device treat packets with a source address for = which | > neither a successful DAD procedure nor a DHCP assignment was = seen? | > | > (A1) Discard the packet | > (A2) Forward and optionally log the packet | > | The logging looks like the poor-man solution, and it carries its own | issues and caveats. It basically says "we can't rely on the accuracy = of | the binding table, so let's log to let the final word to a human". I think we are loosing perspective: A2 option does protect the binding performed by a DAD that is not lost.=20 What it is saying is what happens when this does not occur. I have read = in the list a number of cases in which this occurs. What A2 saying is that = in that events (may be not frequent, but that occur) communication of legitimate users cannot be interrupted.=20 Logging is optional. The protection is the binding when DAD occurs, and = this is valuable in itself. If you have resources to do logging, ok, go for = it.=20 Personally, I consider A1 unacceptable. For what to do for packets forwarded without seeing a DAD, maybe there = are other options to consider apart from A2: (A3) create a bind just when a data packet is received for the first = time (A4) create a bind just when a data packet is received for the first = time and use a SAVI protocol to check that there isn't a different binding = for the same address in other switches. More analysis should be carried to decide among A2, A3, A4... Ax.=20 But I don't consider A1. | However logging carries it's own serious issues: it forces to take = high | level hence slow actions in the data path, which makes the switch = either | a lot more vulnerable, or likely to fail to log important = informations. | It is also likely to generate amount of information out of reach of = many | network operators. | Using the logging as the excuse for failing to build an accurate = binding | table sounds dangerous: it suggests we expect a lot of false = positive, | which will make the log analysis hard, and will be exploited by attackers. | I'll prefer that we make assumptions on what it takes to build an | accurate binding table (non-volatile memory, maybe some assumption on | DAD, snooping on other NDP packets, etc), and when these assumptions | are true, we drop & log. I don't think non-volatile memory is a solution. Consider the root switch fails. Spanning tree takes sometime to be built again. In the meanwhile, a host connected to a switch has issued a DAD = NSOL. The host has no means to know that the switched infrastructure is not = going to deliver appropriately the DAD packet. When everything recovers, the = host traffic is blocked. And when switches change its position in the spanning tree, I don't = think there is an easy way to use the previous information, because it can be topologically meaningless. Snooping NDP packets: why NDP packets are more reliable than data = packets? For me this is just (A3). Regards Alberto | All devices are not equal (hardware/software wise, but also | deployment-wise), so would be acceptable to habe those which can't | verifyi the assumptions to not drop/log in my opinion. | Eric | > (B) In networks where only DHCP is permitted for address = configuration, | > how should a SAVI device treat packets with a source address = for | > which no DHCP assignment was seen? | > | > (B1) Discard the packet | > (B2) Forward and optionally log the packet | > | > In these questions, a SAVI device sees a "successful DAD procedure" = for | > an address if it sees a DAD Neighbor Solicitation message, but no | > responding DAD Neighbor Advertisement message, for this address. | > | > Please recall the relationship of our two main SAVI solution = proposals | > to these consensus questions: The FCFS and CPS solutions both use = the | > combination of (A1) plus (B1), with different means to reduce the | > probability of dropping legitimate packets. The middle-ground = solution | > we are considering now -- originally suggested in [1] by Marcelo, = and | > slightly augmented in [2] by me with an alternative mode for = DHCP-only | > networks -- uses the combination of (A2) plus (B1). I would like = folks | > to consider in particular this combination of (A2) plus (B1) = because it | > constitutes a reasonable compromise between two competing = solutions. | > | > Please also recall our working assumption that SAVI will operate | > exclusively in wired networks, with switch ports constituting the | > binding anchors. The goal of this working assumption is to relieve = the | > discussion from considerations about scenarios where SAVI can only = have | > limited benefit. Unprotected wireless networks are an example of = those | > scenarios, where forgeable MAC addresses are the only possible = binding | > anchors. We will re-evaluate at a later stage how well SAVI = applies to | > other scenarios. | > | > - Christian | > | > | > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html | > [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html | > | > | > | > _______________________________________________ | > savi mailing list | > savi@ietf.org | > https://www.ietf.org/mailman/listinfo/savi | > | =20 | _______________________________________________ | savi mailing list | savi@ietf.org | https://www.ietf.org/mailman/listinfo/savi From alberto@it.uc3m.es Mon Jul 20 03:57:58 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B012A3A699C for ; Mon, 20 Jul 2009 03:57:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0DZHHmuAFTQq for ; Mon, 20 Jul 2009 03:57:57 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 4BDBC3A67AC for ; Mon, 20 Jul 2009 03:57:56 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp02.uc3m.es (Postfix) with ESMTP id 3C5F66C2451; Mon, 20 Jul 2009 12:28:50 +0200 (CEST) From: =?utf-8?Q?Alberto_Garc=C3=ADa?= To: "'Dong Zhang'" , "'Christian Vogt'" , "'SAVI Mailing List'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com><200907151050081554172@huaweisymantec.com><75998D9056424F94A34294F878EF8958@bombo><200907161018350396693@huaweisymantec.com><16C7F3CCDE434470AF2D409B79B70A8E@bombo><200907171450265993512@huaweisymantec.com><4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> <200907201040329011805@huaweisymantec.com> Date: Mon, 20 Jul 2009 12:28:47 +0200 Message-ID: <86BC9051818A451D9387B294D512D11B@bombo> MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 In-Reply-To: <200907201040329011805@huaweisymantec.com> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 Thread-Index: AcoI44hA98flWtdsRCC5hU95ZpxRdAAQCr0g X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16774.006 Cc: 'Padmanabha Nallur 73868' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 10:57:58 -0000 Hi | -----Mensaje original----- | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de = Dong | Zhang | Enviado el: lunes, 20 de julio de 2009 4:41 | Para: Alberto_Garc=C3=ADa; 'Christian Vogt'; 'SAVI Mailing List' | CC: 'Padmanabha Nallur 73868' | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi Alberto, | Please check inline. | =20 | Thank you. | =20 | Alberto_Garc=C3=ADa 2009-07-17 Wrote: | >Hi | > | >| -----Mensaje original----- | >| De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre de | Dong | >| Zhang | >| Enviado el: viernes, 17 de julio de 2009 8:50 | >| Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | >| CC: 'Padmanabha Nallur 73868' | >| Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | >| | >| Alberto_Garc=E9=9F=86 2009-07-16 Wrote: | >| >| I do not think it is a conflict. The difference is just how = to | >| >| use CGA. For instance, the CGA proposal can be used in e2e, = even | between | >| >the | >| >| host | >| >| and the first-hop router. It can depend on the destination = option header. | >| > | >| >Shim6 allows transporting CGA information end-to-end. It does = that now, in | a | >| >standard way. Why you should want to generate a = yet-another-protocol to | >| >transport CGA information end-to-end? | >| Thank you for the information. | >| We will read Shim6. If it really does the relative job, we will = be glad to use it. | >| > | >| >Besides, what does such a protocol would have to do with SAVI? | >| >If you want to use CGAs for providing security in the link of = the host and | >| >the first-hop router, you should probably use the SEND protocol = (see | >| >draft-ietf-savi-send-00). Do you think there is something in the = SEND | >| >protocol that does not suit with binding IPv6 addresses and link = layer | >| >anchors, that could be improved? | >| >And if you want to use the CGA for address validation further = than the first | >| >hop routers, I see some reasons why you should not: at that = point you | need | >| >to validate prefixes, not host addresses, and CGA provides no = protection for | >| >prefixes: any host can generate a valid CGA with whichever = prefix it wanted. | >| >So just validating a CGA does not assure that the host is = authorized to use | >| >that prefix. | >| In the CGA-related information, it contains the signature. We = think it can | >| protect the prefix. Right? | > | >Well, it does not prove that a host has been legitimately assigned a = prefix. | >CGAs, with a protocol transporting signatures made with the private = key, only | assure that once a host generates a given address, it is very very = difficult for | another host to use the same address. And yes, the protection = includes the | prefix: it is just not enough to find a key pair whose hash generates = a given | interface identifier, and then you can impersonate any host with the = same | interface identifier in any network (i.e. with any prefix). | [Dong] Well, yes, we agree with this. CGA does not do identity = authentication. | We only validate the address so that someone else cannot use this IP = address. | We do not check for the IP address binding with a host or a user or = some other | higher level entity and validate that. | =20 | Just the fact that someone else cannot use the same address would = give the | benefits mentioned in the use cases within the draft. I think the place to do this is in the first link. And the tool SEND + = SAVI. Outside the first link, I think it is too costly to do checks in a = per-address basis, and you need other tools (manual configuration, = routing info...) for validating prefixes... so just validate prefixes = with this tools. | =20 | IMHO, we don't think even SAVI solutions need to validate the binding = of IP | address with users etc., only check if a certain IP address is used = on a specific | link. Yes, of course. I was not talking at any point in "users".=20 Again, to check the address, use SEND. | > | >But that says nothing about the legitimacy of ah host to use that = prefix. | >For example, give the prefix of your network, and I can generate = immediately | an CGA that claims to belong to your prefix: CGA =3D hash ( prefix | = public key | | etc). And I can use from my network, if the router (and some routers = above) | does not check source prefixes. Looking only at the CGA nobody can = know if my | host is authorized to use a prefix or not. | >So, CGA does not add anything to prefix protection. You have to = provide other | means to protect that. | I guess the ingress filtering could do this. And savi solutions are = the complement | for ingress filtering. This point has been discussed before. | > | > | >| > | >| >| > | >| >| >What does this type of solutions has to do with SAVI, = considering that | >| >the | >| >| >charter says: "No changes to hosts are allowed."? Isn't your = solution | >| >| >proposing a change to hosts? | >| >| Yes, the CGA proposal does not fit for the current charter = quit well to | >| >some | >| >| extend. | >| >| The reason why we put the CGA-related info in the extension = header is | >| >that it | >| >| has | >| >| the ability to provide a basic security for the source = address like AH & | >| >ESP. The | >| > | >| >The CGA security model does not have much relationship with AH & = ESP. | Well, | >| >all use keys, but besides that... | >| I mean if we could take the CGA-related information in the = extension header, | >| the packet will have AH, ESP and CGA for the basic security = characteristics, | >| including integrity, confidentiality, and authentication. | > | >This is completely different stuff. It seems like generating an = opportunistic IKE | security context (a la SSL) for a communication, starting with the = public/private | key pair associated to the CGAs of two hosts. Then you should look at | http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt | I am a little confused here. I have already known this draft before. = Are you | comparing it with my another draft, = http://tools.ietf.org/id/draft-zhang-shen-sa- | cga-00.txt ? I was not aware of your draft. I wasn't comparing anything, but, from = the title of your draft, yes it seems similar. Regards, Alberto | =20 | =20 | ------------------ | Dong Zhang | 2009-07-20 From jmh@joelhalpern.com Mon Jul 20 09:52:30 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 24F1728C1D2 for ; Mon, 20 Jul 2009 09:52:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.206 X-Spam-Level: X-Spam-Status: No, score=-3.206 tagged_above=-999 required=5 tests=[AWL=0.393, BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Kv1lXjUUwyTR for ; Mon, 20 Jul 2009 09:52:26 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by core3.amsl.com (Postfix) with ESMTP id 4A33E3A68E3 for ; Mon, 20 Jul 2009 09:52:26 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id 4914643011C for ; Mon, 20 Jul 2009 09:52:01 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-248.clppva.btas.verizon.net [71.161.52.248]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id 7259B43013E for ; Mon, 20 Jul 2009 09:52:00 -0700 (PDT) Message-ID: <4A64A0AD.3030906@joelhalpern.com> Date: Mon, 20 Jul 2009 12:51:57 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: SAVI Mailing List References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6443A5.5080302@cisco.com> In-Reply-To: <4A6443A5.5080302@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 16:52:30 -0000 While I agree with most of what Eric says below, I want to clarify one aspect of logging. Even if we can get perfect enforcement, if we are concerned about external use of addresses (which is almost certainly the case if we care about preventing unregistered address usage), logs are absolutely necessary. These may be logs of the allocation and binding process, rather than logs of the enforcement process (which is a big advantage in terms of complexity impact), but when someone external comes in and says "IP address X did action Y" there needs to be enough information to figure out what that means. More than just "yes, that is one of our addresses." Otherwise, when all is said and done, not much has been accomplished. Yours, Joel Eric Levy-Abegnoli wrote: > Sorry for the late response, see inline ... > > Christian Vogt a écrit : >> Folks - >> >> As announced earlier, we will have a consensus call on how SAVI devices >> should treat source addresses for which no configuration signaling was >> seen. Consensus questions for this were proposed on July 8, and the >> feedback received from the working group indicates that those are OK. >> >> I would hence like to initiate the consensus call. To participate in >> the consensus call, please answer by Sunday, July 19, the following two >> questions (A) and (B), using one of the two possible answers provided >> for each question: >> >> (A) In networks where SLAAC is permitted for address configuration, how >> should a SAVI device treat packets with a source address for which >> neither a successful DAD procedure nor a DHCP assignment was seen? >> >> (A1) Discard the packet >> (A2) Forward and optionally log the packet >> > The logging looks like the poor-man solution, and it carries its own > issues and caveats. It basically says "we can't rely on the accuracy of > the binding table, so let's log to let the final word to a human". > However logging carries it's own serious issues: it forces to take high > level hence slow actions in the data path, which makes the switch either > a lot more vulnerable, or likely to fail to log important informations. > It is also likely to generate amount of information out of reach of many > network operators. > Using the logging as the excuse for failing to build an accurate binding > table sounds dangerous: it suggests we expect a lot of false positive, > which will make the log analysis hard, and will be exploited by attackers. > I'll prefer that we make assumptions on what it takes to build an > accurate binding table (non-volatile memory, maybe some assumption on > DAD, snooping on other NDP packets, etc), and when these assumptions > are true, we drop & log. > All devices are not equal (hardware/software wise, but also > deployment-wise), so would be acceptable to habe those which can't > verifyi the assumptions to not drop/log in my opinion. > Eric >> (B) In networks where only DHCP is permitted for address configuration, >> how should a SAVI device treat packets with a source address for >> which no DHCP assignment was seen? >> >> (B1) Discard the packet >> (B2) Forward and optionally log the packet >> >> In these questions, a SAVI device sees a "successful DAD procedure" for >> an address if it sees a DAD Neighbor Solicitation message, but no >> responding DAD Neighbor Advertisement message, for this address. >> >> Please recall the relationship of our two main SAVI solution proposals >> to these consensus questions: The FCFS and CPS solutions both use the >> combination of (A1) plus (B1), with different means to reduce the >> probability of dropping legitimate packets. The middle-ground solution >> we are considering now -- originally suggested in [1] by Marcelo, and >> slightly augmented in [2] by me with an alternative mode for DHCP-only >> networks -- uses the combination of (A2) plus (B1). I would like folks >> to consider in particular this combination of (A2) plus (B1) because it >> constitutes a reasonable compromise between two competing solutions. >> >> Please also recall our working assumption that SAVI will operate >> exclusively in wired networks, with switch ports constituting the >> binding anchors. The goal of this working assumption is to relieve the >> discussion from considerations about scenarios where SAVI can only have >> limited benefit. Unprotected wireless networks are an example of those >> scenarios, where forgeable MAC addresses are the only possible binding >> anchors. We will re-evaluate at a later stage how well SAVI applies to >> other scenarios. >> >> - Christian >> >> >> [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html >> [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html >> >> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From alberto@it.uc3m.es Wed Jul 22 07:36:51 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5790028C107 for ; Wed, 22 Jul 2009 07:36:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Vzi9P83aaLRd for ; Wed, 22 Jul 2009 07:36:50 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id 8A98328C0F1 for ; Wed, 22 Jul 2009 07:36:49 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp03.uc3m.es (Postfix) with ESMTP id 1124B731631; Wed, 22 Jul 2009 16:16:24 +0200 (CEST) From: =?utf-8?Q?Alberto_Garc=C3=ADa?= To: "'Padmanabha Nallur'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> <200907201040329011805@huaweisymantec.com> <86BC9051818A451D9387B294D512D11B@bombo> <000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> Date: Wed, 22 Jul 2009 16:16:21 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> Thread-Index: AcoI44hA98flWtdsRCC5hU95ZpxRdAAQCr0gABXGNyAAVj56gA== X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16778.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2009 14:36:51 -0000 Hi, | -----Mensaje original----- | De: Padmanabha Nallur [mailto:pnallur@huawei.com] | Enviado el: lunes, 20 de julio de 2009 23:01 | Para: 'Alberto Garc=C3=ADa' | CC: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | Asunto: RE: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi Alberto, | =20 | The main point of the CGA proposal is to avoid IP spoofing. | In order to avoid IP spoofing the source IP address checks must be = performed | closer to the destination or destination network as opposed to = implementing | these checks in the source network (e.g., SAVI). | =20 | The CGA proposal provides an alternative solution to prevent IP = spoofing by | providing the checks that can be implemented in the destination = endpoint or | destination network (actually anywhere in the network). We would like = to | have as simple solution as possible and preferably even stateless = solution. In my opinion, what you are proposing is dangerous. Let's consider = flood-based DoS (draft-ietf-savi-threat-scope-00.txt): an attacker wants = to exhaust the victim's resources by sending traffic to it. With your = mechanism, packets with false CGA information do not only consume TCP = state, memory for IP fragmentation... but they also force the host to = spend a lot of CPU in using public cryptography to check a CGA! This is = what any attacker would like: force hosts to do a lot of work for fake = packets! This is why in Shim6 and HIP a 4-way handshake is performed: the = initiator must prove at least that the address is using is topologically = valid (for accounting purposes).=20 In addition, you propose not only perform this DoS-prone check not only = in the host, but anywhere in the network. So any router should divert a = packet from the silicon fast path to the router CPU to check the CGA... = That would be double prize for the attacker: not only compromising a = host, but the whole communication pipe of a site. I really don't see this. Regards, Alberto | This is the main goal of CGA proposal and it would be great if it can = ALSO | be used in other situations (e.g., SAVI) as you mentioned below. | =20 | Validation of the IP address itself (like prefix check) is not the = main goal | of the CGA proposal. | =20 | =20 | Thanks | Paddy Nallur | =20 | -----Original Message----- | From: Alberto Garc=C3=ADa [mailto:alberto@it.uc3m.es] | Sent: Monday, July 20, 2009 3:29 AM | To: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | Cc: 'Padmanabha Nallur 73868' | Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi | =20 | | -----Mensaje original----- | | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre = de | Dong | | Zhang | | Enviado el: lunes, 20 de julio de 2009 4:41 | | Para: Alberto_Garc=C3=ADa; 'Christian Vogt'; 'SAVI Mailing List' | | CC: 'Padmanabha Nallur 73868' | | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | | | | Hi Alberto, | | Please check inline. | | | | Thank you. | | | | Alberto_Garc=C3=ADa 2009-07-17 Wrote: | | >Hi | | > | | >| -----Mensaje original----- | | >| De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre de | | Dong | | >| Zhang | | >| Enviado el: viernes, 17 de julio de 2009 8:50 | | >| Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | | >| CC: 'Padmanabha Nallur 73868' | | >| Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | | >| | | >| Alberto_Garc=E9=9F=86 2009-07-16 Wrote: | | >| >| I do not think it is a conflict. The difference is just = how to | | >| >| use CGA. For instance, the CGA proposal can be used in = e2e, even | | between | | >| >the | | >| >| host | | >| >| and the first-hop router. It can depend on the destination = option | header. | | >| > | | >| >Shim6 allows transporting CGA information end-to-end. It does = that | now, in | | a | | >| >standard way. Why you should want to generate a = yet-another-protocol | to | | >| >transport CGA information end-to-end? | | >| Thank you for the information. | | >| We will read Shim6. If it really does the relative job, we = will be | glad to use it. | | >| > | | >| >Besides, what does such a protocol would have to do with = SAVI? | | >| >If you want to use CGAs for providing security in the link of = the | host and | | >| >the first-hop router, you should probably use the SEND = protocol (see | | >| >draft-ietf-savi-send-00). Do you think there is something in = the | SEND | | >| >protocol that does not suit with binding IPv6 addresses and = link | layer | | >| >anchors, that could be improved? | | >| >And if you want to use the CGA for address validation further = than | the first | | >| >hop routers, I see some reasons why you should not: at that = point | you | | need | | >| >to validate prefixes, not host addresses, and CGA provides no | protection for | | >| >prefixes: any host can generate a valid CGA with whichever = prefix it | wanted. | | >| >So just validating a CGA does not assure that the host is = authorized | to use | | >| >that prefix. | | >| In the CGA-related information, it contains the signature. We = think | it can | | >| protect the prefix. Right? | | > | | >Well, it does not prove that a host has been legitimately = assigned a | prefix. | | >CGAs, with a protocol transporting signatures made with the = private key, | only | | assure that once a host generates a given address, it is very very | difficult for | | another host to use the same address. And yes, the protection = includes | the | | prefix: it is just not enough to find a key pair whose hash = generates a | given | | interface identifier, and then you can impersonate any host with = the same | | interface identifier in any network (i.e. with any prefix). | | [Dong] Well, yes, we agree with this. CGA does not do identity | authentication. | | We only validate the address so that someone else cannot use this = IP | address. | | We do not check for the IP address binding with a host or a user = or some | other | | higher level entity and validate that. | | | | Just the fact that someone else cannot use the same address would = give | the | | benefits mentioned in the use cases within the draft. | =20 | I think the place to do this is in the first link. And the tool SEND = + SAVI. | Outside the first link, I think it is too costly to do checks in a | per-address basis, and you need other tools (manual configuration, = routing | info...) for validating prefixes... so just validate prefixes with = this | tools. | =20 | | | | IMHO, we don't think even SAVI solutions need to validate the = binding of | IP | | address with users etc., only check if a certain IP address is = used on a | specific | | link. | =20 | Yes, of course. I was not talking at any point in "users". | Again, to check the address, use SEND. | =20 | | > | | >But that says nothing about the legitimacy of ah host to use that | prefix. | | >For example, give the prefix of your network, and I can generate | immediately | | an CGA that claims to belong to your prefix: CGA =3D hash ( prefix = | public | key | | | etc). And I can use from my network, if the router (and some = routers | above) | | does not check source prefixes. Looking only at the CGA nobody can = know | if my | | host is authorized to use a prefix or not. | | >So, CGA does not add anything to prefix protection. You have to = provide | other | | means to protect that. | | I guess the ingress filtering could do this. And savi solutions = are the | complement | | for ingress filtering. This point has been discussed before. | | > | | > | | >| > | | >| >| > | | >| >| >What does this type of solutions has to do with SAVI, | considering that | | >| >the | | >| >| >charter says: "No changes to hosts are allowed."? Isn't = your | solution | | >| >| >proposing a change to hosts? | | >| >| Yes, the CGA proposal does not fit for the current charter = quit | well to | | >| >some | | >| >| extend. | | >| >| The reason why we put the CGA-related info in the = extension | header is | | >| >that it | | >| >| has | | >| >| the ability to provide a basic security for the source = address | like AH & | | >| >ESP. The | | >| > | | >| >The CGA security model does not have much relationship with = AH & | ESP. | | Well, | | >| >all use keys, but besides that... | | >| I mean if we could take the CGA-related information in the = extension | header, | | >| the packet will have AH, ESP and CGA for the basic security | characteristics, | | >| including integrity, confidentiality, and authentication. | | > | | >This is completely different stuff. It seems like generating an | opportunistic IKE | | security context (a la SSL) for a communication, starting with the | public/private | | key pair associated to the CGAs of two hosts. Then you should look = at | | http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt | | I am a little confused here. I have already known this draft = before. Are | you | | comparing it with my another draft, | http://tools.ietf.org/id/draft-zhang-shen-sa- | | cga-00.txt ? | =20 | I was not aware of your draft. I wasn't comparing anything, but, from = the | title of your draft, yes it seems similar. | =20 | Regards, | Alberto | =20 | | | | | | ------------------ | | Dong Zhang | | 2009-07-20 From christian.vogt@ericsson.com Wed Jul 22 15:22:50 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B24633A6C45 for ; Wed, 22 Jul 2009 15:22:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.242 X-Spam-Level: X-Spam-Status: No, score=-6.242 tagged_above=-999 required=5 tests=[AWL=0.357, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WNg7QC1qf3tH for ; Wed, 22 Jul 2009 15:22:50 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id DC0533A6C3A for ; Wed, 22 Jul 2009 15:22:49 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n6MMLpkP003616; Wed, 22 Jul 2009 17:21:52 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.56]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 17:21:41 -0500 Received: from [155.53.229.41] ([155.53.229.41]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 17:21:41 -0500 Message-Id: <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> From: Christian Vogt To: Marcelo Bagnulo Braun , Pekka Savola In-Reply-To: <4A6416E0.8090004@it.uc3m.es> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 22 Jul 2009 15:21:41 -0700 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 22 Jul 2009 22:21:41.0227 (UTC) FILETIME=[C9912BB0:01CA0B1A] Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2009 22:22:50 -0000 On Jul 20, 2009, Marcelo Bagnulo Braun wrote: >>> (B) In networks where only DHCP is permitted for address >>> configuration, >>> how should a SAVI device treat packets with a source address for >>> which no DHCP assignment was seen? >>> >>> (B1) Discard the packet >>> (B2) Forward and optionally log the packet >> >> In this case I suppose SAVI device would need to be manually >> configured >> to behave in this manner (i.e. it could not figure this out >> reliably on >> its own)? In that case, B1 would seem to be fine. > > Why are you not concerned about the SAVI device rebooting and loosing > its state (only learnt through the DHCP msg exchange snooping) and > blocking legit nodes out of the network in this case? > > I mean, isn't a similar problem that you mentioned in the above case > also possible here? Good point. A solution to deal with state loss in SAVI devices in DHCP- only networks, which enables (B1), is described in CPS: In DHCP-only networks, one can ensure, through manual configuration of SAVI devices, that SAVI protection is active only on ports that directly connect to hosts. This way, if a SAVI device loses state due to a reboot, hosts discard their DHCP state as well because the link temporarily goes down. Afterwards, hosts obtain new addresses via DHCP, thereby re-building the state in SAVI devices. The same could theoretically be applied also to networks where SLAAC is permitted (question A). But here, the cost of manual configuration may not pay off. The reason is that strong protection of unassigned addresses is of little use in networks where SLAAC is permitted due to the ability of hosts to self-assign any yet-unassigned address. Consequently, I think the combination of (A2) and (B1) does make sense. - Christian From christian.vogt@ericsson.com Wed Jul 22 15:27:45 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5B1453A6809 for ; Wed, 22 Jul 2009 15:27:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.313 X-Spam-Level: X-Spam-Status: No, score=-6.313 tagged_above=-999 required=5 tests=[AWL=0.286, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CF8cp-TOlN3e for ; Wed, 22 Jul 2009 15:27:44 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id 938B13A67F3 for ; Wed, 22 Jul 2009 15:27:44 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n6MMRBS8020694; Wed, 22 Jul 2009 17:27:12 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 17:26:24 -0500 Received: from [155.53.229.41] ([155.53.229.41]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Wed, 22 Jul 2009 17:26:23 -0500 Message-Id: <0E8C34F8-E315-44E0-ABE6-E79D44A9027B@ericsson.com> From: Christian Vogt To: Eric Levy-Abegnoli In-Reply-To: <4A6443A5.5080302@cisco.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Wed, 22 Jul 2009 15:26:24 -0700 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6443A5.5080302@cisco.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 22 Jul 2009 22:26:24.0033 (UTC) FILETIME=[7221F110:01CA0B1B] Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Jul 2009 22:27:45 -0000 On Jul 20, 2009, Eric Levy-Abegnoli wrote: >> (A) In networks where SLAAC is permitted for address configuration, >> how >> should a SAVI device treat packets with a source address for which >> neither a successful DAD procedure nor a DHCP assignment was seen? >> >> (A1) Discard the packet >> (A2) Forward and optionally log the packet >> > > [..] All devices are not equal (hardware/software wise, but also > deployment-wise), so would be acceptable to habe those which can't > verifyi the assumptions to not drop/log in my opinion. Eric, are you saying that you prefer (A2) without logging? - Christian From zhangdong_rh@huaweisymantec.com Wed Jul 22 21:09:29 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7323A3A6B34 for ; Wed, 22 Jul 2009 21:09:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.122 X-Spam-Level: * X-Spam-Status: No, score=1.122 tagged_above=-999 required=5 tests=[AWL=1.668, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, MIME_BASE64_TEXT=1.753] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nnqA5qGB-5FG for ; Wed, 22 Jul 2009 21:09:28 -0700 (PDT) Received: from mta1.huaweisymantec.com (mta1.huaweisymantec.com [218.17.155.14]) by core3.amsl.com (Postfix) with ESMTP id C43CE3A6B55 for ; Wed, 22 Jul 2009 21:08:54 -0700 (PDT) MIME-version: 1.0 Content-type: text/plain; charset=gb2312 Received: from hstml02-in.huaweisymantec.com ([172.26.3.41]) by hstga01-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTP id <0KN7000LZSI39W90@hstga01-in.huaweisymantec.com> for savi@ietf.org; Thu, 23 Jul 2009 11:03:40 +0800 (CST) Received: from z90001956 ([10.27.154.181]) by hstml02-in.huaweisymantec.com (Sun Java(tm) System Messaging Server 6.3-8.03 (built Apr 24 2009; 32bit)) with ESMTPA id <0KN700GU9SI3EQ00@hstml02-in.huaweisymantec.com> for savi@ietf.org; Thu, 23 Jul 2009 11:03:39 +0800 (CST) Date: Thu, 23 Jul 2009 11:03:39 +0800 From: Dong Zhang To: =?gb2312?B?QWxiZXJ0b19HYXJjqKph?= , 'Padmanabha Nallur' References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> <200907201040329011805@huaweisymantec.com> <86BC9051818A451D9387B294D512D11B@bombo> <000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> Message-id: <200907231103387344535@huaweisymantec.com> X-Mailer: Foxmail 6, 10, 201, 20 [cn] Content-transfer-encoding: base64 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 04:09:29 -0000 SGkgQWxiZXJ0bywNCkFsYmVydG9fR2FyY6iqYSAyMDA5LTA3LTIyIFdyb3RlOg0KPkhpLA0KPg0K PnwgIC0tLS0tTWVuc2FqZSBvcmlnaW5hbC0tLS0tDQo+fCAgRGU6IFBhZG1hbmFiaGEgTmFsbHVy IFttYWlsdG86cG5hbGx1ckBodWF3ZWkuY29tXQ0KPnwgIEVudmlhZG8gZWw6IGx1bmVzLCAyMCBk ZSBqdWxpbyBkZSAyMDA5IDIzOjAxDQo+fCAgUGFyYTogJ0FsYmVydG8gR2FyY6iqYScNCj58ICBD QzogJ0RvbmcgWmhhbmcnOyAnQ2hyaXN0aWFuIFZvZ3QnOyAnU0FWSSBNYWlsaW5nIExpc3QnDQo+ fCAgQXN1bnRvOiBSRTogW3NhdmldIEFib3V0IGRyYWZ0LWRvbmctc2F2aS1jZ2EtaGVhZGVyLTAy LnR4dA0KPnwgIA0KPnwgIEhpIEFsYmVydG8sDQo+fCAgDQo+fCAgVGhlIG1haW4gcG9pbnQgb2Yg dGhlIENHQSBwcm9wb3NhbCBpcyB0byBhdm9pZCBJUCBzcG9vZmluZy4NCj58ICBJbiBvcmRlciB0 byBhdm9pZCBJUCBzcG9vZmluZyB0aGUgc291cmNlIElQIGFkZHJlc3MgY2hlY2tzIG11c3QgYmUg cGVyZm9ybWVkDQo+fCAgY2xvc2VyIHRvIHRoZSBkZXN0aW5hdGlvbiBvciBkZXN0aW5hdGlvbiBu ZXR3b3JrIGFzIG9wcG9zZWQgdG8gaW1wbGVtZW50aW5nDQo+fCAgdGhlc2UgY2hlY2tzIGluIHRo ZSBzb3VyY2UgbmV0d29yayAoZS5nLiwgU0FWSSkuDQo+fCAgDQo+fCAgVGhlIENHQSBwcm9wb3Nh bCBwcm92aWRlcyBhbiBhbHRlcm5hdGl2ZSBzb2x1dGlvbiB0byBwcmV2ZW50IElQIHNwb29maW5n IGJ5DQo+fCAgcHJvdmlkaW5nIHRoZSBjaGVja3MgdGhhdCBjYW4gYmUgaW1wbGVtZW50ZWQgaW4g dGhlIGRlc3RpbmF0aW9uIGVuZHBvaW50IG9yDQo+fCAgZGVzdGluYXRpb24gbmV0d29yayAoYWN0 dWFsbHkgYW55d2hlcmUgaW4gdGhlIG5ldHdvcmspLiBXZSB3b3VsZCBsaWtlIHRvDQo+fCAgaGF2 ZSBhcyBzaW1wbGUgc29sdXRpb24gYXMgcG9zc2libGUgYW5kIHByZWZlcmFibHkgZXZlbiBzdGF0 ZWxlc3Mgc29sdXRpb24uDQo+DQo+SW4gbXkgb3Bpbmlvbiwgd2hhdCB5b3UgYXJlIHByb3Bvc2lu ZyBpcyBkYW5nZXJvdXMuIExldCdzIGNvbnNpZGVyIGZsb29kLWJhc2VkIERvUyAoZHJhZnQtaWV0 Zi1zYXZpLXRocmVhdC1zY29wZS0wMC50eHQpOiBhbiBhdHRhY2tlciB3YW50cyB0byBleGhhdXN0 IHRoZSB2aWN0aW0ncyByZXNvdXJjZXMgYnkgc2VuZGluZyB0cmFmZmljIHRvIGl0LiBXaXRoIHlv dXIgbWVjaGFuaXNtLCBwYWNrZXRzIHdpdGggZmFsc2UgQ0dBIGluZm9ybWF0aW9uIGRvIG5vdCBv bmx5IGNvbnN1bWUgVENQIHN0YXRlLCBtZW1vcnkgZm9yIElQIGZyYWdtZW50YXRpb24uLi4gYnV0 IHRoZXkgYWxzbyBmb3JjZSB0aGUgaG9zdCB0byBzcGVuZCBhIGxvdCBvZiBDUFUgaW4gdXNpbmcg cHVibGljIGNyeXB0b2dyYXBoeSB0byBjaGVjayBhIENHQSEgVGhpcyBpcyB3aGF0IGFueSBhdHRh Y2tlciB3b3VsZCBsaWtlOiBmb3JjZSBob3N0cyB0byBkbyBhIGxvdCBvZiB3b3JrIGZvciBmYWtl IHBhY2tldHMhDQo+VGhpcyBpcyB3aHkgaW4gU2hpbTYgYW5kIEhJUCBhIDQtd2F5IGhhbmRzaGFr ZSBpcyBwZXJmb3JtZWQ6IHRoZSBpbml0aWF0b3IgbXVzdCBwcm92ZSBhdCBsZWFzdCB0aGF0IHRo ZSBhZGRyZXNzIGlzIHVzaW5nIGlzIHRvcG9sb2dpY2FsbHkgdmFsaWQgKGZvciBhY2NvdW50aW5n IHB1cnBvc2VzKS4gDQpXZSBhcmUgYXdhcmUgb2YgdGhlIGNvc3Qgb2YgdGhlIGNvbXB1dGF0aW9u IGFuZCB0aGUgYSBmZXcgcG9zc2libGUgRG9TIGF0dGFja3MuDQpQbGVhc2UgcmVhZCB0aGUgc2Vj dGlvbiA4IGFuZCB0aGUgc2VjdXJpdHkgY29uc2lkZXJhdGlvbiBpbiB0aGUgZHJhZnQuIFdvdWxk IHRoZXNlIHJlbW92ZSB5b3VyIHdvcnJ5Pw0KDQpUaGFua3MuDQo+DQo+SW4gYWRkaXRpb24sIHlv dSBwcm9wb3NlIG5vdCBvbmx5IHBlcmZvcm0gdGhpcyBEb1MtcHJvbmUgY2hlY2sgbm90IG9ubHkg aW4gdGhlIGhvc3QsIGJ1dCAgYW55d2hlcmUgaW4gdGhlIG5ldHdvcmsuIFNvIGFueSByb3V0ZXIg c2hvdWxkIGRpdmVydCBhIHBhY2tldCBmcm9tIHRoZSBzaWxpY29uIGZhc3QgcGF0aCB0byB0aGUg cm91dGVyIENQVSB0byBjaGVjayB0aGUgQ0dBLi4uIFRoYXQgd291bGQgYmUgZG91YmxlIHByaXpl IGZvciB0aGUgYXR0YWNrZXI6IG5vdCBvbmx5IGNvbXByb21pc2luZyBhIGhvc3QsIGJ1dCB0aGUg d2hvbGUgY29tbXVuaWNhdGlvbiBwaXBlIG9mIGEgc2l0ZS4NCj4NCj5JIHJlYWxseSBkb24ndCBz ZWUgdGhpcy4NCj4NCj5SZWdhcmRzLA0KPkFsYmVydG8NCj4NCj58ICBUaGlzIGlzIHRoZSBtYWlu IGdvYWwgb2YgQ0dBIHByb3Bvc2FsIGFuZCBpdCB3b3VsZCBiZSBncmVhdCBpZiBpdCBjYW4gQUxT Tw0KPnwgIGJlIHVzZWQgaW4gb3RoZXIgc2l0dWF0aW9ucyAoZS5nLiwgU0FWSSkgYXMgeW91IG1l bnRpb25lZCBiZWxvdy4NCj58ICANCj58ICBWYWxpZGF0aW9uIG9mIHRoZSBJUCBhZGRyZXNzIGl0 c2VsZiAobGlrZSBwcmVmaXggY2hlY2spIGlzIG5vdCB0aGUgbWFpbiBnb2FsDQo+fCAgb2YgdGhl IENHQSBwcm9wb3NhbC4NCj58ICANCj58ICANCj58ICBUaGFua3MNCj58ICBQYWRkeSBOYWxsdXIN Cj58ICANCj58ICAtLS0tLU9yaWdpbmFsIE1lc3NhZ2UtLS0tLQ0KPnwgIEZyb206IEFsYmVydG8g R2FyY6iqYSBbbWFpbHRvOmFsYmVydG9AaXQudWMzbS5lc10NCj58ICBTZW50OiBNb25kYXksIEp1 bHkgMjAsIDIwMDkgMzoyOSBBTQ0KPnwgIFRvOiAnRG9uZyBaaGFuZyc7ICdDaHJpc3RpYW4gVm9n dCc7ICdTQVZJIE1haWxpbmcgTGlzdCcNCj58ICBDYzogJ1BhZG1hbmFiaGEgTmFsbHVyIDczODY4 Jw0KPnwgIFN1YmplY3Q6IFJFOiBbc2F2aV0gQWJvdXQgZHJhZnQtZG9uZy1zYXZpLWNnYS1oZWFk ZXItMDIudHh0DQo+fCAgDQo+fCAgSGkNCj58ICANCj58ICB8ICAtLS0tLU1lbnNhamUgb3JpZ2lu YWwtLS0tLQ0KPnwgIHwgIERlOiBzYXZpLWJvdW5jZXNAaWV0Zi5vcmcgW21haWx0bzpzYXZpLWJv dW5jZXNAaWV0Zi5vcmddIEVuIG5vbWJyZSBkZQ0KPnwgIERvbmcNCj58ICB8ICBaaGFuZw0KPnwg IHwgIEVudmlhZG8gZWw6IGx1bmVzLCAyMCBkZSBqdWxpbyBkZSAyMDA5IDQ6NDENCj58ICB8ICBQ YXJhOiBBbGJlcnRvX0dhcmOoqmE7ICdDaHJpc3RpYW4gVm9ndCc7ICdTQVZJIE1haWxpbmcgTGlz dCcNCj58ICB8ICBDQzogJ1BhZG1hbmFiaGEgTmFsbHVyIDczODY4Jw0KPnwgIHwgIEFzdW50bzog UmU6IFtzYXZpXSBBYm91dCBkcmFmdC1kb25nLXNhdmktY2dhLWhlYWRlci0wMi50eHQNCj58ICB8 DQo+fCAgfCAgSGkgQWxiZXJ0bywNCj58ICB8ICBQbGVhc2UgY2hlY2sgaW5saW5lLg0KPnwgIHwN Cj58ICB8ICBUaGFuayB5b3UuDQo+fCAgfA0KPnwgIHwgIEFsYmVydG9fR2FyY6iqYSAyMDA5LTA3 LTE3IFdyb3RlOg0KPnwgIHwgID5IaQ0KPnwgIHwgID4NCj58ICB8ICA+fCAgLS0tLS1NZW5zYWpl IG9yaWdpbmFsLS0tLS0NCj58ICB8ICA+fCAgRGU6IHNhdmktYm91bmNlc0BpZXRmLm9yZyBbbWFp bHRvOnNhdmktYm91bmNlc0BpZXRmLm9yZ10gRW4gbm9tYnJlIGRlDQo+fCAgfCAgRG9uZw0KPnwg IHwgID58ICBaaGFuZw0KPnwgIHwgID58ICBFbnZpYWRvIGVsOiB2aWVybmVzLCAxNyBkZSBqdWxp byBkZSAyMDA5IDg6NTANCj58ICB8ICA+fCAgUGFyYTogQWxiZXJ0b19HYXJjPzsgJ0NocmlzdGlh biBWb2d0JzsgJ1NBVkkgTWFpbGluZyBMaXN0Jw0KPnwgIHwgID58ICBDQzogJ1BhZG1hbmFiaGEg TmFsbHVyIDczODY4Jw0KPnwgIHwgID58ICBBc3VudG86IFJlOiBbc2F2aV0gQWJvdXQgZHJhZnQt ZG9uZy1zYXZpLWNnYS1oZWFkZXItMDIudHh0DQo+fCAgfCAgPnwNCj58ICB8ICA+fCAgQWxiZXJ0 b19HYXJj7WEgMjAwOS0wNy0xNiBXcm90ZToNCj58ICB8ICA+fCAgPnwgIEkgZG8gbm90IHRoaW5r IGl0IGlzIGEgY29uZmxpY3QuIFRoZSBkaWZmZXJlbmNlIGlzIGp1c3QgaG93IHRvDQo+fCAgfCAg PnwgID58ICB1c2UgQ0dBLiBGb3IgaW5zdGFuY2UsIHRoZSBDR0EgcHJvcG9zYWwgY2FuIGJlIHVz ZWQgaW4gZTJlLCBldmVuDQo+fCAgfCAgYmV0d2Vlbg0KPnwgIHwgID58ICA+dGhlDQo+fCAgfCAg PnwgID58ICBob3N0DQo+fCAgfCAgPnwgID58ICBhbmQgdGhlIGZpcnN0LWhvcCByb3V0ZXIuIEl0 IGNhbiBkZXBlbmQgb24gdGhlIGRlc3RpbmF0aW9uIG9wdGlvbg0KPnwgIGhlYWRlci4NCj58ICB8 ICA+fCAgPg0KPnwgIHwgID58ICA+U2hpbTYgYWxsb3dzIHRyYW5zcG9ydGluZyBDR0EgaW5mb3Jt YXRpb24gZW5kLXRvLWVuZC4gSXQgZG9lcyB0aGF0DQo+fCAgbm93LCBpbg0KPnwgIHwgIGENCj58 ICB8ICA+fCAgPnN0YW5kYXJkIHdheS4gV2h5IHlvdSBzaG91bGQgd2FudCB0byBnZW5lcmF0ZSBh IHlldC1hbm90aGVyLXByb3RvY29sDQo+fCAgdG8NCj58ICB8ICA+fCAgPnRyYW5zcG9ydCBDR0Eg aW5mb3JtYXRpb24gZW5kLXRvLWVuZD8NCj58ICB8ICA+fCAgVGhhbmsgeW91IGZvciB0aGUgaW5m b3JtYXRpb24uDQo+fCAgfCAgPnwgIFdlIHdpbGwgcmVhZCBTaGltNi4gSWYgaXQgcmVhbGx5IGRv ZXMgdGhlIHJlbGF0aXZlIGpvYiwgd2Ugd2lsbCBiZQ0KPnwgIGdsYWQgdG8gdXNlIGl0Lg0KPnwg IHwgID58ICA+DQo+fCAgfCAgPnwgID5CZXNpZGVzLCB3aGF0IGRvZXMgc3VjaCBhIHByb3RvY29s IHdvdWxkIGhhdmUgdG8gZG8gd2l0aCBTQVZJPw0KPnwgIHwgID58ICA+SWYgeW91IHdhbnQgdG8g dXNlIENHQXMgZm9yIHByb3ZpZGluZyBzZWN1cml0eSBpbiB0aGUgbGluayBvZiB0aGUNCj58ICBo b3N0IGFuZA0KPnwgIHwgID58ICA+dGhlIGZpcnN0LWhvcCByb3V0ZXIsIHlvdSBzaG91bGQgcHJv YmFibHkgdXNlIHRoZSBTRU5EIHByb3RvY29sIChzZWUNCj58ICB8ICA+fCAgPmRyYWZ0LWlldGYt c2F2aS1zZW5kLTAwKS4gRG8geW91IHRoaW5rIHRoZXJlIGlzIHNvbWV0aGluZyBpbiB0aGUNCj58 ICBTRU5EDQo+fCAgfCAgPnwgID5wcm90b2NvbCB0aGF0IGRvZXMgbm90IHN1aXQgd2l0aCBiaW5k aW5nIElQdjYgYWRkcmVzc2VzIGFuZCBsaW5rDQo+fCAgbGF5ZXINCj58ICB8ICA+fCAgPmFuY2hv cnMsIHRoYXQgY291bGQgYmUgaW1wcm92ZWQ/DQo+fCAgfCAgPnwgID5BbmQgaWYgeW91IHdhbnQg dG8gdXNlIHRoZSBDR0EgZm9yIGFkZHJlc3MgdmFsaWRhdGlvbiBmdXJ0aGVyIHRoYW4NCj58ICB0 aGUgZmlyc3QNCj58ICB8ICA+fCAgPmhvcCByb3V0ZXJzLCBJIHNlZSBzb21lIHJlYXNvbnMgd2h5 IHlvdSBzaG91bGQgbm90OiAgYXQgdGhhdCBwb2ludA0KPnwgIHlvdQ0KPnwgIHwgIG5lZWQNCj58 ICB8ICA+fCAgPnRvIHZhbGlkYXRlIHByZWZpeGVzLCBub3QgaG9zdCBhZGRyZXNzZXMsIGFuZCBD R0EgcHJvdmlkZXMgbm8NCj58ICBwcm90ZWN0aW9uIGZvcg0KPnwgIHwgID58ICA+cHJlZml4ZXM6 IGFueSBob3N0IGNhbiBnZW5lcmF0ZSBhIHZhbGlkIENHQSB3aXRoIHdoaWNoZXZlciBwcmVmaXgg aXQNCj58ICB3YW50ZWQuDQo+fCAgfCAgPnwgID5TbyBqdXN0IHZhbGlkYXRpbmcgYSBDR0EgZG9l cyBub3QgYXNzdXJlIHRoYXQgdGhlIGhvc3QgaXMgYXV0aG9yaXplZA0KPnwgIHRvIHVzZQ0KPnwg IHwgID58ICA+dGhhdCBwcmVmaXguDQo+fCAgfCAgPnwgIEluIHRoZSBDR0EtcmVsYXRlZCBpbmZv cm1hdGlvbiwgaXQgY29udGFpbnMgdGhlIHNpZ25hdHVyZS4gV2UgdGhpbmsNCj58ICBpdCBjYW4N Cj58ICB8ICA+fCAgcHJvdGVjdCB0aGUgcHJlZml4LiBSaWdodD8NCj58ICB8ICA+DQo+fCAgfCAg PldlbGwsIGl0IGRvZXMgbm90IHByb3ZlIHRoYXQgYSBob3N0IGhhcyBiZWVuIGxlZ2l0aW1hdGVs eSBhc3NpZ25lZCBhDQo+fCAgcHJlZml4Lg0KPnwgIHwgID5DR0FzLCB3aXRoIGEgcHJvdG9jb2wg dHJhbnNwb3J0aW5nIHNpZ25hdHVyZXMgbWFkZSB3aXRoIHRoZSBwcml2YXRlIGtleSwNCj58ICBv bmx5DQo+fCAgfCAgYXNzdXJlIHRoYXQgb25jZSBhIGhvc3QgZ2VuZXJhdGVzIGEgZ2l2ZW4gYWRk cmVzcywgaXQgaXMgdmVyeSB2ZXJ5DQo+fCAgZGlmZmljdWx0IGZvcg0KPnwgIHwgIGFub3RoZXIg aG9zdCB0byB1c2UgdGhlIHNhbWUgYWRkcmVzcy4gQW5kIHllcywgdGhlIHByb3RlY3Rpb24gaW5j bHVkZXMNCj58ICB0aGUNCj58ICB8ICBwcmVmaXg6IGl0IGlzIGp1c3Qgbm90IGVub3VnaCB0byBm aW5kIGEga2V5IHBhaXIgd2hvc2UgaGFzaCBnZW5lcmF0ZXMgYQ0KPnwgIGdpdmVuDQo+fCAgfCAg aW50ZXJmYWNlIGlkZW50aWZpZXIsIGFuZCB0aGVuIHlvdSBjYW4gaW1wZXJzb25hdGUgYW55IGhv c3Qgd2l0aCB0aGUgc2FtZQ0KPnwgIHwgIGludGVyZmFjZSBpZGVudGlmaWVyIGluIGFueSBuZXR3 b3JrIChpLmUuIHdpdGggYW55IHByZWZpeCkuDQo+fCAgfCAgW0RvbmddIFdlbGwsIHllcywgd2Ug YWdyZWUgd2l0aCB0aGlzLiBDR0EgZG9lcyBub3QgZG8gaWRlbnRpdHkNCj58ICBhdXRoZW50aWNh dGlvbi4NCj58ICB8ICBXZSBvbmx5IHZhbGlkYXRlIHRoZSBhZGRyZXNzIHNvIHRoYXQgc29tZW9u ZSBlbHNlIGNhbm5vdCB1c2UgdGhpcyBJUA0KPnwgIGFkZHJlc3MuDQo+fCAgfCAgV2UgZG8gbm90 IGNoZWNrIGZvciB0aGUgSVAgYWRkcmVzcyBiaW5kaW5nIHdpdGggYSBob3N0ICBvciBhIHVzZXIg b3Igc29tZQ0KPnwgIG90aGVyDQo+fCAgfCAgaGlnaGVyIGxldmVsIGVudGl0eSBhbmQgdmFsaWRh dGUgdGhhdC4NCj58ICB8DQo+fCAgfCAgSnVzdCB0aGUgZmFjdCB0aGF0IHNvbWVvbmUgZWxzZSBj YW5ub3QgdXNlIHRoZSBzYW1lIGFkZHJlc3Mgd291bGQgZ2l2ZQ0KPnwgIHRoZQ0KPnwgIHwgIGJl bmVmaXRzIG1lbnRpb25lZCBpbiB0aGUgdXNlIGNhc2VzIHdpdGhpbiB0aGUgZHJhZnQuDQo+fCAg DQo+fCAgSSB0aGluayB0aGUgcGxhY2UgdG8gZG8gdGhpcyBpcyBpbiB0aGUgZmlyc3QgbGluay4g QW5kIHRoZSB0b29sIFNFTkQgKyBTQVZJLg0KPnwgIE91dHNpZGUgdGhlIGZpcnN0IGxpbmssIEkg dGhpbmsgaXQgaXMgdG9vIGNvc3RseSB0byBkbyBjaGVja3MgaW4gYQ0KPnwgIHBlci1hZGRyZXNz IGJhc2lzLCBhbmQgeW91IG5lZWQgb3RoZXIgdG9vbHMgKG1hbnVhbCBjb25maWd1cmF0aW9uLCBy b3V0aW5nDQo+fCAgaW5mby4uLikgZm9yIHZhbGlkYXRpbmcgcHJlZml4ZXMuLi4gc28ganVzdCB2 YWxpZGF0ZSBwcmVmaXhlcyB3aXRoIHRoaXMNCj58ICB0b29scy4NCj58ICANCj58ICB8DQo+fCAg fCAgSU1ITywgd2UgZG9uJ3QgdGhpbmsgZXZlbiBTQVZJIHNvbHV0aW9ucyBuZWVkIHRvIHZhbGlk YXRlIHRoZSBiaW5kaW5nIG9mDQo+fCAgSVANCj58ICB8ICBhZGRyZXNzIHdpdGggdXNlcnMgZXRj Liwgb25seSBjaGVjayBpZiBhIGNlcnRhaW4gSVAgYWRkcmVzcyBpcyB1c2VkIG9uIGENCj58ICBz cGVjaWZpYw0KPnwgIHwgIGxpbmsuDQo+fCAgDQo+fCAgWWVzLCBvZiBjb3Vyc2UuIEkgd2FzIG5v dCB0YWxraW5nIGF0IGFueSBwb2ludCBpbiAidXNlcnMiLg0KPnwgIEFnYWluLCB0byBjaGVjayB0 aGUgYWRkcmVzcywgdXNlIFNFTkQuDQo+fCAgDQo+fCAgfCAgPg0KPnwgIHwgID5CdXQgdGhhdCBz YXlzIG5vdGhpbmcgYWJvdXQgdGhlIGxlZ2l0aW1hY3kgb2YgYWggaG9zdCB0byB1c2UgdGhhdA0K PnwgIHByZWZpeC4NCj58ICB8ICA+Rm9yIGV4YW1wbGUsIGdpdmUgdGhlIHByZWZpeCBvZiB5b3Vy IG5ldHdvcmssIGFuZCBJIGNhbiBnZW5lcmF0ZQ0KPnwgIGltbWVkaWF0ZWx5DQo+fCAgfCAgYW4g Q0dBIHRoYXQgY2xhaW1zIHRvIGJlbG9uZyB0byB5b3VyIHByZWZpeDogQ0dBID0gaGFzaCAoIHBy ZWZpeCB8IHB1YmxpYw0KPnwgIGtleSB8DQo+fCAgfCAgZXRjKS4gQW5kIEkgY2FuIHVzZSBmcm9t IG15IG5ldHdvcmssIGlmIHRoZSByb3V0ZXIgKGFuZCBzb21lIHJvdXRlcnMNCj58ICBhYm92ZSkN Cj58ICB8ICBkb2VzIG5vdCBjaGVjayBzb3VyY2UgcHJlZml4ZXMuIExvb2tpbmcgb25seSBhdCB0 aGUgQ0dBIG5vYm9keSBjYW4ga25vdw0KPnwgIGlmIG15DQo+fCAgfCAgaG9zdCBpcyBhdXRob3Jp emVkIHRvIHVzZSBhIHByZWZpeCBvciBub3QuDQo+fCAgfCAgPlNvLCBDR0EgZG9lcyBub3QgYWRk IGFueXRoaW5nIHRvIHByZWZpeCBwcm90ZWN0aW9uLiBZb3UgaGF2ZSB0byBwcm92aWRlDQo+fCAg b3RoZXINCj58ICB8ICBtZWFucyB0byBwcm90ZWN0IHRoYXQuDQo+fCAgfCAgSSBndWVzcyB0aGUg aW5ncmVzcyBmaWx0ZXJpbmcgY291bGQgZG8gdGhpcy4gQW5kIHNhdmkgc29sdXRpb25zIGFyZSB0 aGUNCj58ICBjb21wbGVtZW50DQo+fCAgfCAgZm9yIGluZ3Jlc3MgZmlsdGVyaW5nLiBUaGlzIHBv aW50IGhhcyBiZWVuIGRpc2N1c3NlZCBiZWZvcmUuDQo+fCAgfCAgPg0KPnwgIHwgID4NCj58ICB8 ICA+fCAgPg0KPnwgIHwgID58ICA+fCAgPg0KPnwgIHwgID58ICA+fCAgPldoYXQgZG9lcyB0aGlz IHR5cGUgb2Ygc29sdXRpb25zIGhhcyB0byBkbyB3aXRoIFNBVkksDQo+fCAgY29uc2lkZXJpbmcg dGhhdA0KPnwgIHwgID58ICA+dGhlDQo+fCAgfCAgPnwgID58ICA+Y2hhcnRlciBzYXlzOiAiTm8g Y2hhbmdlcyB0byBob3N0cyBhcmUgYWxsb3dlZC4iPyBJc24ndCB5b3VyDQo+fCAgc29sdXRpb24N Cj58ICB8ICA+fCAgPnwgID5wcm9wb3NpbmcgYSBjaGFuZ2UgdG8gaG9zdHM/DQo+fCAgfCAgPnwg ID58ICBZZXMsIHRoZSBDR0EgcHJvcG9zYWwgZG9lcyBub3QgZml0IGZvciB0aGUgY3VycmVudCBj aGFydGVyIHF1aXQNCj58ICB3ZWxsIHRvDQo+fCAgfCAgPnwgID5zb21lDQo+fCAgfCAgPnwgID58 ICBleHRlbmQuDQo+fCAgfCAgPnwgID58ICBUaGUgcmVhc29uIHdoeSB3ZSBwdXQgdGhlIENHQS1y ZWxhdGVkIGluZm8gaW4gdGhlIGV4dGVuc2lvbg0KPnwgIGhlYWRlciBpcw0KPnwgIHwgID58ICA+ dGhhdCBpdA0KPnwgIHwgID58ICA+fCAgaGFzDQo+fCAgfCAgPnwgID58ICB0aGUgYWJpbGl0eSB0 byBwcm92aWRlIGEgYmFzaWMgc2VjdXJpdHkgZm9yIHRoZSBzb3VyY2UgYWRkcmVzcw0KPnwgIGxp a2UgQUggJg0KPnwgIHwgID58ICA+RVNQLiBUaGUNCj58ICB8ICA+fCAgPg0KPnwgIHwgID58ICA+ VGhlIENHQSBzZWN1cml0eSBtb2RlbCBkb2VzIG5vdCBoYXZlIG11Y2ggcmVsYXRpb25zaGlwIHdp dGggQUggJg0KPnwgIEVTUC4NCj58ICB8ICBXZWxsLA0KPnwgIHwgID58ICA+YWxsIHVzZSBrZXlz LCBidXQgYmVzaWRlcyB0aGF0Li4uDQo+fCAgfCAgPnwgIEkgbWVhbiBpZiB3ZSBjb3VsZCB0YWtl IHRoZSBDR0EtcmVsYXRlZCBpbmZvcm1hdGlvbiBpbiB0aGUgZXh0ZW5zaW9uDQo+fCAgaGVhZGVy LA0KPnwgIHwgID58ICB0aGUgcGFja2V0IHdpbGwgaGF2ZSBBSCwgRVNQIGFuZCBDR0EgZm9yIHRo ZSBiYXNpYyBzZWN1cml0eQ0KPnwgIGNoYXJhY3RlcmlzdGljcywNCj58ICB8ICA+fCAgaW5jbHVk aW5nIGludGVncml0eSwgY29uZmlkZW50aWFsaXR5LCBhbmQgYXV0aGVudGljYXRpb24uDQo+fCAg fCAgPg0KPnwgIHwgID5UaGlzIGlzIGNvbXBsZXRlbHkgZGlmZmVyZW50IHN0dWZmLiBJdCBzZWVt cyBsaWtlIGdlbmVyYXRpbmcgYW4NCj58ICBvcHBvcnR1bmlzdGljIElLRQ0KPnwgIHwgIHNlY3Vy aXR5IGNvbnRleHQgKGEgbGEgU1NMKSBmb3IgYSBjb21tdW5pY2F0aW9uLCBzdGFydGluZyB3aXRo IHRoZQ0KPnwgIHB1YmxpYy9wcml2YXRlDQo+fCAgfCAga2V5IHBhaXIgYXNzb2NpYXRlZCB0byB0 aGUgQ0dBcyBvZiB0d28gaG9zdHMuIFRoZW4geW91IHNob3VsZCBsb29rIGF0DQo+fCAgfCAgaHR0 cDovL3Rvb2xzLmlldGYub3JnL2lkL2RyYWZ0LWxhZ2FuaWVyLWlrZS1pcHY2LWNnYS0wMi50eHQN Cj58ICB8ICBJIGFtIGEgbGl0dGxlIGNvbmZ1c2VkIGhlcmUuIEkgaGF2ZSBhbHJlYWR5IGtub3du IHRoaXMgZHJhZnQgYmVmb3JlLiBBcmUNCj58ICB5b3UNCj58ICB8ICBjb21wYXJpbmcgaXQgd2l0 aCBteSBhbm90aGVyIGRyYWZ0LA0KPnwgIGh0dHA6Ly90b29scy5pZXRmLm9yZy9pZC9kcmFmdC16 aGFuZy1zaGVuLXNhLQ0KPnwgIHwgIGNnYS0wMC50eHQgPw0KPnwgIA0KPnwgIEkgd2FzIG5vdCBh d2FyZSBvZiB5b3VyIGRyYWZ0LiBJIHdhc24ndCBjb21wYXJpbmcgYW55dGhpbmcsIGJ1dCwgZnJv bSB0aGUNCj58ICB0aXRsZSBvZiB5b3VyIGRyYWZ0LCB5ZXMgaXQgc2VlbXMgc2ltaWxhci4NCj58 ICANCj58ICBSZWdhcmRzLA0KPnwgIEFsYmVydG8NCj58ICANCj58ICB8DQo+fCAgfA0KPnwgIHwg IC0tLS0tLS0tLS0tLS0tLS0tLQ0KPnwgIHwgIERvbmcgWmhhbmcNCj58ICB8ICAyMDA5LTA3LTIw DQo+DQo+Lg0KDQoNCg== From marcelo@it.uc3m.es Thu Jul 23 00:44:28 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 29E653A6765 for ; Thu, 23 Jul 2009 00:44:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.545 X-Spam-Level: X-Spam-Status: No, score=-6.545 tagged_above=-999 required=5 tests=[AWL=0.054, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rw2MU1EqXwOS for ; Thu, 23 Jul 2009 00:44:27 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 7A3C43A6870 for ; Thu, 23 Jul 2009 00:43:35 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id 1B3816BABD3; Thu, 23 Jul 2009 09:23:03 +0200 (CEST) Message-ID: <4A680FD7.4000202@it.uc3m.es> Date: Thu, 23 Jul 2009 09:23:03 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Christian Vogt References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> In-Reply-To: <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.003 Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 07:44:28 -0000 Christian Vogt escribió: > > On Jul 20, 2009, Marcelo Bagnulo Braun wrote: > >>>> (B) In networks where only DHCP is permitted for address >>>> configuration, >>>> how should a SAVI device treat packets with a source address for >>>> which no DHCP assignment was seen? >>>> >>>> (B1) Discard the packet >>>> (B2) Forward and optionally log the packet >>> >>> In this case I suppose SAVI device would need to be manually configured > >>> to behave in this manner (i.e. it could not figure this out reliably on >>> its own)? In that case, B1 would seem to be fine. >> >> Why are you not concerned about the SAVI device rebooting and loosing >> its state (only learnt through the DHCP msg exchange snooping) and >> blocking legit nodes out of the network in this case? >> >> I mean, isn't a similar problem that you mentioned in the above case >> also possible here? > > Good point. A solution to deal with state loss in SAVI devices in DHCP- > only networks, which enables (B1), is described in CPS: > > In DHCP-only networks, one can ensure, through manual configuration of > SAVI devices, that SAVI protection is active only on ports that directly > connect to hosts. This way, if a SAVI device loses state due to a > reboot, hosts discard their DHCP state as well because the link > temporarily goes down. Afterwards, hosts obtain new addresses via DHCP, > thereby re-building the state in SAVI devices. I have not checked the dhcp spec in detail for this, but does it mandates that the dhcp lease MUST be renewed after a link goes down and up? Or is it like the SLAAC case where it is clearly not ambiguous the way the RFC is written and there is a bunch of exceptions when DAD can not be performed? Regards, marcelo > > The same could theoretically be applied also to networks where SLAAC is > permitted (question A). But here, the cost of manual configuration may > not pay off. The reason is that strong protection of unassigned > addresses is of little use in networks where SLAAC is permitted due to > the ability of hosts to self-assign any yet-unassigned address. > > Consequently, I think the combination of (A2) and (B1) does make sense. > > - Christian > > > From gdaley@netstarnetworks.com Thu Jul 23 00:50:57 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 00F233A688C for ; Thu, 23 Jul 2009 00:50:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.605 X-Spam-Level: X-Spam-Status: No, score=-1.605 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RELAY_IS_203=0.994] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AoowRD6NZrTj for ; Thu, 23 Jul 2009 00:50:56 -0700 (PDT) Received: from mail.syd.netstarnetworks.com (mail.syd.netstarnetworks.com [203.8.7.220]) by core3.amsl.com (Postfix) with ESMTP id D1B1D3A6884 for ; Thu, 23 Jul 2009 00:50:55 -0700 (PDT) Received: from sydmail.netstarnetworks.com ([10.18.193.13]) by mail.syd.netstarnetworks.com (8.12.8/8.12.8) with ESMTP id n6N7nMRs019638; Thu, 23 Jul 2009 17:49:23 +1000 Received: from melmail.netstarnetworks.com ([10.20.193.13]) by sydmail.netstarnetworks.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 23 Jul 2009 17:49:12 +1000 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Date: Thu, 23 Jul 2009 17:49:11 +1000 Message-ID: <6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com> In-Reply-To: <4A680FD7.4000202@it.uc3m.es> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [savi] Consensus call on "unregistered" source addresses Thread-Index: AcoLaWvU2TwVpXsuTLiDWj7tC15sHwAAEGVg References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com><4A6416E0.8090004@it.uc3m.es><3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> From: "Greg Daley" To: "marcelo bagnulo braun" , "Christian Vogt" X-OriginalArrivalTime: 23 Jul 2009 07:49:12.0143 (UTC) FILETIME=[117E9DF0:01CA0B6A] Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 07:50:57 -0000 Hi Marcelo,=20 > I have not checked the dhcp spec in detail for this, but does it=20 > mandates that the dhcp lease MUST be renewed after a link goes down and up? > Or is it like the SLAAC case where it is clearly not ambiguous the way=20 > the RFC is written and there is a bunch of exceptions when=20 > DAD can not be performed? DHCPv6 Solicit/Advertise can be used to check the existing DHCP Relay/Router is in use. By default if there is an existing lease, there is no requirement to retrieve a lease from the server. Of course, to talk DHCPv6 one is required to have an autoconfigured Link-local address... Greg From elevyabe@cisco.com Thu Jul 23 01:27:27 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 91E8A3A698D for ; Thu, 23 Jul 2009 01:27:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.599 X-Spam-Level: X-Spam-Status: No, score=-8.599 tagged_above=-999 required=5 tests=[AWL=-2.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gy6knGo4Qfmy for ; Thu, 23 Jul 2009 01:27:26 -0700 (PDT) Received: from sj-iport-1.cisco.com (sj-iport-1.cisco.com [171.71.176.70]) by core3.amsl.com (Postfix) with ESMTP id AAB7E3A68ED for ; Thu, 23 Jul 2009 01:27:26 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEAMO6Z0qQ/uCL/2dsb2JhbAC3fYglkQMFhA0 X-IronPort-AV: E=Sophos;i="4.43,253,1246838400"; d="scan'208";a="217986136" Received: from ams-dkim-2.cisco.com ([144.254.224.139]) by sj-iport-1.cisco.com with ESMTP; 23 Jul 2009 08:25:11 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id n6N8PA8Z002098; Thu, 23 Jul 2009 10:25:10 +0200 Received: from xbh-ams-102.cisco.com (xbh-ams-102.cisco.com [144.254.73.132]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6N8PABf001309; Thu, 23 Jul 2009 08:25:10 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-102.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 23 Jul 2009 10:25:10 +0200 Received: from [144.254.53.99] ([144.254.53.99]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Thu, 23 Jul 2009 10:25:09 +0200 Message-ID: <4A681E65.8010108@cisco.com> Date: Thu, 23 Jul 2009 10:25:09 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Christian Vogt References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6443A5.5080302@cisco.com> <0E8C34F8-E315-44E0-ABE6-E79D44A9027B@ericsson.com> In-Reply-To: <0E8C34F8-E315-44E0-ABE6-E79D44A9027B@ericsson.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 23 Jul 2009 08:25:09.0819 (UTC) FILETIME=[1791D8B0:01CA0B6F] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=1806; t=1248337510; x=1249201510; c=relaxed/simple; s=amsdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Consensus=20call=20on=20=22unr egistered=22=20source=20addresses |Sender:=20; bh=d7q6JAmoYlmo/Ms5OXJEoa7ieBKTQIqMUOQccy4io7U=; b=uWYmomZYaKPFVmXXhVJ99RkjFSlrq3aXYytEX4AlXiiUgvKdKf6Ni+7l+R IvPSJnMNRNVN3/30QkT5i84jZjKSBlx9ICAJ+/DnEk1SehTOpGGY7NNS04o6 DWCBxjySRm; Authentication-Results: ams-dkim-2; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim2001 verified; ); Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 08:27:27 -0000 Christian Vogt a écrit : > > On Jul 20, 2009, Eric Levy-Abegnoli wrote: > >>> (A) In networks where SLAAC is permitted for address configuration, how >>> should a SAVI device treat packets with a source address for which >>> neither a successful DAD procedure nor a DHCP assignment was seen? >>> >>> (A1) Discard the packet >>> (A2) Forward and optionally log the packet >>> >> >> [..] All devices are not equal (hardware/software wise, but also >> deployment-wise), so would be acceptable to habe those which can't >> verifyi the assumptions to not drop/log in my opinion. > > Eric, are you saying that you prefer (A2) without logging? Christian , in the current state of the proposals, I am against both A1 and A2. A2 is the worse though, because it's "politically correct": it does not break anything and provides "on the paper" all the tools to further investigate anomalies. In reality, logging in the data path is not safe, not reliable (must be rate-limited), and prone to attacks. Logging it a useful and necessary tool, not a solution in itself. We should not use it as an excuse for not fixing the inaccuracy of our binding table. As far as the "optional log", if we forward and don't log, what have we accomplished? Isn't it what current non-savi devices do today? So my choice would go for 1) Work to build a more accurate binding table 2) With certain assumptions (to be specified), drop optionally 3) When assumptions can't be verified, log. BTW, do we really need to make a choice there? It depends so much on the device capabilities and on the deployment environment that mandating/preventing whatever behavior don't seem to be practical. I’d rather treat that as a policy and mandate it to be configurable. Eric > > - Christian > > > From gdaley@netstarnetworks.com Thu Jul 23 01:36:44 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ACBC63A6903 for ; Thu, 23 Jul 2009 01:36:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.605 X-Spam-Level: X-Spam-Status: No, score=-1.605 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RELAY_IS_203=0.994] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WrewPIpO2ZAR for ; Thu, 23 Jul 2009 01:36:44 -0700 (PDT) Received: from mail.syd.netstarnetworks.com (mail.syd.netstarnetworks.com [203.8.7.220]) by core3.amsl.com (Postfix) with ESMTP id B081C3A68CE for ; Thu, 23 Jul 2009 01:36:42 -0700 (PDT) Received: from sydmail.netstarnetworks.com ([10.18.193.13]) by mail.syd.netstarnetworks.com (8.12.8/8.12.8) with ESMTP id n6N8GLRs021062; Thu, 23 Jul 2009 18:16:22 +1000 Received: from melmail.netstarnetworks.com ([10.20.193.13]) by sydmail.netstarnetworks.com with Microsoft SMTPSVC(6.0.3790.3959); Thu, 23 Jul 2009 18:16:10 +1000 X-MimeOLE: Produced By Microsoft Exchange V6.5 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Date: Thu, 23 Jul 2009 18:16:09 +1000 Message-ID: <6983BF97BFC24D4EA551F1407123291801193C1B@melmail.netstarnetworks.com> In-Reply-To: <4A681808.1070602@it.uc3m.es> X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: [savi] Consensus call on "unregistered" source addresses Thread-Index: AcoLa1hnh/f4qzPaReGuZtr0Wm+K/QAACMbQ References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com><4A6416E0.8090004@it.uc3m.es><3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com> <4A681808.1070602@it.uc3m.es> From: "Greg Daley" To: "marcelo bagnulo braun" X-OriginalArrivalTime: 23 Jul 2009 08:16:10.0206 (UTC) FILETIME=[D5EF6FE0:01CA0B6D] Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 08:36:44 -0000 Greg Daley Security Consultant NetStar Australia Pty Ltd E-mail: gdaley@netstarnetworks.com Mobile: +61 401 772 770 Direct: +61 3 8532 4042 Fax: +61 3 8532 4032=20 > -----Original Message----- > From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es]=20 > Sent: Thursday, 23 July 2009 5:58 PM > To: Greg Daley > Cc: Christian Vogt; SAVI Mailing List > Subject: Re: [savi] Consensus call on "unregistered" source addresses >=20 > Greg Daley escribi=F3: > > Hi Marcelo,=20 > > > > =20 > >> I have not checked the dhcp spec in detail for this, but does it=20 > >> mandates that the dhcp lease MUST be renewed after a link =20 > goes down > >> =20 > > and up? > > =20 > >> Or is it like the SLAAC case where it is clearly not ambiguous the > >> =20 > > way=20 > > =20 > >> the RFC is written and there is a bunch of exceptions when=20 > >> DAD can not be performed? > >> =20 > > > > DHCPv6 Solicit/Advertise can be used to check the existing DHCP > > Relay/Router is in use. > > > > By default if there is an existing lease, there is no requirement to > > retrieve a lease from > > the server. > > > > =20 >=20 > I am sorry, i am not sure i understand this. >=20 > suppose a host has obtained the lease fro the dhcp server > then the link goes down for 30 secs and then back up, > then what does the host does? >=20 > does it need to exchange a msg with the dhcp server or it can simply=20 > keep on using the address it has (i am assuming the lease has not=20 > expired and it is not close to the renewal date neither) On a link where all addresses are managed by DHCP (RFC4862 M=3D1), it = has complete ownership of the address. There is no explicit need to ask the DHCP server for an = address in RFC3315. It may try to=20 check that the service is there with DHCPv6 SOLICIT or CONFIRM (which by = default doesn't bind an address) In section 18.1.2, a host which believes it may have moved to a new link = MUST CONFIRM. This doesn't mean that a lease is being allocated though. The Simple DNAv6 procedures cover this in more detail though, and = specify that the=20 host should check if the DHCP server is actually there, even if the = Router says no movement has occurred. Clearly this is not standard RFC3315 behaviour though. Greg From marcelo@it.uc3m.es Thu Jul 23 01:50:20 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8EA653A6903 for ; Thu, 23 Jul 2009 01:50:20 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.553 X-Spam-Level: X-Spam-Status: No, score=-6.553 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 9Jnsu++W8mqq for ; Thu, 23 Jul 2009 01:50:19 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id B841B3A6817 for ; Thu, 23 Jul 2009 01:50:19 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp01.uc3m.es (Postfix) with ESMTP id 3C905BA01D8; Thu, 23 Jul 2009 09:58:00 +0200 (CEST) Message-ID: <4A681808.1070602@it.uc3m.es> Date: Thu, 23 Jul 2009 09:58:00 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Greg Daley References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com><4A6416E0.8090004@it.uc3m.es><3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com> In-Reply-To: <6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.003 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 08:50:20 -0000 Greg Daley escribió: > Hi Marcelo, > > >> I have not checked the dhcp spec in detail for this, but does it >> mandates that the dhcp lease MUST be renewed after a link goes down >> > and up? > >> Or is it like the SLAAC case where it is clearly not ambiguous the >> > way > >> the RFC is written and there is a bunch of exceptions when >> DAD can not be performed? >> > > DHCPv6 Solicit/Advertise can be used to check the existing DHCP > Relay/Router is in use. > > By default if there is an existing lease, there is no requirement to > retrieve a lease from > the server. > > I am sorry, i am not sure i understand this. suppose a host has obtained the lease fro the dhcp server then the link goes down for 30 secs and then back up, then what does the host does? does it need to exchange a msg with the dhcp server or it can simply keep on using the address it has (i am assuming the lease has not expired and it is not close to the renewal date neither) Thanks, marcelo > Of course, to talk DHCPv6 one is required to have an autoconfigured > Link-local address... > > Greg > > From junbi@tsinghua.edu.cn Thu Jul 23 02:53:23 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 849813A6A00 for ; Thu, 23 Jul 2009 02:53:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sKYRz+rLoXjv for ; Thu, 23 Jul 2009 02:53:22 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 5CF003A6983 for ; Thu, 23 Jul 2009 02:53:22 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTuxg-0005Zs-0H; Thu, 23 Jul 2009 17:51:40 +0800 Message-ID: <25255C7E5FB5419981A9AD148122331E@userPC> From: "Jun Bi" To: "Christian Vogt" , "SAVI Mailing List" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> In-Reply-To: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> Date: Thu, 23 Jul 2009 17:51:32 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 09:53:23 -0000 Hi All, We support two modes in SAVI. (1) In DHCP-only network. (2) In DHCP-SLAAC mixed network. We believe what the users want is the higher security level. We think the default dropping will bring the network more secure, accounting accuracy, and manageable. Best Regards, Jun Bi ----- Original Message ----- From: "Christian Vogt" To: "SAVI Mailing List" Sent: Tuesday, July 14, 2009 12:54 PM Subject: [savi] Consensus call on "unregistered" source addresses > Folks - > > As announced earlier, we will have a consensus call on how SAVI devices > should treat source addresses for which no configuration signaling was > seen. Consensus questions for this were proposed on July 8, and the > feedback received from the working group indicates that those are OK. > > I would hence like to initiate the consensus call. To participate in > the consensus call, please answer by Sunday, July 19, the following two > questions (A) and (B), using one of the two possible answers provided > for each question: > > (A) In networks where SLAAC is permitted for address configuration, how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet > (A2) Forward and optionally log the packet > > (B) In networks where only DHCP is permitted for address configuration, > how should a SAVI device treat packets with a source address for > which no DHCP assignment was seen? > > (B1) Discard the packet > (B2) Forward and optionally log the packet > > In these questions, a SAVI device sees a "successful DAD procedure" for > an address if it sees a DAD Neighbor Solicitation message, but no > responding DAD Neighbor Advertisement message, for this address. > > Please recall the relationship of our two main SAVI solution proposals > to these consensus questions: The FCFS and CPS solutions both use the > combination of (A1) plus (B1), with different means to reduce the > probability of dropping legitimate packets. The middle-ground solution > we are considering now -- originally suggested in [1] by Marcelo, and > slightly augmented in [2] by me with an alternative mode for DHCP-only > networks -- uses the combination of (A2) plus (B1). I would like folks > to consider in particular this combination of (A2) plus (B1) because it > constitutes a reasonable compromise between two competing solutions. > > Please also recall our working assumption that SAVI will operate > exclusively in wired networks, with switch ports constituting the > binding anchors. The goal of this working assumption is to relieve the > discussion from considerations about scenarios where SAVI can only have > limited benefit. Unprotected wireless networks are an example of those > scenarios, where forgeable MAC addresses are the only possible binding > anchors. We will re-evaluate at a later stage how well SAVI applies to > other scenarios. > > - Christian > > > [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html > [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > From marcelo@it.uc3m.es Thu Jul 23 03:10:13 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8F7CC3A69AF for ; Thu, 23 Jul 2009 03:10:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.559 X-Spam-Level: X-Spam-Status: No, score=-6.559 tagged_above=-999 required=5 tests=[AWL=0.040, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 75aNS+csyuG3 for ; Thu, 23 Jul 2009 03:10:12 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id AAB1B3A6971 for ; Thu, 23 Jul 2009 03:10:12 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id 9C04D6BAD37; Thu, 23 Jul 2009 12:07:55 +0200 (CEST) Message-ID: <4A68367B.4000109@it.uc3m.es> Date: Thu, 23 Jul 2009 12:07:55 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Christian Vogt References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com> <001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn> <4A225E1C.1080300@it.uc3m.es> <3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> In-Reply-To: <3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.003 Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 10:10:13 -0000 Sorry for coming back to this, but i have further comments... Christian Vogt escribió: > > CPS calls for SAVI devices to create > bindings only for directly attached hosts, not for hosts attached via > another switch. This is based on the assumption that the ports of SAVI > devices are configured with respect to whether they connect to a host > directly, or whether they connect to another switch. For ports > connecting to another switch, SAVI protection is disabled. > I would like to come back to the level of protection achieved by this. Suppose you have the following topology. +-------------------+ | Internet | +-------------------+ | | +-------+ | router| +-------+ | +--------+ |SAVICPS1|--H3 +--------+ | | +----+ +---+ | | +-------------+ +--------+ |Legacy Switch| |SAVICPS2| +-------------+ +--------+ | | H1 H2 So suppose that as you say, the SAVICPS does create bindings for ports connected to another switch. So, how do we prevent H1 from spoofing H2 address when is sending packets to H3 (or to any host in the rest of the internet in the picture above)? I mean, i understnad that the main idea in CPS is that there is perimeter defense, so all the borders need to provide protection. I understand that in order to actually provide the protection, the SAVICPS1 device must create bindings for hosts connected behind the legacy switch, or am i missing something? Regards, marcelo From marcelo@it.uc3m.es Thu Jul 23 03:27:04 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EE3173A68C1 for ; Thu, 23 Jul 2009 03:27:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.563 X-Spam-Level: X-Spam-Status: No, score=-6.563 tagged_above=-999 required=5 tests=[AWL=0.036, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GDTCPj-qZJEu for ; Thu, 23 Jul 2009 03:27:04 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id BB9063A685F for ; Thu, 23 Jul 2009 03:27:03 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp03.uc3m.es (Postfix) with ESMTP id B6FF67F06A0; Thu, 23 Jul 2009 12:12:06 +0200 (CEST) Message-ID: <4A683776.4070809@it.uc3m.es> Date: Thu, 23 Jul 2009 12:12:06 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Guang Yao References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn> In-Reply-To: <001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.003 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 10:27:05 -0000 Guang Yao escribió: > >> -----Original Message----- >> From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf Of >> marcelo bagnulo braun >> Sent: Thursday, July 23, 2009 3:23 PM >> To: Christian Vogt >> Cc: SAVI Mailing List >> Subject: Re: [savi] Consensus call on "unregistered" source addresses >> >> Christian Vogt escribió: >> >>> On Jul 20, 2009, Marcelo Bagnulo Braun wrote: >>> >>> >>>>>> (B) In networks where only DHCP is permitted for address >>>>>> configuration, >>>>>> how should a SAVI device treat packets with a source address for >>>>>> which no DHCP assignment was seen? >>>>>> >>>>>> (B1) Discard the packet >>>>>> (B2) Forward and optionally log the packet >>>>>> >>>>> In this case I suppose SAVI device would need to be manually >>>>> > configured > >>>>> to behave in this manner (i.e. it could not figure this out reliably >>>>> > on > >>>>> its own)? In that case, B1 would seem to be fine. >>>>> >>>> Why are you not concerned about the SAVI device rebooting and loosing >>>> its state (only learnt through the DHCP msg exchange snooping) and >>>> blocking legit nodes out of the network in this case? >>>> >>>> I mean, isn't a similar problem that you mentioned in the above case >>>> also possible here? >>>> >>> Good point. A solution to deal with state loss in SAVI devices in DHCP- >>> only networks, which enables (B1), is described in CPS: >>> >>> In DHCP-only networks, one can ensure, through manual configuration of >>> SAVI devices, that SAVI protection is active only on ports that directly >>> connect to hosts. This way, if a SAVI device loses state due to a >>> reboot, hosts discard their DHCP state as well because the link >>> temporarily goes down. Afterwards, hosts obtain new addresses via DHCP, >>> thereby re-building the state in SAVI devices. >>> >> I have not checked the dhcp spec in detail for this, but does it >> mandates that the dhcp lease MUST be renewed after a link goes down and >> up? >> Or is it like the SLAAC case where it is clearly not ambiguous the way >> the RFC is written and there is a bunch of exceptions when DAD can not >> be performed? >> >> > [Guang Yao] > See rfc3315 18.1.2 > The host _MUST_ send CONFIRM when > o The client reboots. > > o The client is physically connected to a wired connection. > > o The client returns from sleep mode. > > o The client using a wireless technology changes access points. > > so the node is not mandated to send a confirm when the switch that it is connected reboots as long as it remains the same regards, marcelo >> Regards, marcelo >> >> >> >>> The same could theoretically be applied also to networks where SLAAC is >>> permitted (question A). But here, the cost of manual configuration may >>> not pay off. The reason is that strong protection of unassigned >>> addresses is of little use in networks where SLAAC is permitted due to >>> the ability of hosts to self-assign any yet-unassigned address. >>> >>> Consequently, I think the combination of (A2) and (B1) does make sense. >>> >>> - Christian >>> >>> >>> >>> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> > > > > From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 04:36:32 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 590773A659B for ; Thu, 23 Jul 2009 04:36:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.166 X-Spam-Level: X-Spam-Status: No, score=-2.166 tagged_above=-999 required=5 tests=[AWL=0.433, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MSiWFJl+tAQn for ; Thu, 23 Jul 2009 04:36:31 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id 28EB03A6358 for ; Thu, 23 Jul 2009 04:36:31 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTufn-00020W-TB; Thu, 23 Jul 2009 17:33:11 +0800 From: "Guang Yao" To: "'marcelo bagnulo braun'" , "'Christian Vogt'" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> In-Reply-To: <4A680FD7.4000202@it.uc3m.es> Date: Thu, 23 Jul 2009 17:33:12 +0800 Message-ID: <001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLaW1/4meqmVlqQ4m2VBZRCOx91QADqIrw Content-Language: zh-cn Cc: 'SAVI Mailing List' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 11:36:32 -0000 > -----Original Message----- > From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf = Of > marcelo bagnulo braun > Sent: Thursday, July 23, 2009 3:23 PM > To: Christian Vogt > Cc: SAVI Mailing List > Subject: Re: [savi] Consensus call on "unregistered" source addresses >=20 > Christian Vogt escribi=F3: > > > > On Jul 20, 2009, Marcelo Bagnulo Braun wrote: > > > >>>> (B) In networks where only DHCP is permitted for address > >>>> configuration, > >>>> how should a SAVI device treat packets with a source address = for > >>>> which no DHCP assignment was seen? > >>>> > >>>> (B1) Discard the packet > >>>> (B2) Forward and optionally log the packet > >>> > >>> In this case I suppose SAVI device would need to be manually configured > > > >>> to behave in this manner (i.e. it could not figure this out = reliably on > >>> its own)? In that case, B1 would seem to be fine. > >> > >> Why are you not concerned about the SAVI device rebooting and = loosing > >> its state (only learnt through the DHCP msg exchange snooping) and > >> blocking legit nodes out of the network in this case? > >> > >> I mean, isn't a similar problem that you mentioned in the above = case > >> also possible here? > > > > Good point. A solution to deal with state loss in SAVI devices in = DHCP- > > only networks, which enables (B1), is described in CPS: > > > > In DHCP-only networks, one can ensure, through manual configuration = of > > SAVI devices, that SAVI protection is active only on ports that = directly > > connect to hosts. This way, if a SAVI device loses state due to a > > reboot, hosts discard their DHCP state as well because the link > > temporarily goes down. Afterwards, hosts obtain new addresses via = DHCP, > > thereby re-building the state in SAVI devices. >=20 > I have not checked the dhcp spec in detail for this, but does it > mandates that the dhcp lease MUST be renewed after a link goes down = and > up? > Or is it like the SLAAC case where it is clearly not ambiguous the way > the RFC is written and there is a bunch of exceptions when DAD can not > be performed? >=20 [Guang Yao]=20 See rfc3315 18.1.2 The host _MUST_ send CONFIRM when o The client reboots. o The client is physically connected to a wired connection. o The client returns from sleep mode. o The client using a wireless technology changes access points. > Regards, marcelo >=20 >=20 > > > > The same could theoretically be applied also to networks where SLAAC = is > > permitted (question A). But here, the cost of manual configuration = may > > not pay off. The reason is that strong protection of unassigned > > addresses is of little use in networks where SLAAC is permitted due = to > > the ability of hosts to self-assign any yet-unassigned address. > > > > Consequently, I think the combination of (A2) and (B1) does make = sense. > > > > - Christian > > > > > > >=20 > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 04:54:18 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 5D7703A6992 for ; Thu, 23 Jul 2009 04:54:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.274 X-Spam-Level: X-Spam-Status: No, score=-2.274 tagged_above=-999 required=5 tests=[AWL=0.325, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hA6WcZYX35n4 for ; Thu, 23 Jul 2009 04:54:17 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 168DC3A63EB for ; Thu, 23 Jul 2009 04:54:16 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTwqn-0007cG-I2; Thu, 23 Jul 2009 19:52:41 +0800 From: "Guang Yao" To: "'marcelo bagnulo braun'" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn> <4A683776.4070809@it.uc3m.es> In-Reply-To: <4A683776.4070809@it.uc3m.es> Date: Thu, 23 Jul 2009 19:52:41 +0800 Message-ID: <002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLfgmzXcxWCtyeSI66R24v9frI4QACrIcw Content-Language: zh-cn Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 11:54:18 -0000 > -----Original Message----- > From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es] > Sent: Thursday, July 23, 2009 6:12 PM > To: Guang Yao > Cc: 'Christian Vogt'; 'SAVI Mailing List' > Subject: Re: [savi] Consensus call on "unregistered" source addresses >=20 > Guang Yao escribi=F3: > > > >> -----Original Message----- > >> From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On = Behalf Of > >> marcelo bagnulo braun > >> Sent: Thursday, July 23, 2009 3:23 PM > >> To: Christian Vogt > >> Cc: SAVI Mailing List > >> Subject: Re: [savi] Consensus call on "unregistered" source = addresses > >> > >> Christian Vogt escribi=F3: > >> > >>> On Jul 20, 2009, Marcelo Bagnulo Braun wrote: > >>> > >>> > >>>>>> (B) In networks where only DHCP is permitted for address > >>>>>> configuration, > >>>>>> how should a SAVI device treat packets with a source address = for > >>>>>> which no DHCP assignment was seen? > >>>>>> > >>>>>> (B1) Discard the packet > >>>>>> (B2) Forward and optionally log the packet > >>>>>> > >>>>> In this case I suppose SAVI device would need to be manually > >>>>> > > configured > > > >>>>> to behave in this manner (i.e. it could not figure this out = reliably > >>>>> > > on > > > >>>>> its own)? In that case, B1 would seem to be fine. > >>>>> > >>>> Why are you not concerned about the SAVI device rebooting and = loosing > >>>> its state (only learnt through the DHCP msg exchange snooping) = and > >>>> blocking legit nodes out of the network in this case? > >>>> > >>>> I mean, isn't a similar problem that you mentioned in the above = case > >>>> also possible here? > >>>> > >>> Good point. A solution to deal with state loss in SAVI devices in DHCP- > >>> only networks, which enables (B1), is described in CPS: > >>> > >>> In DHCP-only networks, one can ensure, through manual = configuration of > >>> SAVI devices, that SAVI protection is active only on ports that directly > >>> connect to hosts. This way, if a SAVI device loses state due to a > >>> reboot, hosts discard their DHCP state as well because the link > >>> temporarily goes down. Afterwards, hosts obtain new addresses via DHCP, > >>> thereby re-building the state in SAVI devices. > >>> > >> I have not checked the dhcp spec in detail for this, but does it > >> mandates that the dhcp lease MUST be renewed after a link goes down = and > >> up? > >> Or is it like the SLAAC case where it is clearly not ambiguous the = way > >> the RFC is written and there is a bunch of exceptions when DAD can = not > >> be performed? > >> > >> > > [Guang Yao] > > See rfc3315 18.1.2 > > The host _MUST_ send CONFIRM when > > o The client reboots. > > > > o The client is physically connected to a wired connection. > > > > o The client returns from sleep mode. > > > > o The client using a wireless technology changes access points. > > > > > so the node is not mandated to send a confirm when the switch that it = is > connected reboots as long as it remains the same >=20 >=20 > regards, marcelo [Guang Yao]=20 You must be kidding. When the switch reboot, its ports are first turned down: then the client = is disconnected; then turned on: then the client will be connected to the port. This is = the second case. >=20 >=20 > >> Regards, marcelo > >> > >> > >> > >>> The same could theoretically be applied also to networks where = SLAAC is > >>> permitted (question A). But here, the cost of manual = configuration may > >>> not pay off. The reason is that strong protection of unassigned > >>> addresses is of little use in networks where SLAAC is permitted = due to > >>> the ability of hosts to self-assign any yet-unassigned address. > >>> > >>> Consequently, I think the combination of (A2) and (B1) does make sense. > >>> > >>> - Christian > >>> > >>> > >>> > >>> > >> _______________________________________________ > >> savi mailing list > >> savi@ietf.org > >> https://www.ietf.org/mailman/listinfo/savi > >> > > > > > > > > From marcelo@it.uc3m.es Thu Jul 23 06:01:28 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 94DC03A6A48 for ; Thu, 23 Jul 2009 06:01:28 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.567 X-Spam-Level: X-Spam-Status: No, score=-6.567 tagged_above=-999 required=5 tests=[AWL=0.032, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rg6XzG34idOg for ; Thu, 23 Jul 2009 06:01:27 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 4B8013A69E8 for ; Thu, 23 Jul 2009 06:01:27 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp01.uc3m.es (Postfix) with ESMTP id BFA55BA0222; Thu, 23 Jul 2009 15:01:07 +0200 (CEST) Message-ID: <4A685F13.7010906@it.uc3m.es> Date: Thu, 23 Jul 2009 15:01:07 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Guang Yao References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn> <4A683776.4070809@it.uc3m.es> <002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn> In-Reply-To: <002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.003 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 13:01:28 -0000 Guang Yao escribió: > >> -----Original Message----- >> From: marcelo bagnulo braun [mailto:marcelo@it.uc3m.es] >> Sent: Thursday, July 23, 2009 6:12 PM >> To: Guang Yao >> Cc: 'Christian Vogt'; 'SAVI Mailing List' >> Subject: Re: [savi] Consensus call on "unregistered" source addresses >> >> Guang Yao escribió: >> >>>> -----Original Message----- >>>> From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf Of >>>> marcelo bagnulo braun >>>> Sent: Thursday, July 23, 2009 3:23 PM >>>> To: Christian Vogt >>>> Cc: SAVI Mailing List >>>> Subject: Re: [savi] Consensus call on "unregistered" source addresses >>>> >>>> Christian Vogt escribió: >>>> >>>> >>>>> On Jul 20, 2009, Marcelo Bagnulo Braun wrote: >>>>> >>>>> >>>>> >>>>>>>> (B) In networks where only DHCP is permitted for address >>>>>>>> configuration, >>>>>>>> how should a SAVI device treat packets with a source address for >>>>>>>> which no DHCP assignment was seen? >>>>>>>> >>>>>>>> (B1) Discard the packet >>>>>>>> (B2) Forward and optionally log the packet >>>>>>>> >>>>>>>> >>>>>>> In this case I suppose SAVI device would need to be manually >>>>>>> >>>>>>> >>> configured >>> >>> >>>>>>> to behave in this manner (i.e. it could not figure this out reliably >>>>>>> >>>>>>> >>> on >>> >>> >>>>>>> its own)? In that case, B1 would seem to be fine. >>>>>>> >>>>>>> >>>>>> Why are you not concerned about the SAVI device rebooting and loosing >>>>>> its state (only learnt through the DHCP msg exchange snooping) and >>>>>> blocking legit nodes out of the network in this case? >>>>>> >>>>>> I mean, isn't a similar problem that you mentioned in the above case >>>>>> also possible here? >>>>>> >>>>>> >>>>> Good point. A solution to deal with state loss in SAVI devices in >>>>> > DHCP- > >>>>> only networks, which enables (B1), is described in CPS: >>>>> >>>>> In DHCP-only networks, one can ensure, through manual configuration of >>>>> SAVI devices, that SAVI protection is active only on ports that >>>>> > directly > >>>>> connect to hosts. This way, if a SAVI device loses state due to a >>>>> reboot, hosts discard their DHCP state as well because the link >>>>> temporarily goes down. Afterwards, hosts obtain new addresses via >>>>> > DHCP, > >>>>> thereby re-building the state in SAVI devices. >>>>> >>>>> >>>> I have not checked the dhcp spec in detail for this, but does it >>>> mandates that the dhcp lease MUST be renewed after a link goes down and >>>> up? >>>> Or is it like the SLAAC case where it is clearly not ambiguous the way >>>> the RFC is written and there is a bunch of exceptions when DAD can not >>>> be performed? >>>> >>>> >>>> >>> [Guang Yao] >>> See rfc3315 18.1.2 >>> The host _MUST_ send CONFIRM when >>> o The client reboots. >>> >>> o The client is physically connected to a wired connection. >>> >>> o The client returns from sleep mode. >>> >>> o The client using a wireless technology changes access points. >>> >>> >>> >> so the node is not mandated to send a confirm when the switch that it is >> connected reboots as long as it remains the same >> >> >> regards, marcelo >> > [Guang Yao] > You must be kidding. > When the switch reboot, its ports are first turned down: then the client is > disconnected; > is the host _physically_ disconnected? > then turned on: then the client will be connected to the port. This is the > second case. > >> >>>> Regards, marcelo >>>> >>>> >>>> >>>> >>>>> The same could theoretically be applied also to networks where SLAAC >>>>> > is > >>>>> permitted (question A). But here, the cost of manual configuration >>>>> > may > >>>>> not pay off. The reason is that strong protection of unassigned >>>>> addresses is of little use in networks where SLAAC is permitted due to >>>>> the ability of hosts to self-assign any yet-unassigned address. >>>>> >>>>> Consequently, I think the combination of (A2) and (B1) does make >>>>> > sense. > >>>>> - Christian >>>>> >>>>> >>>>> >>>>> >>>>> >>>> _______________________________________________ >>>> savi mailing list >>>> savi@ietf.org >>>> https://www.ietf.org/mailman/listinfo/savi >>>> >>>> >>> >>> >>> > > > > From junbi@cernet.edu.cn Thu Jul 23 06:16:51 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C00B28C11C for ; Thu, 23 Jul 2009 06:16:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.586 X-Spam-Level: * X-Spam-Status: No, score=1.586 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, FH_HAS_XAIMC=2.696] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5QPQsTuQOs4Y for ; Thu, 23 Jul 2009 06:16:50 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id F295428C10D for ; Thu, 23 Jul 2009 06:16:49 -0700 (PDT) Received: from userPC([59.66.24.40]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm314a68a91e; Thu, 23 Jul 2009 21:15:12 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" , "Guang Yao" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn> <4A685F13.7010906@it.uc3m.es> In-Reply-To: <4A685F13.7010906@it.uc3m.es> Date: Thu, 23 Jul 2009 21:15:04 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: GVeIy3WB Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 13:16:51 -0000 Dear Marcelo, When the switch reboot, the host's interface thinks it is disconnected (no power at the cable), then the host send out confirm when the link is up. I did see it during the test and I think you could also observe it if you snoop the packet. Thanks, Jun Bi >>>> >>> [Guang Yao] >>> See rfc3315 18.1.2 >>> The host _MUST_ send CONFIRM when >>> o The client reboots. >>> >>> o The client is physically connected to a wired connection. >>> >>> o The client returns from sleep mode. >>> >>> o The client using a wireless technology changes access points. >>> >>> >>> >> so the node is not mandated to send a confirm when the switch that it is >> connected reboots as long as it remains the same >> >> >> regards, marcelo >> > [Guang Yao] You must be kidding. > When the switch reboot, its ports are first turned down: then the client > is > disconnected; > is the host _physically_ disconnected? > then turned on: then the client will be connected to the port. This is the > second case. > >> >>>> Regards, marcelo From junbi@cernet.edu.cn Thu Jul 23 06:22:06 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 76AEA3A6915 for ; Thu, 23 Jul 2009 06:22:06 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.842 X-Spam-Level: X-Spam-Status: No, score=0.842 tagged_above=-999 required=5 tests=[AWL=0.745, BAYES_00=-2.599, FH_HAS_XAIMC=2.696] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id YYee2khICGCZ for ; Thu, 23 Jul 2009 06:22:05 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 1C85A3A67B2 for ; Thu, 23 Jul 2009 06:22:04 -0700 (PDT) Received: from userPC([59.66.24.40]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm584a68aa43; Thu, 23 Jul 2009 21:20:05 +0800 Message-ID: <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> From: "Jun Bi" To: "marcelo bagnulo braun" , "Christian Vogt" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> In-Reply-To: <4A68367B.4000109@it.uc3m.es> Date: Thu, 23 Jul 2009 21:19:58 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: GjXNy3WB Cc: SAVI Mailing List , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 13:22:06 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Christian Vogt" Cc: "SAVI Mailing List" ; "Guang Yao" Sent: Thursday, July 23, 2009 6:07 PM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? Sorry for coming back to this, but i have further comments... Christian Vogt escribió: > > CPS calls for SAVI devices to create > bindings only for directly attached hosts, not for hosts attached via > another switch. This is based on the assumption that the ports of SAVI > devices are configured with respect to whether they connect to a host > directly, or whether they connect to another switch. For ports > connecting to another switch, SAVI protection is disabled. > I would like to come back to the level of protection achieved by this. Suppose you have the following topology. +-------------------+ | Internet | +-------------------+ | | +-------+ | router| +-------+ | +--------+ |SAVICPS1|--H3 +--------+ | | +----+ +---+ | | +-------------+ +--------+ |Legacy Switch| |SAVICPS2| +-------------+ +--------+ | | H1 H2 So suppose that as you say, the SAVICPS does create bindings for ports connected to another switch. [Jun Bi] SAVI-CPS1 won't creat binding for trunk port. So, how do we prevent H1 from spoofing H2 address when is sending packets to H3 (or to any host in the rest of the internet in the picture above)? I mean, i understnad that the main idea in CPS is that there is perimeter defense, so all the borders need to provide protection. I understand that in order to actually provide the protection, the SAVICPS1 device must create bindings for hosts connected behind the legacy switch, or am i missing something? [Jun Bi] Dear Marcelo, Thank you for the question. CPS only validate the source address of SAVI deployment area (SAVI area) (for hosts directly attached to SAVI switches). The goal is to make the hosts in SAVI area (H1 and H3 in your picture) won't spoof. If the admistrator really want more benifit, we have a deployment suggestion. The network adminstrator knows which is SAVI-switch, which is non-SAVI-swtich. Then he can configure two VLANs, one for SAVI area, other for non-SAVI area, then assign differnt address space (prefixes) for two differnet areas. The layer 3 device will do the ingress filtering then H1 can't use H2's source address. Best Regards, Jun Bi From marcelo@it.uc3m.es Thu Jul 23 07:17:11 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2B45A3A67A2 for ; Thu, 23 Jul 2009 07:17:11 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.572 X-Spam-Level: X-Spam-Status: No, score=-6.572 tagged_above=-999 required=5 tests=[AWL=0.027, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id EDZDx6mSneLT for ; Thu, 23 Jul 2009 07:17:10 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 2851B3A6B52 for ; Thu, 23 Jul 2009 07:17:09 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp01.uc3m.es (Postfix) with ESMTP id 003F1B4A4AA; Thu, 23 Jul 2009 16:15:59 +0200 (CEST) Message-ID: <4A68709F.6030201@it.uc3m.es> Date: Thu, 23 Jul 2009 16:15:59 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn> <4A685F13.7010906@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:17:11 -0000 Jun Bi escribió: > Dear Marcelo, > > When the switch reboot, the host's interface thinks it is disconnected > (no power at the cable), then the host send out > confirm when the link is up. sure, this is what i would call disconnect as you do my question is what is the difference between disconnected and physically disconnected? In addition, i guess there are at least two other problematic cases where the reboot in the savi device would result in problems: The case when the host is connected to the SAVI device through a legacy switch, in case the reboot of the savi device is invisible to the host, so it won't send any dhcp msg Ans besides, if we move to the wireless case, it is explicilty stated in the below rules that: o The client using a wireless technology changes access points. So, in wireless networks a reboot in the savi device would not imply any dhcp mesage, so the lost state in case of reboot in this cannot be recovered by epxecting the host will send a new dhcp msg. Regards, marcelo > I did see it during the test and I think you could also observe it if > you snoop the packet. > > Thanks, > Jun Bi > >>>>> >>>> [Guang Yao] >>>> See rfc3315 18.1.2 >>>> The host _MUST_ send CONFIRM when >>>> o The client reboots. >>>> >>>> o The client is physically connected to a wired connection. >>>> >>>> o The client returns from sleep mode. >>>> >>>> o The client using a wireless technology changes access points. >>>> >>>> >>>> >>> so the node is not mandated to send a confirm when the switch that >>> it is >>> connected reboots as long as it remains the same >>> >>> >>> regards, marcelo >>> >> [Guang Yao] You must be kidding. >> When the switch reboot, its ports are first turned down: then the >> client is >> disconnected; >> > > is the host _physically_ disconnected? >> then turned on: then the client will be connected to the port. This >> is the >> second case. >> >>> >>>>> Regards, marcelo > > > From marcelo@it.uc3m.es Thu Jul 23 07:21:25 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 597B43A6B8E for ; Thu, 23 Jul 2009 07:21:25 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.574 X-Spam-Level: X-Spam-Status: No, score=-6.574 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2DrLi502BsPd for ; Thu, 23 Jul 2009 07:21:24 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id E18D43A6B79 for ; Thu, 23 Jul 2009 07:21:23 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id A6FF76BA088; Thu, 23 Jul 2009 16:20:08 +0200 (CEST) Message-ID: <4A687198.1010009@it.uc3m.es> Date: Thu, 23 Jul 2009 16:20:08 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> In-Reply-To: <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:21:25 -0000 Jun Bi escribió: > > > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Christian Vogt" > Cc: "SAVI Mailing List" ; "Guang Yao" > > Sent: Thursday, July 23, 2009 6:07 PM > Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > > > Sorry for coming back to this, but i have further comments... > > Christian Vogt escribió: >> >> CPS calls for SAVI devices to create >> bindings only for directly attached hosts, not for hosts attached via >> another switch. This is based on the assumption that the ports of SAVI >> devices are configured with respect to whether they connect to a host >> directly, or whether they connect to another switch. For ports >> connecting to another switch, SAVI protection is disabled. >> > I would like to come back to the level of protection achieved by this. > > Suppose you have the following topology. > > > +-------------------+ > | Internet | > +-------------------+ > | > | > +-------+ > | router| > +-------+ > | > +--------+ > |SAVICPS1|--H3 > +--------+ > | | > +----+ +---+ > | | > +-------------+ +--------+ > |Legacy Switch| |SAVICPS2| > +-------------+ +--------+ > | | > H1 H2 > > > > So suppose that as you say, the SAVICPS does create bindings for ports > connected to another switch. > > > [Jun Bi] > SAVI-CPS1 won't creat binding for trunk port. sorry, this is what i quoted above and that is what i meant... (i guess i was too concentrated in the ascii and disregarded the actual text) > > So, how do we prevent H1 from spoofing H2 address when is sending > packets to H3 (or to any host in the rest of the internet in the picture > above)? > > > I mean, i understnad that the main idea in CPS is that there is > perimeter defense, so all the borders need to provide protection. > I understand that in order to actually provide the protection, the > SAVICPS1 device must create bindings for hosts connected behind the > legacy switch, or am i missing something? > > [Jun Bi] > Dear Marcelo, > Thank you for the question. > CPS only validate the source address of SAVI deployment area (SAVI > area) (for hosts directly attached to SAVI > switches). The goal is to make the hosts in SAVI area (H1 and H3 in > your picture) won't spoof. > > If the admistrator really want more benifit, we have a deployment > suggestion. > The network adminstrator knows which is SAVI-switch, which is > non-SAVI-swtich. > Then he can configure two VLANs, one for SAVI area, other for > non-SAVI area, > then assign differnt address space (prefixes) for two differnet areas. > The layer 3 device will do the ingress filtering then H1 can't use > H2's source address. > so, basically you mean that in order to get SAVI protection _all_ the devices in the same IP subnetwork MUST use SAVI devices and you cannot have legacy devices. This must be explicitly mentioned since imho it is a severe deployment limitation. In other words, if we want to deploy CPS in a subntework, then all the devices MUST be SAVI devices. Regards, marcelo > Best Regards, > Jun Bi > > > > > > > > From junbi@tsinghua.edu.cn Thu Jul 23 07:37:01 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 722523A68F1 for ; Thu, 23 Jul 2009 07:37:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1qUGHtk6yvmf for ; Thu, 23 Jul 2009 07:37:00 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 7658F3A63EB for ; Thu, 23 Jul 2009 07:37:00 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTzN1-0001XU-09; Thu, 23 Jul 2009 22:34:07 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn><4A685F13.7010906@it.uc3m.es> <4A68709F.6030201@it.uc3m.es> In-Reply-To: <4A68709F.6030201@it.uc3m.es> Date: Thu, 23 Jul 2009 22:33:58 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:37:01 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" ; "Guang Yao" Sent: Thursday, July 23, 2009 10:15 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses Jun Bi escribió: > Dear Marcelo, > > When the switch reboot, the host's interface thinks it is disconnected (no > power at the cable), then the host send out > confirm when the link is up. sure, this is what i would call disconnect as you do my question is what is the difference between disconnected and physically disconnected? In addition, i guess there are at least two other problematic cases where the reboot in the savi device would result in problems: The case when the host is connected to the SAVI device through a legacy switch, in case the reboot of the savi device is invisible to the host, so it won't send any dhcp msg Please see my another reply on none-directly host. Ans besides, if we move to the wireless case, it is explicilty stated in the below rules that: o The client using a wireless technology changes access points. So, in wireless networks a reboot in the savi device would not imply any dhcp mesage, so the lost state in case of reboot in this cannot be recovered by epxecting the host will send a new dhcp msg. For the wired Ethernet case, it is no problem. thanks, Jun Regards, marcelo > I did see it during the test and I think you could also observe it if you > snoop the packet. > > Thanks, > Jun Bi > >>>>> >>>> [Guang Yao] >>>> See rfc3315 18.1.2 >>>> The host _MUST_ send CONFIRM when >>>> o The client reboots. >>>> >>>> o The client is physically connected to a wired connection. >>>> >>>> o The client returns from sleep mode. >>>> >>>> o The client using a wireless technology changes access points. >>>> >>>> >>>> >>> so the node is not mandated to send a confirm when the switch that it is >>> connected reboots as long as it remains the same >>> >>> >>> regards, marcelo >>> >> [Guang Yao] You must be kidding. >> When the switch reboot, its ports are first turned down: then the client >> is >> disconnected; >> > > is the host _physically_ disconnected? >> then turned on: then the client will be connected to the port. This is >> the >> second case. >> >>> >>>>> Regards, marcelo > > > _______________________________________________ savi mailing list savi@ietf.org https://www.ietf.org/mailman/listinfo/savi From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 07:38:57 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DCF663A67EF for ; Thu, 23 Jul 2009 07:38:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.339 X-Spam-Level: X-Spam-Status: No, score=-2.339 tagged_above=-999 required=5 tests=[AWL=0.260, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dKejcqC+NnGb for ; Thu, 23 Jul 2009 07:38:57 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id 7591C3A6855 for ; Thu, 23 Jul 2009 07:38:32 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTzPr-0006KH-Ms for savi@ietf.org; Thu, 23 Jul 2009 22:37:04 +0800 From: "Guang Yao" To: "'SAVI Mailing List'" Date: Thu, 23 Jul 2009 22:37:03 +0800 Message-ID: <001001ca0ba3$0c010a50$24031ef0$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLlcI480D+VqXQTZSkpsFBa0Uz7AAAX7LwAALsLKA= Content-Language: zh-cn Subject: [savi] FW: Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:38:57 -0000 > >>>> > >>>> > >>> [Guang Yao] > >>> See rfc3315 18.1.2 > >>> The host _MUST_ send CONFIRM when > >>> o The client reboots. > >>> > >>> o The client is physically connected to a wired connection. > >>> > >>> o The client returns from sleep mode. > >>> > >>> o The client using a wireless technology changes access points. > >>> > >>> > >>> > >> so the node is not mandated to send a confirm when the switch that it is > >> connected reboots as long as it remains the same > >> > >> > >> regards, marcelo > >> > > [Guang Yao] > > You must be kidding. > > When the switch reboot, its ports are first turned down: then the client is > > disconnected; > > > > is the host _physically_ disconnected? [Guang Yao] How can a host know it is _physically_ disconnected? Through watching whether its cable is unplugged by EYE? Or through electrical signal? > > then turned on: then the client will be connected to the port. This is the > > second case. From junbi@tsinghua.edu.cn Thu Jul 23 07:44:27 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BD10F3A6ACE for ; Thu, 23 Jul 2009 07:44:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6+UFh9ONkoBe for ; Thu, 23 Jul 2009 07:44:26 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id 035413A6987 for ; Thu, 23 Jul 2009 07:43:43 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTzUg-0006MN-Hs; Thu, 23 Jul 2009 22:42:02 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> In-Reply-To: <4A687198.1010009@it.uc3m.es> Date: Thu, 23 Jul 2009 22:41:53 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:44:28 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" ; "Guang Yao" Sent: Thursday, July 23, 2009 10:20 PM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? Jun Bi escribió: > > > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Christian Vogt" > Cc: "SAVI Mailing List" ; "Guang Yao" > > Sent: Thursday, July 23, 2009 6:07 PM > Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > > > Sorry for coming back to this, but i have further comments... > > Christian Vogt escribió: >> >> CPS calls for SAVI devices to create >> bindings only for directly attached hosts, not for hosts attached via >> another switch. This is based on the assumption that the ports of SAVI >> devices are configured with respect to whether they connect to a host >> directly, or whether they connect to another switch. For ports >> connecting to another switch, SAVI protection is disabled. >> > I would like to come back to the level of protection achieved by this. > > Suppose you have the following topology. > > > +-------------------+ > | Internet | > +-------------------+ > | > | > +-------+ > | router| > +-------+ > | > +--------+ > |SAVICPS1|--H3 > +--------+ > | | > +----+ +---+ > | | > +-------------+ +--------+ > |Legacy Switch| |SAVICPS2| > +-------------+ +--------+ > | | > H1 H2 > > > > So suppose that as you say, the SAVICPS does create bindings for ports > connected to another switch. > > > [Jun Bi] > SAVI-CPS1 won't creat binding for trunk port. sorry, this is what i quoted above and that is what i meant... (i guess i was too concentrated in the ascii and disregarded the actual text) > > So, how do we prevent H1 from spoofing H2 address when is sending > packets to H3 (or to any host in the rest of the internet in the picture > above)? > > > I mean, i understnad that the main idea in CPS is that there is > perimeter defense, so all the borders need to provide protection. > I understand that in order to actually provide the protection, the > SAVICPS1 device must create bindings for hosts connected behind the > legacy switch, or am i missing something? > > [Jun Bi] > Dear Marcelo, > Thank you for the question. > CPS only validate the source address of SAVI deployment area (SAVI > area) (for hosts directly attached to SAVI > switches). The goal is to make the hosts in SAVI area (H1 and H3 in > your picture) won't spoof. > > If the admistrator really want more benifit, we have a deployment > suggestion. > The network adminstrator knows which is SAVI-switch, which is > non-SAVI-swtich. > Then he can configure two VLANs, one for SAVI area, other for non-SAVI > area, > then assign differnt address space (prefixes) for two differnet areas. > The layer 3 device will do the ingress filtering then H1 can't use H2's > source address. > so, basically you mean that in order to get SAVI protection _all_ the devices in the same IP subnetwork MUST use SAVI devices and you cannot have legacy devices. Hi, I don't want to use the word "protect", it should be "anti-spoof". SAVI-CPS could anti-spoof in SAVI-area, not none-SAVI area. If you deploy _all_ SAVI-CPS switch, then you anti-spoof for _all_ host. If you deploy some of them, then you anti-spoof for some host attched to the new SAVI-switch. I think it's reasonable. The more SAVI-switch you deploy, the more host you anti-spoof. There is no free luch. This must be explicitly mentioned since imho it is a severe deployment limitation. Hi, we mentioned it, that's why Christian also methion it at the email above. In other words, if we want to deploy CPS in a subntework, then all the devices MUST be SAVI devices. Not "MUST", did you see you reply? Regards, marcelo > Best Regards, > Jun Bi > > > > > > > > _______________________________________________ savi mailing list savi@ietf.org https://www.ietf.org/mailman/listinfo/savi From marcelo@it.uc3m.es Thu Jul 23 07:44:29 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6DDE03A67B3 for ; Thu, 23 Jul 2009 07:44:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.576 X-Spam-Level: X-Spam-Status: No, score=-6.576 tagged_above=-999 required=5 tests=[AWL=0.023, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oJOcEx3S09bc for ; Thu, 23 Jul 2009 07:44:28 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 446423A6ABC for ; Thu, 23 Jul 2009 07:43:56 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp01.uc3m.es (Postfix) with ESMTP id AEA21BA57DF; Thu, 23 Jul 2009 16:42:19 +0200 (CEST) Message-ID: <4A6876CB.6010107@it.uc3m.es> Date: Thu, 23 Jul 2009 16:42:19 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn><4A685F13.7010906@it.uc3m.es> <4A68709F.6030201@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:44:29 -0000 Jun Bi escribió: > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Jun Bi" > Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" > ; "Guang Yao" > Sent: Thursday, July 23, 2009 10:15 PM > Subject: Re: [savi] Consensus call on "unregistered" source addresses > > > Jun Bi escribió: >> Dear Marcelo, >> >> When the switch reboot, the host's interface thinks it is >> disconnected (no power at the cable), then the host send out >> confirm when the link is up. > > sure, this is what i would call disconnect as you do > > my question is what is the difference between disconnected and > physically disconnected? > > In addition, i guess there are at least two other problematic cases > where the reboot in the savi device would result in problems: > > The case when the host is connected to the SAVI device through a legacy > switch, in case the reboot of the savi device is invisible to the host, > so it won't send any dhcp msg > > > Please see my another reply on none-directly host. so basically also for the dhcp case, the cps solution is incompatible with legacy switches i.e. savi and legacy devices cannot be connected int he same subnetwork > > > Ans besides, if we move to the wireless case, it is explicilty stated > in the below rules that: > > o The client using a wireless technology changes access points. > > > So, in wireless networks a reboot in the savi device would not imply any > dhcp mesage, so the lost state in case of reboot in this cannot be > recovered by epxecting the host will send a new dhcp msg. > > > For the wired Ethernet case, it is no problem. > we haven't yet clarified the disconnected versus physically disconnected issue Regards, marcelo > thanks, > Jun > > Regards, marcelo > > >> I did see it during the test and I think you could also observe it if >> you snoop the packet. >> >> Thanks, >> Jun Bi >> >>>>>> >>>>> [Guang Yao] >>>>> See rfc3315 18.1.2 >>>>> The host _MUST_ send CONFIRM when >>>>> o The client reboots. >>>>> >>>>> o The client is physically connected to a wired connection. >>>>> >>>>> o The client returns from sleep mode. >>>>> >>>>> o The client using a wireless technology changes access points. >>>>> >>>>> >>>>> >>>> so the node is not mandated to send a confirm when the switch that >>>> it is >>>> connected reboots as long as it remains the same >>>> >>>> >>>> regards, marcelo >>>> >>> [Guang Yao] You must be kidding. >>> When the switch reboot, its ports are first turned down: then the >>> client is >>> disconnected; >>> >> >> is the host _physically_ disconnected? >>> then turned on: then the client will be connected to the port. This >>> is the >>> second case. >>> >>>> >>>>>> Regards, marcelo >> >> >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > > > From marcelo@it.uc3m.es Thu Jul 23 07:57:24 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A54CB3A6939 for ; Thu, 23 Jul 2009 07:57:24 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.578 X-Spam-Level: X-Spam-Status: No, score=-6.578 tagged_above=-999 required=5 tests=[AWL=0.021, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OazYn4uc1qyX for ; Thu, 23 Jul 2009 07:57:23 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id 6A3093A6837 for ; Thu, 23 Jul 2009 07:57:23 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp03.uc3m.es (Postfix) with ESMTP id 9E63F7317B9; Thu, 23 Jul 2009 16:50:42 +0200 (CEST) Message-ID: <4A6878C2.5060303@it.uc3m.es> Date: Thu, 23 Jul 2009 16:50:42 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn><4A685F13.7010906@it.uc3m.es> <4A68709F.6030201@it.uc3m.es> <4A6876CB.6010107@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 14:57:24 -0000 Jun Bi escribió: > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Jun Bi" > Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" > ; "Guang Yao" > Sent: Thursday, July 23, 2009 10:42 PM > Subject: Re: [savi] Consensus call on "unregistered" source addresses > > >> Jun Bi escribió: >>> >>> ----- Original Message ----- From: "marcelo bagnulo braun" >>> >>> To: "Jun Bi" >>> Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" >>> ; "Guang Yao" >>> >>> Sent: Thursday, July 23, 2009 10:15 PM >>> Subject: Re: [savi] Consensus call on "unregistered" source addresses >>> >>> >>> Jun Bi escribió: >>>> Dear Marcelo, >>>> >>>> When the switch reboot, the host's interface thinks it is >>>> disconnected (no power at the cable), then the host send out >>>> confirm when the link is up. >>> >>> sure, this is what i would call disconnect as you do >>> >>> my question is what is the difference between disconnected and >>> physically disconnected? >>> >>> In addition, i guess there are at least two other problematic cases >>> where the reboot in the savi device would result in problems: >>> >>> The case when the host is connected to the SAVI device through a legacy >>> switch, in case the reboot of the savi device is invisible to the host, >>> so it won't send any dhcp msg >>> >>> >>> Please see my another reply on none-directly host. >> >> so basically also for the dhcp case, the cps solution is incompatible >> with legacy switches i.e. savi and legacy devices cannot be connected >> int he same subnetwork >> > > Did you see my another reply? > The more you deploy, the more you could anti-spoof. > There is a deployment suggestion. which basically implies having different IP subnetworks, one with all SAVI devices and the other without SAVI devices My point is that the limitation applies to both the SLAAC and the dhcp case > >>> >>> >>> Ans besides, if we move to the wireless case, it is explicilty stated >>> in the below rules that: >>> >>> o The client using a wireless technology changes access points. >>> >>> >>> So, in wireless networks a reboot in the savi device would not imply >>> any >>> dhcp mesage, so the lost state in case of reboot in this cannot be >>> recovered by epxecting the host will send a new dhcp msg. >>> >>> >>> For the wired Ethernet case, it is no problem. >>> >> we haven't yet clarified the disconnected versus physically >> disconnected issue > > > I don't know how to anwer you. > What's your point? > that we should ask people who wrote the dhcp spec and people doing dhcp implementations to give us some background on this > > > >> >> Regards, marcelo >> >> >> >>> thanks, >>> Jun >>> >>> Regards, marcelo >>> >>> >>>> I did see it during the test and I think you could also observe it >>>> if you snoop the packet. >>>> >>>> Thanks, >>>> Jun Bi >>>> >>>>>>>> >>>>>>> [Guang Yao] >>>>>>> See rfc3315 18.1.2 >>>>>>> The host _MUST_ send CONFIRM when >>>>>>> o The client reboots. >>>>>>> >>>>>>> o The client is physically connected to a wired connection. >>>>>>> >>>>>>> o The client returns from sleep mode. >>>>>>> >>>>>>> o The client using a wireless technology changes access points. >>>>>>> >>>>>>> >>>>>>> >>>>>> so the node is not mandated to send a confirm when the switch >>>>>> that it is >>>>>> connected reboots as long as it remains the same >>>>>> >>>>>> >>>>>> regards, marcelo >>>>>> >>>>> [Guang Yao] You must be kidding. >>>>> When the switch reboot, its ports are first turned down: then the >>>>> client is >>>>> disconnected; >>>>> >>>> >>>> is the host _physically_ disconnected? >>>>> then turned on: then the client will be connected to the port. >>>>> This is the >>>>> second case. >>>>> >>>>>> >>>>>>>> Regards, marcelo >>>> >>>> >>>> >>> >>> _______________________________________________ >>> savi mailing list >>> savi@ietf.org >>> https://www.ietf.org/mailman/listinfo/savi >>> >>> >>> >>> >> >> >> > > > From junbi@tsinghua.edu.cn Thu Jul 23 08:07:47 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2C7543A6A14 for ; Thu, 23 Jul 2009 08:07:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id CYEdr6x5Q-Ac for ; Thu, 23 Jul 2009 08:07:46 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 331E63A67D2 for ; Thu, 23 Jul 2009 08:07:46 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTzXi-0001h0-UD; Thu, 23 Jul 2009 22:45:10 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn><4A685F13.7010906@it.uc3m.es> <4A68709F.6030201@it.uc3m.es> <4A6876CB.6010107@it.uc3m.es> In-Reply-To: <4A6876CB.6010107@it.uc3m.es> Date: Thu, 23 Jul 2009 22:45:03 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:07:47 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" ; "Guang Yao" Sent: Thursday, July 23, 2009 10:42 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses > Jun Bi escribió: >> >> ----- Original Message ----- From: "marcelo bagnulo braun" >> >> To: "Jun Bi" >> Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" >> ; "Guang Yao" >> Sent: Thursday, July 23, 2009 10:15 PM >> Subject: Re: [savi] Consensus call on "unregistered" source addresses >> >> >> Jun Bi escribió: >>> Dear Marcelo, >>> >>> When the switch reboot, the host's interface thinks it is disconnected >>> (no power at the cable), then the host send out >>> confirm when the link is up. >> >> sure, this is what i would call disconnect as you do >> >> my question is what is the difference between disconnected and >> physically disconnected? >> >> In addition, i guess there are at least two other problematic cases >> where the reboot in the savi device would result in problems: >> >> The case when the host is connected to the SAVI device through a legacy >> switch, in case the reboot of the savi device is invisible to the host, >> so it won't send any dhcp msg >> >> >> Please see my another reply on none-directly host. > > so basically also for the dhcp case, the cps solution is incompatible with > legacy switches i.e. savi and legacy devices cannot be connected int he > same subnetwork > Did you see my another reply? The more you deploy, the more you could anti-spoof. There is a deployment suggestion. >> >> >> Ans besides, if we move to the wireless case, it is explicilty stated >> in the below rules that: >> >> o The client using a wireless technology changes access points. >> >> >> So, in wireless networks a reboot in the savi device would not imply any >> dhcp mesage, so the lost state in case of reboot in this cannot be >> recovered by epxecting the host will send a new dhcp msg. >> >> >> For the wired Ethernet case, it is no problem. >> > we haven't yet clarified the disconnected versus physically disconnected > issue I don't know how to anwer you. What's your point? > > Regards, marcelo > > > >> thanks, >> Jun >> >> Regards, marcelo >> >> >>> I did see it during the test and I think you could also observe it if >>> you snoop the packet. >>> >>> Thanks, >>> Jun Bi >>> >>>>>>> >>>>>> [Guang Yao] >>>>>> See rfc3315 18.1.2 >>>>>> The host _MUST_ send CONFIRM when >>>>>> o The client reboots. >>>>>> >>>>>> o The client is physically connected to a wired connection. >>>>>> >>>>>> o The client returns from sleep mode. >>>>>> >>>>>> o The client using a wireless technology changes access points. >>>>>> >>>>>> >>>>>> >>>>> so the node is not mandated to send a confirm when the switch that it >>>>> is >>>>> connected reboots as long as it remains the same >>>>> >>>>> >>>>> regards, marcelo >>>>> >>>> [Guang Yao] You must be kidding. >>>> When the switch reboot, its ports are first turned down: then the >>>> client is >>>> disconnected; >>>> >>> >>> is the host _physically_ disconnected? >>>> then turned on: then the client will be connected to the port. This is >>>> the >>>> second case. >>>> >>>>> >>>>>>> Regards, marcelo >>> >>> >>> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> >> >> >> > > > From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 08:08:03 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4CD5A3A6A14 for ; Thu, 23 Jul 2009 08:08:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.382 X-Spam-Level: X-Spam-Status: No, score=-2.382 tagged_above=-999 required=5 tests=[AWL=0.217, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hSGv1fm2Sph1 for ; Thu, 23 Jul 2009 08:08:02 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 5646A3A67EF for ; Thu, 23 Jul 2009 08:08:02 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTzsg-00020J-V3; Thu, 23 Jul 2009 23:06:51 +0800 From: "Guang Yao" To: "'marcelo bagnulo braun'" , "'Jun Bi'" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> In-Reply-To: <4A687198.1010009@it.uc3m.es> Date: Thu, 23 Jul 2009 23:06:50 +0800 Message-ID: <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLoOBXxTCvI395Qwa/3ALrSibGoQAAodyA Content-Language: zh-cn Cc: 'SAVI Mailing List' , 'Christian Vogt' , 'Guang Yao' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:08:03 -0000 > > so, basically you mean that in order to get SAVI protection _all_ the > devices in the same IP subnetwork MUST use SAVI devices and you cannot > have legacy devices. [Guang Yao] We never mean it is a MUST. It is just a suggestion for deployment. With partly deployment, CPS still works well, especially on filtering spoofing from directly connected hosts. On filtering spoofing packet from trunk port, IMO, CPS chooses the most secure and effective way that only check whether conflict local bindings. I know some mechanism would set up bindings on trunk port, but then a _BDP_ must be designed to clear overdue bindings on the trunk port. Or else, there will be a lot of other problems: memory cost, dropping of legal packets, full binding table... CPS at least makes sure every existing binding is valid without a BDP. FCFS actually make use of "likely" valid bindings to filter packets, because every binding may have been overdue. If you think that is not enough, OK, please design a SAVI solution that can protect _all_ the IP address in the IP subnetwork with only _partly_ deployment and _without_ modify current protocols. I think you may find it is impossible. > > This must be explicitly mentioned since imho it is a severe deployment > limitation. > In other words, if we want to deploy CPS in a subntework, then all the > devices MUST be SAVI devices. > > Regards, marcelo [Guang Yao] From junbi@cernet.edu.cn Thu Jul 23 08:17:13 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id AB7C03A67B3 for ; Thu, 23 Jul 2009 08:17:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.469 X-Spam-Level: X-Spam-Status: No, score=0.469 tagged_above=-999 required=5 tests=[AWL=0.372, BAYES_00=-2.599, FH_HAS_XAIMC=2.696] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id z0sfDvn7f3rh for ; Thu, 23 Jul 2009 08:17:12 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 2C1EB3A69F6 for ; Thu, 23 Jul 2009 08:17:11 -0700 (PDT) Received: from userPC([59.66.24.40]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm314a68c590; Thu, 23 Jul 2009 23:16:34 +0800 Message-ID: <6FDB296C1F3E4D8DA1F3983ABB992EDD@userPC> From: "Jun Bi" To: "marcelo bagnulo braun" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn><4A685F13.7010906@it.uc3m.es><4A68709F.6030201@it.uc3m.es><4A6876CB.6010107@it.uc3m.es> <4A6878C2.5060303@it.uc3m.es> In-Reply-To: <4A6878C2.5060303@it.uc3m.es> Date: Thu, 23 Jul 2009 23:16:26 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: GSGCA4WB Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:17:13 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" ; "Guang Yao" Sent: Thursday, July 23, 2009 10:50 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses Jun Bi escribió: > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Jun Bi" > Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" > ; "Guang Yao" > Sent: Thursday, July 23, 2009 10:42 PM > Subject: Re: [savi] Consensus call on "unregistered" source addresses > > >> Jun Bi escribió: >>> >>> ----- Original Message ----- From: "marcelo bagnulo braun" >>> >>> To: "Jun Bi" >>> Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" >>> ; "Guang Yao" >>> >>> Sent: Thursday, July 23, 2009 10:15 PM >>> Subject: Re: [savi] Consensus call on "unregistered" source addresses >>> >>> >>> Jun Bi escribió: >>>> Dear Marcelo, >>>> >>>> When the switch reboot, the host's interface thinks it is disconnected >>>> (no power at the cable), then the host send out >>>> confirm when the link is up. >>> >>> sure, this is what i would call disconnect as you do >>> >>> my question is what is the difference between disconnected and >>> physically disconnected? >>> >>> In addition, i guess there are at least two other problematic cases >>> where the reboot in the savi device would result in problems: >>> >>> The case when the host is connected to the SAVI device through a legacy >>> switch, in case the reboot of the savi device is invisible to the host, >>> so it won't send any dhcp msg >>> >>> >>> Please see my another reply on none-directly host. >> >> so basically also for the dhcp case, the cps solution is incompatible >> with legacy switches i.e. savi and legacy devices cannot be connected int >> he same subnetwork >> > > Did you see my another reply? > The more you deploy, the more you could anti-spoof. > There is a deployment suggestion. which basically implies having different IP subnetworks, one with all SAVI devices and the other without SAVI devices But it works. My point is that the limitation applies to both the SLAAC and the dhcp case Setting up binding based on Control Packet Snooping (CPS) provide the beinit, and could be deployed in real enviroment,with a very low cost (no new protocol, no host change, etc). Please trade off the benifit and cost. Thanks, Jun > >>> >>> >>> Ans besides, if we move to the wireless case, it is explicilty stated >>> in the below rules that: >>> >>> o The client using a wireless technology changes access points. >>> >>> >>> So, in wireless networks a reboot in the savi device would not imply any >>> dhcp mesage, so the lost state in case of reboot in this cannot be >>> recovered by epxecting the host will send a new dhcp msg. >>> >>> >>> For the wired Ethernet case, it is no problem. >>> >> we haven't yet clarified the disconnected versus physically disconnected >> issue > > > I don't know how to anwer you. > What's your point? > that we should ask people who wrote the dhcp spec and people doing dhcp implementations to give us some background on this In the real test, CPS works when switch reboot, change port, change switch. There is a SAVI implmentation in a switch, we will demo it at SAVI WG meeting. thanks, Jun > > > >> >> Regards, marcelo >> >> >> >>> thanks, >>> Jun >>> >>> Regards, marcelo >>> >>> >>>> I did see it during the test and I think you could also observe it if >>>> you snoop the packet. >>>> >>>> Thanks, >>>> Jun Bi >>>> >>>>>>>> >>>>>>> [Guang Yao] >>>>>>> See rfc3315 18.1.2 >>>>>>> The host _MUST_ send CONFIRM when >>>>>>> o The client reboots. >>>>>>> >>>>>>> o The client is physically connected to a wired connection. >>>>>>> >>>>>>> o The client returns from sleep mode. >>>>>>> >>>>>>> o The client using a wireless technology changes access points. >>>>>>> >>>>>>> >>>>>>> >>>>>> so the node is not mandated to send a confirm when the switch that it >>>>>> is >>>>>> connected reboots as long as it remains the same >>>>>> >>>>>> >>>>>> regards, marcelo >>>>>> >>>>> [Guang Yao] You must be kidding. >>>>> When the switch reboot, its ports are first turned down: then the >>>>> client is >>>>> disconnected; >>>>> >>>> >>>> is the host _physically_ disconnected? >>>>> then turned on: then the client will be connected to the port. This is >>>>> the >>>>> second case. >>>>> >>>>>> >>>>>>>> Regards, marcelo >>>> >>>> >>>> >>> >>> _______________________________________________ >>> savi mailing list >>> savi@ietf.org >>> https://www.ietf.org/mailman/listinfo/savi >>> >>> >>> >>> >> >> >> > > > _______________________________________________ savi mailing list savi@ietf.org https://www.ietf.org/mailman/listinfo/savi From junbi@cernet.edu.cn Thu Jul 23 08:39:32 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id B652F3A69F2 for ; Thu, 23 Jul 2009 08:39:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.346 X-Spam-Level: X-Spam-Status: No, score=0.346 tagged_above=-999 required=5 tests=[AWL=0.248, BAYES_00=-2.599, FH_HAS_XAIMC=2.696, STOX_REPLY_TYPE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3K2oEcx0KkXJ for ; Thu, 23 Jul 2009 08:39:32 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 6CBB83A687C for ; Thu, 23 Jul 2009 08:39:31 -0700 (PDT) Received: from userPC([59.66.24.40]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm3c4a68c99f; Thu, 23 Jul 2009 23:33:53 +0800 Message-ID: <720C8A3E452D49CD8DA2221E6818EDD8@userPC> From: "Jun Bi" To: "Guang Yao" , "'marcelo bagnulo braun'" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> In-Reply-To: <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> Date: Thu, 23 Jul 2009 23:33:45 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: GUrSA4WB Cc: 'SAVI Mailing List' , 'Christian Vogt' , 'Guang Yao' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:39:32 -0000 ----- Original Message ----- From: "Guang Yao" To: "'marcelo bagnulo braun'" ; "'Jun Bi'" Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" ; "'Guang Yao'" Sent: Thursday, July 23, 2009 11:06 PM Subject: RE: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >> >> so, basically you mean that in order to get SAVI protection _all_ the >> devices in the same IP subnetwork MUST use SAVI devices and you cannot >> have legacy devices. > [Guang Yao] > We never mean it is a MUST. It is just a suggestion for deployment. > With partly deployment, CPS still works well, especially on filtering > spoofing from directly connected hosts. > On filtering spoofing packet from trunk port, IMO, CPS chooses the most > secure and effective way that only check whether conflict local bindings. > I know some mechanism would set up bindings on trunk port, but then a > _BDP_ > must be designed to > clear overdue bindings on the trunk port. Or else, there will be a lot of > other problems: memory cost, > dropping of legal packets, full binding table... > > CPS at least makes sure every existing binding is valid without a BDP. > FCFS actually make use of "likely" valid bindings to filter packets, > because > every binding may have been overdue. > Hi Marcelo, By reading all you emails, I think you also recognize the benifit of CPS. Yes, you may ask more benifit, but please trade off the cost and the benifit. CPS is really a low cost solution and be implemented in switch and tested. To recognize the benifit, the WG at least could made some progress (having a solution works in some situation). It doesn't mean CPS prevent other new technology. You could continute you work, but at least now we did see FCFS has much more problems. Thanks, Jun > If you think that is not enough, > OK, please design a SAVI solution that can protect _all_ the IP address in > the > IP subnetwork with only _partly_ deployment and _without_ modify current > protocols. > I think you may find it is impossible. >> >> This must be explicitly mentioned since imho it is a severe deployment >> limitation. >> In other words, if we want to deploy CPS in a subntework, then all the >> devices MUST be SAVI devices. >> >> Regards, marcelo > > [Guang Yao] > > > From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 08:39:47 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6AFE33A67D2 for ; Thu, 23 Jul 2009 08:39:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.413 X-Spam-Level: X-Spam-Status: No, score=-2.413 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4HmW9DErAnzf for ; Thu, 23 Jul 2009 08:39:46 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id 65C3B3A6783 for ; Thu, 23 Jul 2009 08:39:46 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MU03o-0006uP-Fu for savi@ietf.org; Thu, 23 Jul 2009 23:18:20 +0800 From: "Guang Yao" To: "'SAVI Mailing List'" Date: Thu, 23 Jul 2009 23:18:20 +0800 Message-ID: <001301ca0ba8$cfc47350$6f4d59f0$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLpBxAvm0DwfjJQSSdbl5La71H5gAAzpxgAABZWCA= Content-Language: zh-cn Subject: [savi] FW: Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:39:47 -0000 -----Original Message----- From: Guang Yao [mailto:yaog@netarchlab.tsinghua.edu.cn] Sent: Thursday, July 23, 2009 11:18 PM To: 'marcelo bagnulo braun'; 'Jun Bi' Cc: 'SAVI Mailing List'; 'Christian Vogt'; 'Guang Yao' Subject: RE: [savi] Consensus call on "unregistered" source addresses > so basically also for the dhcp case, the cps solution is incompatible > with legacy switches i.e. savi and legacy devices cannot be connected > int he same subnetwork [Guang Yao] I wonder which sentence so tenebrous makes you think of that. > we haven't yet clarified the disconnected versus physically disconnected > issue [Guang Yao] Please see my previous mail. There is no eye on the host, it cannot see that its cable has been _physically_ unplugged. All it can do is through electoral signal. If you emphasize _physically_ disconnected, then every computer must need a camera or a force transducer to make sure it is _physically_ disconnected. > > Regards, marcelo > > > > > thanks, > > Jun > > > > Regards, marcelo > > > > > >> I did see it during the test and I think you could also observe it if > >> you snoop the packet. > >> > >> Thanks, > >> Jun Bi > >> > >>>>>> > >>>>> [Guang Yao] > >>>>> See rfc3315 18.1.2 > >>>>> The host _MUST_ send CONFIRM when > >>>>> o The client reboots. > >>>>> > >>>>> o The client is physically connected to a wired connection. > >>>>> > >>>>> o The client returns from sleep mode. > >>>>> > >>>>> o The client using a wireless technology changes access points. > >>>>> > >>>>> > >>>>> > >>>> so the node is not mandated to send a confirm when the switch that > >>>> it is > >>>> connected reboots as long as it remains the same > >>>> > >>>> > >>>> regards, marcelo > >>>> > >>> [Guang Yao] You must be kidding. > >>> When the switch reboot, its ports are first turned down: then the > >>> client is > >>> disconnected; > >>> > >> > >> is the host _physically_ disconnected? > >>> then turned on: then the client will be connected to the port. This > >>> is the > >>> second case. > >>> > >>>> > >>>>>> Regards, marcelo > >> > >> > >> > > > > _______________________________________________ > > savi mailing list > > savi@ietf.org > > https://www.ietf.org/mailman/listinfo/savi > > > > > > > > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From marcelo@it.uc3m.es Thu Jul 23 08:43:57 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id ADB7A3A6ACE for ; Thu, 23 Jul 2009 08:43:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.579 X-Spam-Level: X-Spam-Status: No, score=-6.579 tagged_above=-999 required=5 tests=[AWL=0.020, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iZeDqTlpRozK for ; Thu, 23 Jul 2009 08:43:56 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 0B2543A6941 for ; Thu, 23 Jul 2009 08:43:27 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp01.uc3m.es (Postfix) with ESMTP id 668F6BA58B6; Thu, 23 Jul 2009 16:48:43 +0200 (CEST) Message-ID: <4A68784B.3090508@it.uc3m.es> Date: Thu, 23 Jul 2009 16:48:43 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:43:57 -0000 Jun Bi escribió: > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Jun Bi" > Cc: "SAVI Mailing List" ; "Christian Vogt" > ; "Guang Yao" > Sent: Thursday, July 23, 2009 10:20 PM > Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > > > Jun Bi escribió: >> >> >> >> ----- Original Message ----- From: "marcelo bagnulo braun" >> >> To: "Christian Vogt" >> Cc: "SAVI Mailing List" ; "Guang Yao" >> >> Sent: Thursday, July 23, 2009 6:07 PM >> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >> >> >> Sorry for coming back to this, but i have further comments... >> >> Christian Vogt escribió: >>> >>> CPS calls for SAVI devices to create >>> bindings only for directly attached hosts, not for hosts attached via >>> another switch. This is based on the assumption that the ports of SAVI >>> devices are configured with respect to whether they connect to a host >>> directly, or whether they connect to another switch. For ports >>> connecting to another switch, SAVI protection is disabled. >>> >> I would like to come back to the level of protection achieved by this. >> >> Suppose you have the following topology. >> >> >> +-------------------+ >> | Internet | >> +-------------------+ >> | >> | >> +-------+ >> | router| >> +-------+ >> | >> +--------+ >> |SAVICPS1|--H3 >> +--------+ >> | | >> +----+ +---+ >> | | >> +-------------+ +--------+ >> |Legacy Switch| |SAVICPS2| >> +-------------+ +--------+ >> | | >> H1 H2 >> >> >> >> So suppose that as you say, the SAVICPS does create bindings for ports >> connected to another switch. >> >> >> [Jun Bi] >> SAVI-CPS1 won't creat binding for trunk port. > > sorry, this is what i quoted above and that is what i meant... (i guess > i was too concentrated in the ascii and disregarded the actual text) > >> >> So, how do we prevent H1 from spoofing H2 address when is sending >> packets to H3 (or to any host in the rest of the internet in the picture >> above)? >> >> >> I mean, i understnad that the main idea in CPS is that there is >> perimeter defense, so all the borders need to provide protection. >> I understand that in order to actually provide the protection, the >> SAVICPS1 device must create bindings for hosts connected behind the >> legacy switch, or am i missing something? >> >> [Jun Bi] >> Dear Marcelo, >> Thank you for the question. >> CPS only validate the source address of SAVI deployment area (SAVI >> area) (for hosts directly attached to SAVI >> switches). The goal is to make the hosts in SAVI area (H1 and H3 >> in your picture) won't spoof. > > >> >> If the admistrator really want more benifit, we have a deployment >> suggestion. >> The network adminstrator knows which is SAVI-switch, which is >> non-SAVI-swtich. >> Then he can configure two VLANs, one for SAVI area, other for >> non-SAVI area, >> then assign differnt address space (prefixes) for two differnet >> areas. >> The layer 3 device will do the ingress filtering then H1 can't use >> H2's source address. >> > > so, basically you mean that in order to get SAVI protection _all_ the > devices in the same IP subnetwork MUST use SAVI devices and you cannot > have legacy devices. > > Hi, I don't want to use the word "protect", it should be > "anti-spoof". > SAVI-CPS could anti-spoof in SAVI-area, not none-SAVI area. > If you deploy _all_ SAVI-CPS switch, then you anti-spoof for > _all_ host. > If you deploy some of them, then you anti-spoof for some host > attched to the new SAVI-switch. but this is misleading I mean, as if you see in the figure i sketched above, the host that is connected in the legacy switch can spoof the address of _any_ host even those that are connected to a SAVI device. So if you have a network that is using some CPS SAVI devices and some legacy switches, an attacker connected to a legacy device can spoof any address in the network. So when a host is connected to a SAVI device this doesn't mean that its address is protected and no attacker can spoof it, but what it means is that the host cannot spoof any other address of another host that is also connected to a savi device (this assuming that the DAD packets are widely distributed, which may not be the case, but this is a different story) so i think the protection resulting from the solution is fairly weak. Regards, marcelo > I think it's reasonable. The more SAVI-switch you deploy, the > more host you anti-spoof. > There is no free luch. > > > This must be explicitly mentioned since imho it is a severe deployment > limitation. > > Hi, we mentioned it, that's why Christian also methion it at > the email above. > > In other words, if we want to deploy CPS in a subntework, then all the > devices MUST be SAVI devices. > > Not "MUST", did you see you reply? > > > > > > Regards, marcelo > >> Best Regards, >> Jun Bi >> >> >> >> >> >> >> >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > > > From junbi@tsinghua.edu.cn Thu Jul 23 08:44:00 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id F2EBA3A6783 for ; Thu, 23 Jul 2009 08:43:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3w6bRGJ4DOwr for ; Thu, 23 Jul 2009 08:43:58 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id D53AE3A69FC for ; Thu, 23 Jul 2009 08:43:33 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MTztS-0006km-F7; Thu, 23 Jul 2009 23:07:38 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> In-Reply-To: <4A68784B.3090508@it.uc3m.es> Date: Thu, 23 Jul 2009 23:07:30 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:44:00 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" ; "Guang Yao" Sent: Thursday, July 23, 2009 10:48 PM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > Jun Bi escribió: >> >> ----- Original Message ----- From: "marcelo bagnulo braun" >> >> To: "Jun Bi" >> Cc: "SAVI Mailing List" ; "Christian Vogt" >> ; "Guang Yao" >> Sent: Thursday, July 23, 2009 10:20 PM >> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >> >> >> Jun Bi escribió: >>> >>> >>> >>> ----- Original Message ----- From: "marcelo bagnulo braun" >>> >>> To: "Christian Vogt" >>> Cc: "SAVI Mailing List" ; "Guang Yao" >>> >>> Sent: Thursday, July 23, 2009 6:07 PM >>> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >>> >>> >>> Sorry for coming back to this, but i have further comments... >>> >>> Christian Vogt escribió: >>>> >>>> CPS calls for SAVI devices to create >>>> bindings only for directly attached hosts, not for hosts attached via >>>> another switch. This is based on the assumption that the ports of SAVI >>>> devices are configured with respect to whether they connect to a host >>>> directly, or whether they connect to another switch. For ports >>>> connecting to another switch, SAVI protection is disabled. >>>> >>> I would like to come back to the level of protection achieved by this. >>> >>> Suppose you have the following topology. >>> >>> >>> +-------------------+ >>> | Internet | >>> +-------------------+ >>> | >>> | >>> +-------+ >>> | router| >>> +-------+ >>> | >>> +--------+ >>> |SAVICPS1|--H3 >>> +--------+ >>> | | >>> +----+ +---+ >>> | | >>> +-------------+ +--------+ >>> |Legacy Switch| |SAVICPS2| >>> +-------------+ +--------+ >>> | | >>> H1 H2 >>> >>> >>> >>> So suppose that as you say, the SAVICPS does create bindings for ports >>> connected to another switch. >>> >>> >>> [Jun Bi] >>> SAVI-CPS1 won't creat binding for trunk port. >> >> sorry, this is what i quoted above and that is what i meant... (i guess >> i was too concentrated in the ascii and disregarded the actual text) >> >>> >>> So, how do we prevent H1 from spoofing H2 address when is sending >>> packets to H3 (or to any host in the rest of the internet in the picture >>> above)? >>> >>> >>> I mean, i understnad that the main idea in CPS is that there is >>> perimeter defense, so all the borders need to provide protection. >>> I understand that in order to actually provide the protection, the >>> SAVICPS1 device must create bindings for hosts connected behind the >>> legacy switch, or am i missing something? >>> >>> [Jun Bi] >>> Dear Marcelo, >>> Thank you for the question. >>> CPS only validate the source address of SAVI deployment area (SAVI >>> area) (for hosts directly attached to SAVI >>> switches). The goal is to make the hosts in SAVI area (H1 and H3 in >>> your picture) won't spoof. >> >> >>> >>> If the admistrator really want more benifit, we have a deployment >>> suggestion. >>> The network adminstrator knows which is SAVI-switch, which is >>> non-SAVI-swtich. >>> Then he can configure two VLANs, one for SAVI area, other for >>> non-SAVI area, >>> then assign differnt address space (prefixes) for two differnet >>> areas. >>> The layer 3 device will do the ingress filtering then H1 can't use >>> H2's source address. >>> >> >> so, basically you mean that in order to get SAVI protection _all_ the >> devices in the same IP subnetwork MUST use SAVI devices and you cannot >> have legacy devices. >> >> Hi, I don't want to use the word "protect", it should be >> "anti-spoof". >> SAVI-CPS could anti-spoof in SAVI-area, not none-SAVI area. >> If you deploy _all_ SAVI-CPS switch, then you anti-spoof for >> _all_ host. >> If you deploy some of them, then you anti-spoof for some host >> attched to the new SAVI-switch. > > but this is misleading > I mean, as if you see in the figure i sketched above, the host that is > connected in the legacy switch can spoof the address of _any_ host even > those that are connected to a SAVI device. (1)The SAVI swtich could prevent the hosts directly attched to spoof another address, This is a benifit. (2)SAVI validate the source address, it doesn't protect the detination,that's why I sugesst you don't use the word "protect". Any host under legency switch could still spoof the source address, it's acceptable, because you didn't deploy new technology. You get some benifit in the deployment area, when you deploy all switch, then you get the highest security level, it's reasonable. Please note in FCFS, even the host directly attached to SAVI-FCFS-switch could still spoof source address. (3)Even the hosts under legacy switch won't need to be validated, we still proposed a deployment suggestion to to VLAN stated in my past email. At that case, H1 could not use H2's source Address. > > So if you have a network that is using some CPS SAVI devices and some > legacy switches, an attacker connected to a legacy device can spoof any > address in the network. Please see above.Sice you did't deploy, why you ask the benifit of anti-spoofing. > > So when a host is connected to a SAVI device this doesn't mean that its > address is protected and no attacker can spoof it, but what it means is > that the host cannot spoof any other address of another host that is also > connected to a savi device (this assuming that the DAD packets are widely > distributed, which may not be the case, but this is a different story) > > so i think the protection resulting from the solution is fairly weak. In the deployment suggestion by using VLAN, the attcker under legacy switch can't spoof the src of host under SAVI switch. So it's not weak. > > Regards, marcelo > >> I think it's reasonable. The more SAVI-switch you deploy, the >> more host you anti-spoof. >> There is no free luch. >> >> >> This must be explicitly mentioned since imho it is a severe deployment >> limitation. >> >> Hi, we mentioned it, that's why Christian also methion it at the >> email above. >> > > > > >> In other words, if we want to deploy CPS in a subntework, then all the >> devices MUST be SAVI devices. >> >> Not "MUST", did you see you reply? >> >> >> >> >> >> Regards, marcelo >> >>> Best Regards, >>> Jun Bi >>> >>> >>> >>> >>> >>> >>> >>> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> >> >> >> > > > From jmh@joelhalpern.com Thu Jul 23 08:48:58 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id DEB293A69F2 for ; Thu, 23 Jul 2009 08:48:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.74 X-Spam-Level: X-Spam-Status: No, score=-2.74 tagged_above=-999 required=5 tests=[AWL=-0.475, BAYES_00=-2.599, IP_NOT_FRIENDLY=0.334] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id T-WvhyFCPh75 for ; Thu, 23 Jul 2009 08:48:58 -0700 (PDT) Received: from morbo.mail.tigertech.net (morbo.mail.tigertech.net [67.131.251.54]) by core3.amsl.com (Postfix) with ESMTP id 730D93A6783 for ; Thu, 23 Jul 2009 08:48:38 -0700 (PDT) Received: from hermes.mail.tigertech.net (hermes.mail.tigertech.net [64.62.209.72]) by morbo.tigertech.net (Postfix) with ESMTP id E2A5AA3BB7 for ; Thu, 23 Jul 2009 08:46:07 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by hermes.tigertech.net (Postfix) with ESMTP id CB3A143801A; Thu, 23 Jul 2009 08:45:37 -0700 (PDT) X-Virus-Scanned: Debian amavisd-new at hermes.tigertech.net Received: from [10.10.10.100] (pool-71-161-52-248.clppva.btas.verizon.net [71.161.52.248]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by hermes.tigertech.net (Postfix) with ESMTP id AA39D438019; Thu, 23 Jul 2009 08:45:36 -0700 (PDT) Message-ID: <4A68859B.5060609@joelhalpern.com> Date: Thu, 23 Jul 2009 11:45:31 -0400 From: "Joel M. Halpern" User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <25255C7E5FB5419981A9AD148122331E@userPC> In-Reply-To: <25255C7E5FB5419981A9AD148122331E@userPC> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:48:59 -0000 I think we should recognize that there are "non-SAVI" networks. Some network configurations / operational policies simply do not meet the goals of SAVI. It is perfectly reasonable (and I think necessary) for the working group to say that if you want the benefits (to the network operator and the larger community) that SAVI brings, you need to run your network in certain ways. As an extreme example, a wireless network with no per-user security at either the MAC, Admission, or IP layers probably can not be "SAVI." Similarly, a network using SLAAC probably needs to have certain additional mechanisms in place in order to be "SAVI." I would suggest that we focus on what properties and constraints we need to have in place to meet our goals, and then what mechanisms can make use of those properties. Yours, Joel PS: The reason for sending this is that it seems likely that many fixed wired networks (for example in office environments) using SLAAC will not be able to meet our requirements without additional constraints. Jun Bi wrote: > Hi All, > > We support two modes in SAVI. > (1) In DHCP-only network. > (2) In DHCP-SLAAC mixed network. > > We believe what the users want is the higher security level. > We think the default dropping will bring the network more secure, > accounting accuracy, > and manageable. > > Best Regards, > Jun Bi > > ----- Original Message ----- From: "Christian Vogt" > > To: "SAVI Mailing List" > Sent: Tuesday, July 14, 2009 12:54 PM > Subject: [savi] Consensus call on "unregistered" source addresses > > >> Folks - >> >> As announced earlier, we will have a consensus call on how SAVI devices >> should treat source addresses for which no configuration signaling was >> seen. Consensus questions for this were proposed on July 8, and the >> feedback received from the working group indicates that those are OK. >> >> I would hence like to initiate the consensus call. To participate in >> the consensus call, please answer by Sunday, July 19, the following two >> questions (A) and (B), using one of the two possible answers provided >> for each question: >> >> (A) In networks where SLAAC is permitted for address configuration, how >> should a SAVI device treat packets with a source address for which >> neither a successful DAD procedure nor a DHCP assignment was seen? >> >> (A1) Discard the packet >> (A2) Forward and optionally log the packet >> >> (B) In networks where only DHCP is permitted for address configuration, >> how should a SAVI device treat packets with a source address for >> which no DHCP assignment was seen? >> >> (B1) Discard the packet >> (B2) Forward and optionally log the packet >> >> In these questions, a SAVI device sees a "successful DAD procedure" for >> an address if it sees a DAD Neighbor Solicitation message, but no >> responding DAD Neighbor Advertisement message, for this address. >> >> Please recall the relationship of our two main SAVI solution proposals >> to these consensus questions: The FCFS and CPS solutions both use the >> combination of (A1) plus (B1), with different means to reduce the >> probability of dropping legitimate packets. The middle-ground solution >> we are considering now -- originally suggested in [1] by Marcelo, and >> slightly augmented in [2] by me with an alternative mode for DHCP-only >> networks -- uses the combination of (A2) plus (B1). I would like folks >> to consider in particular this combination of (A2) plus (B1) because it >> constitutes a reasonable compromise between two competing solutions. >> >> Please also recall our working assumption that SAVI will operate >> exclusively in wired networks, with switch ports constituting the >> binding anchors. The goal of this working assumption is to relieve the >> discussion from considerations about scenarios where SAVI can only have >> limited benefit. Unprotected wireless networks are an example of those >> scenarios, where forgeable MAC addresses are the only possible binding >> anchors. We will re-evaluate at a later stage how well SAVI applies to >> other scenarios. >> >> - Christian >> >> >> [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html >> [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html >> >> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> >> > > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From junbi@tsinghua.edu.cn Thu Jul 23 08:58:12 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7EE423A69F6 for ; Thu, 23 Jul 2009 08:58:12 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eNH4HSEEmS3N for ; Thu, 23 Jul 2009 08:58:11 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id C15663A6C59 for ; Thu, 23 Jul 2009 08:57:54 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MU0fS-0002iA-E9; Thu, 23 Jul 2009 23:57:14 +0800 Message-ID: From: "Jun Bi" To: "Joel M. Halpern" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <25255C7E5FB5419981A9AD148122331E@userPC> <4A68859B.5060609@joelhalpern.com> In-Reply-To: <4A68859B.5060609@joelhalpern.com> Date: Thu, 23 Jul 2009 23:57:05 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 15:58:14 -0000 ----- Original Message ----- From: "Joel M. Halpern" To: "Jun Bi" Cc: "Christian Vogt" ; "SAVI Mailing List" Sent: Thursday, July 23, 2009 11:45 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses >I think we should recognize that there are "non-SAVI" networks. > Some network configurations / operational policies simply do not meet the > goals of SAVI. It is perfectly reasonable (and I think necessary) for the > working group to say that if you want the benefits (to the network > operator and the larger community) that SAVI brings, you need to run your > network in certain ways. > Dear Joel and WG members, I agree with that. If the operator wants to prevent hosts in SAVI-area to spoof source address, then please deploy more SAVI swtches. Thanks, Jun Bi > As an extreme example, a wireless network with no per-user security at > either the MAC, Admission, or IP layers probably can not be "SAVI." > > Similarly, a network using SLAAC probably needs to have certain additional > mechanisms in place in order to be "SAVI." > > I would suggest that we focus on what properties and constraints we need > to have in place to meet our goals, and then what mechanisms can make use > of those properties. > > Yours, > Joel > > PS: The reason for sending this is that it seems likely that many fixed > wired networks (for example in office environments) using SLAAC will not > be able to meet our requirements without additional constraints. > > Jun Bi wrote: >> Hi All, >> >> We support two modes in SAVI. >> (1) In DHCP-only network. >> (2) In DHCP-SLAAC mixed network. >> >> We believe what the users want is the higher security level. >> We think the default dropping will bring the network more secure, >> accounting accuracy, >> and manageable. >> >> Best Regards, >> Jun Bi >> >> ----- Original Message ----- From: "Christian Vogt" >> >> To: "SAVI Mailing List" >> Sent: Tuesday, July 14, 2009 12:54 PM >> Subject: [savi] Consensus call on "unregistered" source addresses >> >> >>> Folks - >>> >>> As announced earlier, we will have a consensus call on how SAVI devices >>> should treat source addresses for which no configuration signaling was >>> seen. Consensus questions for this were proposed on July 8, and the >>> feedback received from the working group indicates that those are OK. >>> >>> I would hence like to initiate the consensus call. To participate in >>> the consensus call, please answer by Sunday, July 19, the following two >>> questions (A) and (B), using one of the two possible answers provided >>> for each question: >>> >>> (A) In networks where SLAAC is permitted for address configuration, how >>> should a SAVI device treat packets with a source address for which >>> neither a successful DAD procedure nor a DHCP assignment was seen? >>> >>> (A1) Discard the packet >>> (A2) Forward and optionally log the packet >>> >>> (B) In networks where only DHCP is permitted for address configuration, >>> how should a SAVI device treat packets with a source address for >>> which no DHCP assignment was seen? >>> >>> (B1) Discard the packet >>> (B2) Forward and optionally log the packet >>> >>> In these questions, a SAVI device sees a "successful DAD procedure" for >>> an address if it sees a DAD Neighbor Solicitation message, but no >>> responding DAD Neighbor Advertisement message, for this address. >>> >>> Please recall the relationship of our two main SAVI solution proposals >>> to these consensus questions: The FCFS and CPS solutions both use the >>> combination of (A1) plus (B1), with different means to reduce the >>> probability of dropping legitimate packets. The middle-ground solution >>> we are considering now -- originally suggested in [1] by Marcelo, and >>> slightly augmented in [2] by me with an alternative mode for DHCP-only >>> networks -- uses the combination of (A2) plus (B1). I would like folks >>> to consider in particular this combination of (A2) plus (B1) because it >>> constitutes a reasonable compromise between two competing solutions. >>> >>> Please also recall our working assumption that SAVI will operate >>> exclusively in wired networks, with switch ports constituting the >>> binding anchors. The goal of this working assumption is to relieve the >>> discussion from considerations about scenarios where SAVI can only have >>> limited benefit. Unprotected wireless networks are an example of those >>> scenarios, where forgeable MAC addresses are the only possible binding >>> anchors. We will re-evaluate at a later stage how well SAVI applies to >>> other scenarios. >>> >>> - Christian >>> >>> >>> [1] http://www.ietf.org/mail-archive/web/savi/current/msg00654.html >>> [2] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html >>> >>> >>> >>> _______________________________________________ >>> savi mailing list >>> savi@ietf.org >>> https://www.ietf.org/mailman/listinfo/savi >>> >>> >> >> >> _______________________________________________ >> savi mailing list >> savi@ietf.org >> https://www.ietf.org/mailman/listinfo/savi >> > > From marcelo@it.uc3m.es Thu Jul 23 09:00:34 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C05313A6A19 for ; Thu, 23 Jul 2009 09:00:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.58 X-Spam-Level: X-Spam-Status: No, score=-6.58 tagged_above=-999 required=5 tests=[AWL=0.019, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id bOO5C3iazQk6 for ; Thu, 23 Jul 2009 09:00:33 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id E1C283A68A0 for ; Thu, 23 Jul 2009 09:00:32 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp03.uc3m.es (Postfix) with ESMTP id AB554731A44; Thu, 23 Jul 2009 17:59:47 +0200 (CEST) Message-ID: <4A6888F3.5080809@it.uc3m.es> Date: Thu, 23 Jul 2009 17:59:47 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:00:34 -0000 Jun Bi escribió: > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Jun Bi" > Cc: "SAVI Mailing List" ; "Christian Vogt" > ; "Guang Yao" > Sent: Thursday, July 23, 2009 10:48 PM > Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > > >> Jun Bi escribió: >>> >>> ----- Original Message ----- From: "marcelo bagnulo braun" >>> >>> To: "Jun Bi" >>> Cc: "SAVI Mailing List" ; "Christian Vogt" >>> ; "Guang Yao" >>> >>> Sent: Thursday, July 23, 2009 10:20 PM >>> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >>> >>> >>> Jun Bi escribió: >>>> >>>> >>>> >>>> ----- Original Message ----- From: "marcelo bagnulo braun" >>>> >>>> To: "Christian Vogt" >>>> Cc: "SAVI Mailing List" ; "Guang Yao" >>>> >>>> Sent: Thursday, July 23, 2009 6:07 PM >>>> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >>>> >>>> >>>> Sorry for coming back to this, but i have further comments... >>>> >>>> Christian Vogt escribió: >>>>> >>>>> CPS calls for SAVI devices to create >>>>> bindings only for directly attached hosts, not for hosts attached via >>>>> another switch. This is based on the assumption that the ports of >>>>> SAVI >>>>> devices are configured with respect to whether they connect to a host >>>>> directly, or whether they connect to another switch. For ports >>>>> connecting to another switch, SAVI protection is disabled. >>>>> >>>> I would like to come back to the level of protection achieved by this. >>>> >>>> Suppose you have the following topology. >>>> >>>> >>>> +-------------------+ >>>> | Internet | >>>> +-------------------+ >>>> | >>>> | >>>> +-------+ >>>> | router| >>>> +-------+ >>>> | >>>> +--------+ >>>> |SAVICPS1|--H3 >>>> +--------+ >>>> | | >>>> +----+ +---+ >>>> | | >>>> +-------------+ +--------+ >>>> |Legacy Switch| |SAVICPS2| >>>> +-------------+ +--------+ >>>> | | >>>> H1 H2 >>>> >>>> >>>> >>>> So suppose that as you say, the SAVICPS does create bindings for ports >>>> connected to another switch. >>>> >>>> >>>> [Jun Bi] >>>> SAVI-CPS1 won't creat binding for trunk port. >>> >>> sorry, this is what i quoted above and that is what i meant... (i guess >>> i was too concentrated in the ascii and disregarded the actual text) >>> >>>> >>>> So, how do we prevent H1 from spoofing H2 address when is sending >>>> packets to H3 (or to any host in the rest of the internet in the >>>> picture >>>> above)? >>>> >>>> >>>> I mean, i understnad that the main idea in CPS is that there is >>>> perimeter defense, so all the borders need to provide protection. >>>> I understand that in order to actually provide the protection, the >>>> SAVICPS1 device must create bindings for hosts connected behind the >>>> legacy switch, or am i missing something? >>>> >>>> [Jun Bi] >>>> Dear Marcelo, >>>> Thank you for the question. >>>> CPS only validate the source address of SAVI deployment area >>>> (SAVI area) (for hosts directly attached to SAVI >>>> switches). The goal is to make the hosts in SAVI area (H1 and H3 >>>> in your picture) won't spoof. >>> >>> >>>> >>>> If the admistrator really want more benifit, we have a >>>> deployment suggestion. >>>> The network adminstrator knows which is SAVI-switch, which is >>>> non-SAVI-swtich. >>>> Then he can configure two VLANs, one for SAVI area, other for >>>> non-SAVI area, >>>> then assign differnt address space (prefixes) for two differnet >>>> areas. >>>> The layer 3 device will do the ingress filtering then H1 can't >>>> use H2's source address. >>>> >>> >>> so, basically you mean that in order to get SAVI protection _all_ the >>> devices in the same IP subnetwork MUST use SAVI devices and you cannot >>> have legacy devices. >>> >>> Hi, I don't want to use the word "protect", it should be >>> "anti-spoof". >>> SAVI-CPS could anti-spoof in SAVI-area, not none-SAVI area. >>> If you deploy _all_ SAVI-CPS switch, then you anti-spoof >>> for _all_ host. >>> If you deploy some of them, then you anti-spoof for some >>> host attched to the new SAVI-switch. >> >> but this is misleading >> I mean, as if you see in the figure i sketched above, the host that >> is connected in the legacy switch can spoof the address of _any_ host >> even those that are connected to a SAVI device. > > (1)The SAVI swtich could prevent the hosts directly attched > to spoof another address, > This is a benifit. > (2)SAVI validate the source address, it doesn't protect the > detination,that's why I sugesst > you don't use the word "protect".Any host under legency > switch could still spoof the source address, it's > acceptable, because you didn't deploy new technology. well, you could achieve better security if you used another approach > > You get some benifit in the deployment area, when you > deploy all switch, then you get the highest security > level, it's reasonable. > Please note in FCFS, even the host directly attached to > SAVI-FCFS-switch could still spoof source address. how come? > > (3)Even the hosts under legacy switch won't need to be > validated, we still proposed a deployment > suggestion to to VLAN stated in my past email. At that > case, H1 could not use H2's source > Address. > as i mentioned before, you can call it a deployment suggestion but what it really is is a mean to have all the devices in the subnetwork to be SAVI devices, which is the way to comply with the limitation imposed by the CPS savi >> >> So if you have a network that is using some CPS SAVI devices and some >> legacy switches, an attacker connected to a legacy device can spoof >> any address in the network. > > Please see above.Sice you did't deploy, why you ask the > benifit of anti-spoofing. I am not sure what do you mean by this, but again, if you have a legacy device in the same subnetwork, an attacker connected to the legacy device can spoof any address of the subnetwrok under SAVI CPS > >> >> So when a host is connected to a SAVI device this doesn't mean that >> its address is protected and no attacker can spoof it, but what it >> means is that the host cannot spoof any other address of another host >> that is also connected to a savi device (this assuming that the DAD >> packets are widely distributed, which may not be the case, but this >> is a different story) >> >> so i think the protection resulting from the solution is fairly weak. > > In the deployment suggestion by using VLAN, the attcker > under legacy switch > can't spoof the src of host under SAVI switch. > So it's not weak. > Again, you can call it as you wish, but the fact is that SAVI CPS requires that all switches in the subnetwrok implement SAVI CPS because if not an attacker connected to the legacy switch can spoof any address Regards, marcelo >> >> Regards, marcelo >> >>> I think it's reasonable. The more SAVI-switch you deploy, >>> the more host you anti-spoof. >>> There is no free luch. >>> >>> >>> This must be explicitly mentioned since imho it is a severe deployment >>> limitation. >>> >>> Hi, we mentioned it, that's why Christian also methion it >>> at the email above. >>> >> >> >> >> >>> In other words, if we want to deploy CPS in a subntework, then all the >>> devices MUST be SAVI devices. >>> >>> Not "MUST", did you see you reply? >>> >>> >>> >>> >>> >>> Regards, marcelo >>> >>>> Best Regards, >>>> Jun Bi >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>> >>> _______________________________________________ >>> savi mailing list >>> savi@ietf.org >>> https://www.ietf.org/mailman/listinfo/savi >>> >>> >>> >>> >> >> >> > > > From marcelo@it.uc3m.es Thu Jul 23 09:06:15 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D6BED3A6AD3 for ; Thu, 23 Jul 2009 09:06:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.581 X-Spam-Level: X-Spam-Status: No, score=-6.581 tagged_above=-999 required=5 tests=[AWL=0.018, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id zxjZep+iiOKp for ; Thu, 23 Jul 2009 09:06:15 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id F31B03A6ACE for ; Thu, 23 Jul 2009 09:06:14 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id 06F2A657362; Thu, 23 Jul 2009 18:05:28 +0200 (CEST) Message-ID: <4A688A47.2010209@it.uc3m.es> Date: Thu, 23 Jul 2009 18:05:27 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Guang Yao References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> In-Reply-To: <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:06:15 -0000 Guang Yao escribió: >> so, basically you mean that in order to get SAVI protection _all_ the >> devices in the same IP subnetwork MUST use SAVI devices and you cannot >> have legacy devices. >> > [Guang Yao] > We never mean it is a MUST. It is just a suggestion for deployment. > > With partly deployment, CPS still works well, especially on filtering > spoofing from directly connected hosts. > you mean that SAVI CPS only protects against atttacker connected to a SAVI device, If the attacker connects to a legacy switch, it can then sppof any address of any host in the netwrok, even if the target host is connected directly to a SAVI device. You can call this that it works well, i guess it is a matter of opinions, i wouldn't call it that way. But i guess we need to agree that we disagree and let the WG to decide if this is acceptable or not > On filtering spoofing packet from trunk port, i am not sure what do you mean by this > IMO, CPS chooses the most > secure and effective way that only check whether conflict local bindings. > I know some mechanism would set up bindings on trunk port, but then a _BDP_ > must be designed to > clear overdue bindings on the trunk port. Or else, there will be a lot of > other problems: memory cost, > dropping of legal packets, full binding table... > > CPS at least makes sure every existing binding is valid without a BDP. > how is mobility supported for instance? > FCFS actually make use of "likely" valid bindings to filter packets, because > every binding may have been overdue. > > what do you mean by overdue? > If you think that is not enough, > OK, please design a SAVI solution that can protect _all_ the IP address in > the > the point is that protecting an unused address i by far less imporntat than protecting an actually used address, especially in SLAAC. the only differenc ebetween an used and an unused address is a DAD NSOL, so there is not much gain protecting an unused address in SLAAC there is however, a lot of benefit in protecting an address that is currently being used by a host regards, marcelo > IP subnetwork with only _partly_ deployment and _without_ modify current > protocols. > I think you may find it is impossible. > >> This must be explicitly mentioned since imho it is a severe deployment >> limitation. >> In other words, if we want to deploy CPS in a subntework, then all the >> devices MUST be SAVI devices. >> >> Regards, marcelo >> > > [Guang Yao] > > > > From marcelo@it.uc3m.es Thu Jul 23 09:07:45 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8471A3A6B43 for ; Thu, 23 Jul 2009 09:07:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.582 X-Spam-Level: X-Spam-Status: No, score=-6.582 tagged_above=-999 required=5 tests=[AWL=0.017, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id slh7IGmnC+kS for ; Thu, 23 Jul 2009 09:07:44 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id 2E88B3A6856 for ; Thu, 23 Jul 2009 09:07:44 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id DC8AC657362; Thu, 23 Jul 2009 18:07:08 +0200 (CEST) Message-ID: <4A688AAC.5050501@it.uc3m.es> Date: Thu, 23 Jul 2009 18:07:08 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><001b01ca0b78$99204390$cb60cab0$@tsinghua.edu.cn><4A683776.4070809@it.uc3m.es><002201ca0b8c$15947be0$40bd73a0$@tsinghua.edu.cn><4A685F13.7010906@it.uc3m.es><4A68709F.6030201@it.uc3m.es><4A6876CB.6010107@it.uc3m.es> <4A6878C2.5060303@it.uc3m.es> <6FDB296C1F3E4D8DA1F3983ABB992EDD@userPC> In-Reply-To: <6FDB296C1F3E4D8DA1F3983ABB992EDD@userPC> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:07:45 -0000 Jun Bi escribió: > > ----- Original Message ----- From: "marcelo bagnulo braun" > > To: "Jun Bi" > Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" > ; "Guang Yao" > Sent: Thursday, July 23, 2009 10:50 PM > Subject: Re: [savi] Consensus call on "unregistered" source addresses > > > Jun Bi escribió: >> >> ----- Original Message ----- From: "marcelo bagnulo braun" >> >> To: "Jun Bi" >> Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" >> ; "Guang Yao" >> >> Sent: Thursday, July 23, 2009 10:42 PM >> Subject: Re: [savi] Consensus call on "unregistered" source addresses >> >> >>> Jun Bi escribió: >>>> >>>> ----- Original Message ----- From: "marcelo bagnulo braun" >>>> >>>> To: "Jun Bi" >>>> Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" >>>> ; "Guang Yao" >>>> >>>> Sent: Thursday, July 23, 2009 10:15 PM >>>> Subject: Re: [savi] Consensus call on "unregistered" source addresses >>>> >>>> >>>> Jun Bi escribió: >>>>> Dear Marcelo, >>>>> >>>>> When the switch reboot, the host's interface thinks it is >>>>> disconnected (no power at the cable), then the host send out >>>>> confirm when the link is up. >>>> >>>> sure, this is what i would call disconnect as you do >>>> >>>> my question is what is the difference between disconnected and >>>> physically disconnected? >>>> >>>> In addition, i guess there are at least two other problematic cases >>>> where the reboot in the savi device would result in problems: >>>> >>>> The case when the host is connected to the SAVI device through a >>>> legacy >>>> switch, in case the reboot of the savi device is invisible to the >>>> host, >>>> so it won't send any dhcp msg >>>> >>>> >>>> Please see my another reply on none-directly host. >>> >>> so basically also for the dhcp case, the cps solution is >>> incompatible with legacy switches i.e. savi and legacy devices >>> cannot be connected int he same subnetwork >>> >> >> Did you see my another reply? >> The more you deploy, the more you could anti-spoof. >> There is a deployment suggestion. > > which basically implies having different IP subnetworks, one with all > SAVI devices and the other without SAVI devices > > But it works. depends what do you mean by works....If you think that a solution that allows any attacker that connects to a savi device to sppof any address int he network works... > > My point is that the limitation applies to both the SLAAC and the dhcp > case > > > Setting up binding based on Control Packet Snooping (CPS) > provide the beinit, > and could be deployed in real enviroment,with a very low > cost (no new protocol, > no host change, etc). Please trade off the benifit and cost. > > Thanks, > Jun > > > > >> >>>> >>>> >>>> Ans besides, if we move to the wireless case, it is explicilty stated >>>> in the below rules that: >>>> >>>> o The client using a wireless technology changes access points. >>>> >>>> >>>> So, in wireless networks a reboot in the savi device would not >>>> imply any >>>> dhcp mesage, so the lost state in case of reboot in this cannot be >>>> recovered by epxecting the host will send a new dhcp msg. >>>> >>>> >>>> For the wired Ethernet case, it is no problem. >>>> >>> we haven't yet clarified the disconnected versus physically >>> disconnected issue >> >> >> I don't know how to anwer you. >> What's your point? >> > > that we should ask people who wrote the dhcp spec and people doing dhcp > implementations to give us some background on this > > > In the real test, CPS works when switch reboot, change port, > change switch. > There is a SAVI implmentation in a switch, we will demo it at > SAVI WG meeting. > > thanks, > Jun >> >> >> >>> >>> Regards, marcelo >>> >>> >>> >>>> thanks, >>>> Jun >>>> >>>> Regards, marcelo >>>> >>>> >>>>> I did see it during the test and I think you could also observe it >>>>> if you snoop the packet. >>>>> >>>>> Thanks, >>>>> Jun Bi >>>>> >>>>>>>>> >>>>>>>> [Guang Yao] >>>>>>>> See rfc3315 18.1.2 >>>>>>>> The host _MUST_ send CONFIRM when >>>>>>>> o The client reboots. >>>>>>>> >>>>>>>> o The client is physically connected to a wired connection. >>>>>>>> >>>>>>>> o The client returns from sleep mode. >>>>>>>> >>>>>>>> o The client using a wireless technology changes access >>>>>>>> points. >>>>>>>> >>>>>>>> >>>>>>>> >>>>>>> so the node is not mandated to send a confirm when the switch >>>>>>> that it is >>>>>>> connected reboots as long as it remains the same >>>>>>> >>>>>>> >>>>>>> regards, marcelo >>>>>>> >>>>>> [Guang Yao] You must be kidding. >>>>>> When the switch reboot, its ports are first turned down: then the >>>>>> client is >>>>>> disconnected; >>>>>> >>>>> >>>>> is the host _physically_ disconnected? >>>>>> then turned on: then the client will be connected to the port. >>>>>> This is the >>>>>> second case. >>>>>> >>>>>>> >>>>>>>>> Regards, marcelo >>>>> >>>>> >>>>> >>>> >>>> _______________________________________________ >>>> savi mailing list >>>> savi@ietf.org >>>> https://www.ietf.org/mailman/listinfo/savi >>>> >>>> >>>> >>>> >>> >>> >>> >> >> >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > > > From junbi@tsinghua.edu.cn Thu Jul 23 09:09:07 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E1D3C3A68B3 for ; Thu, 23 Jul 2009 09:09:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.504 X-Spam-Level: X-Spam-Status: No, score=-0.504 tagged_above=-999 required=5 tests=[AWL=-0.600, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495, J_CHICKENPOX_44=0.6, J_CHICKENPOX_83=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J4CM82u2dziK for ; Thu, 23 Jul 2009 09:09:06 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id B691C3A6B80 for ; Thu, 23 Jul 2009 09:09:04 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MU0qH-0007Yx-6p; Fri, 24 Jul 2009 00:08:25 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> <4A6888F3.5080809@it.uc3m.es> In-Reply-To: <4A6888F3.5080809@it.uc3m.es> Date: Fri, 24 Jul 2009 00:08:16 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:09:08 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" ; "Guang Yao" Sent: Thursday, July 23, 2009 11:59 PM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > Jun Bi escribió: >> >> ----- Original Message ----- From: "marcelo bagnulo braun" >> >> To: "Jun Bi" >> Cc: "SAVI Mailing List" ; "Christian Vogt" >> ; "Guang Yao" >> Sent: Thursday, July 23, 2009 10:48 PM >> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >> >> >>> Jun Bi escribió: >>>> >>>> ----- Original Message ----- From: "marcelo bagnulo braun" >>>> >>>> To: "Jun Bi" >>>> Cc: "SAVI Mailing List" ; "Christian Vogt" >>>> ; "Guang Yao" >>>> >>>> Sent: Thursday, July 23, 2009 10:20 PM >>>> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >>>> >>>> >>>> Jun Bi escribió: >>>>> >>>>> >>>>> >>>>> ----- Original Message ----- From: "marcelo bagnulo braun" >>>>> >>>>> To: "Christian Vogt" >>>>> Cc: "SAVI Mailing List" ; "Guang Yao" >>>>> >>>>> Sent: Thursday, July 23, 2009 6:07 PM >>>>> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >>>>> >>>>> >>>>> Sorry for coming back to this, but i have further comments... >>>>> >>>>> Christian Vogt escribió: >>>>>> >>>>>> CPS calls for SAVI devices to create >>>>>> bindings only for directly attached hosts, not for hosts attached via >>>>>> another switch. This is based on the assumption that the ports of >>>>>> SAVI >>>>>> devices are configured with respect to whether they connect to a host >>>>>> directly, or whether they connect to another switch. For ports >>>>>> connecting to another switch, SAVI protection is disabled. >>>>>> >>>>> I would like to come back to the level of protection achieved by this. >>>>> >>>>> Suppose you have the following topology. >>>>> >>>>> >>>>> +-------------------+ >>>>> | Internet | >>>>> +-------------------+ >>>>> | >>>>> | >>>>> +-------+ >>>>> | router| >>>>> +-------+ >>>>> | >>>>> +--------+ >>>>> |SAVICPS1|--H3 >>>>> +--------+ >>>>> | | >>>>> +----+ +---+ >>>>> | | >>>>> +-------------+ +--------+ >>>>> |Legacy Switch| |SAVICPS2| >>>>> +-------------+ +--------+ >>>>> | | >>>>> H1 H2 >>>>> >>>>> >>>>> >>>>> So suppose that as you say, the SAVICPS does create bindings for ports >>>>> connected to another switch. >>>>> >>>>> >>>>> [Jun Bi] >>>>> SAVI-CPS1 won't creat binding for trunk port. >>>> >>>> sorry, this is what i quoted above and that is what i meant... (i guess >>>> i was too concentrated in the ascii and disregarded the actual text) >>>> >>>>> >>>>> So, how do we prevent H1 from spoofing H2 address when is sending >>>>> packets to H3 (or to any host in the rest of the internet in the >>>>> picture >>>>> above)? >>>>> >>>>> >>>>> I mean, i understnad that the main idea in CPS is that there is >>>>> perimeter defense, so all the borders need to provide protection. >>>>> I understand that in order to actually provide the protection, the >>>>> SAVICPS1 device must create bindings for hosts connected behind the >>>>> legacy switch, or am i missing something? >>>>> >>>>> [Jun Bi] >>>>> Dear Marcelo, >>>>> Thank you for the question. >>>>> CPS only validate the source address of SAVI deployment area (SAVI >>>>> area) (for hosts directly attached to SAVI >>>>> switches). The goal is to make the hosts in SAVI area (H1 and H3 in >>>>> your picture) won't spoof. >>>> >>>> >>>>> >>>>> If the admistrator really want more benifit, we have a deployment >>>>> suggestion. >>>>> The network adminstrator knows which is SAVI-switch, which is >>>>> non-SAVI-swtich. >>>>> Then he can configure two VLANs, one for SAVI area, other for >>>>> non-SAVI area, >>>>> then assign differnt address space (prefixes) for two differnet >>>>> areas. >>>>> The layer 3 device will do the ingress filtering then H1 can't use >>>>> H2's source address. >>>>> >>>> >>>> so, basically you mean that in order to get SAVI protection _all_ the >>>> devices in the same IP subnetwork MUST use SAVI devices and you cannot >>>> have legacy devices. >>>> >>>> Hi, I don't want to use the word "protect", it should be >>>> "anti-spoof". >>>> SAVI-CPS could anti-spoof in SAVI-area, not none-SAVI area. >>>> If you deploy _all_ SAVI-CPS switch, then you anti-spoof for >>>> _all_ host. >>>> If you deploy some of them, then you anti-spoof for some host >>>> attched to the new SAVI-switch. >>> >>> but this is misleading >>> I mean, as if you see in the figure i sketched above, the host that is >>> connected in the legacy switch can spoof the address of _any_ host even >>> those that are connected to a SAVI device. >> >> (1)The SAVI swtich could prevent the hosts directly attched to >> spoof another address, >> This is a benifit. >> (2)SAVI validate the source address, it doesn't protect the >> detination,that's why I sugesst >> you don't use the word "protect".Any host under legency >> switch could still spoof the source address, it's acceptable, >> because you didn't deploy new technology. > well, you could achieve better security if you used another approach Please let us know the approach with better security. In my option, FCFS will lower the security. In CPS, the host under SAVI-swtich can't spoof. it's reasonable, predictable, and dependable. In FCFS,even the host user SAVI-switch can STILL spoof, it's NOT predictable, and dependable. Will you call FCFS brings better security? > >> >> You get some benifit in the deployment area, when you deploy >> all switch, then you get the highest security >> level, it's reasonable. >> Please note in FCFS, even the host directly attached to >> SAVI-FCFS-switch could still spoof source address. > how come? > > >> >> (3)Even the hosts under legacy switch won't need to be >> validated, we still proposed a deployment >> suggestion to to VLAN stated in my past email. At that >> case, H1 could not use H2's source >> Address. >> > as i mentioned before, you can call it a deployment suggestion but what it > really is is a mean to have all the devices in the subnetwork to be SAVI > devices, which is the way to comply with the limitation imposed by the CPS > savi It's very easy and CLEAR for a operator to divide SAVI area and non-SAVI area. > >>> >>> So if you have a network that is using some CPS SAVI devices and some >>> legacy switches, an attacker connected to a legacy device can spoof any >>> address in the network. >> >> Please see above.Sice you did't deploy, why you ask the >> benifit of anti-spoofing. > > I am not sure what do you mean by this, but again, if you have a legacy > device in the same subnetwork, an attacker connected to the legacy device > can spoof any address of the subnetwrok under SAVI CPS I meant, if you delpoy a SAVI swtich, then you prevent the host under this SAVI switch to spoof. Othewise,you could prevent it, it's reasonable, predictable, and dependable. Again, there is NO FREE LUCH. >> >>> >>> So when a host is connected to a SAVI device this doesn't mean that its >>> address is protected and no attacker can spoof it, but what it means is >>> that the host cannot spoof any other address of another host that is >>> also connected to a savi device (this assuming that the DAD packets are >>> widely distributed, which may not be the case, but this is a different >>> story) >>> >>> so i think the protection resulting from the solution is fairly weak. >> >> In the deployment suggestion by using VLAN, the attcker >> under legacy switch >> can't spoof the src of host under SAVI switch. >> So it's not weak. >> > Again, you can call it as you wish, but the fact is that SAVI CPS requires > that all switches in the subnetwrok implement SAVI CPS because if not an > attacker connected to the legacy switch can spoof any address > > Regards, marcelo > > >>> >>> Regards, marcelo >>> >>>> I think it's reasonable. The more SAVI-switch you deploy, the >>>> more host you anti-spoof. >>>> There is no free luch. >>>> >>>> >>>> This must be explicitly mentioned since imho it is a severe deployment >>>> limitation. >>>> >>>> Hi, we mentioned it, that's why Christian also methion it at >>>> the email above. >>>> >>> >>> >>> >>> >>>> In other words, if we want to deploy CPS in a subntework, then all the >>>> devices MUST be SAVI devices. >>>> >>>> Not "MUST", did you see you reply? >>>> >>>> >>>> >>>> >>>> >>>> Regards, marcelo >>>> >>>>> Best Regards, >>>>> Jun Bi >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>>> >>>> >>>> _______________________________________________ >>>> savi mailing list >>>> savi@ietf.org >>>> https://www.ietf.org/mailman/listinfo/savi >>>> >>>> >>>> >>>> >>> >>> >>> >> >> >> > > > From junbi@cernet.edu.cn Thu Jul 23 09:23:58 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 667713A6856 for ; Thu, 23 Jul 2009 09:23:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.883 X-Spam-Level: X-Spam-Status: No, score=0.883 tagged_above=-999 required=5 tests=[AWL=-0.414, BAYES_00=-2.599, FH_HAS_XAIMC=2.696, J_CHICKENPOX_44=0.6, J_CHICKENPOX_83=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BvjNe2FOMwaf for ; Thu, 23 Jul 2009 09:23:57 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id D2F583A6783 for ; Thu, 23 Jul 2009 09:23:45 -0700 (PDT) Received: from userPC([59.66.24.40]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm104a68d458; Fri, 24 Jul 2009 00:19:38 +0800 Message-ID: <5326B631613E41B78D8F50A449CCBEB0@userPC> From: "Jun Bi" To: "marcelo bagnulo braun" , "Guang Yao" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <4A688A47.2010209@it.uc3m.es> In-Reply-To: <4A688A47.2010209@it.uc3m.es> Date: Fri, 24 Jul 2009 00:19:09 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: GgIBB4WB Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:23:58 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Guang Yao" Cc: "'Jun Bi'" ; "'SAVI Mailing List'" ; "'Christian Vogt'" Sent: Friday, July 24, 2009 12:05 AM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > Guang Yao escribió: >>> so, basically you mean that in order to get SAVI protection _all_ the >>> devices in the same IP subnetwork MUST use SAVI devices and you cannot >>> have legacy devices. >>> >> [Guang Yao] We never mean it is a MUST. It is just a suggestion for >> deployment. >> > >> With partly deployment, CPS still works well, especially on filtering >> spoofing from directly connected hosts. >> > you mean that SAVI CPS only protects against atttacker connected to a SAVI > device, If the attacker connects to a legacy switch, it can then sppof any > address of any host in the netwrok, even if the target host is connected > directly to a SAVI device. > > You can call this that it works well, i guess it is a matter of opinions, > i wouldn't call it that way. > But i guess we need to agree that we disagree and let the WG to decide if > this is acceptable or not You don't need to repeat it in any email. As you see in my last eamil, my answer is: (1)In CPS, if you delpoy a SAVI swtich, then you prevent the host under this SAVI switch to spoof. Othewise,you could not prevent it, it's reasonable, predictable, and dependable. The more you deploy, the more host can't spoof, it's reasonable. There is NO FREE LUCH. (2) In CPS, the host under SAVI-swtich can't spoof (strictly). it's reasonable, predictable, and dependable. In FCFS,even the host user SAVI-switch can STILL spoof, it's NOT predictable, and dependable. Will you call FCFS brings better security? (3) When deployment, it's very easy and CLEAR for a operator to divide SAVI area and non-SAVI area. Then the attacking case you mentioned won't happen. (4) Please give me a better design. > >> On filtering spoofing packet from trunk port, > i am not sure what do you mean by this > >> IMO, CPS chooses the most >> secure and effective way that only check whether conflict local bindings. >> I know some mechanism would set up bindings on trunk port, but then a >> _BDP_ >> must be designed to >> clear overdue bindings on the trunk port. Or else, there will be a lot of >> other problems: memory cost, >> dropping of legal packets, full binding table... >> >> CPS at least makes sure every existing binding is valid without a BDP. >> > how is mobility supported for instance? > >> FCFS actually make use of "likely" valid bindings to filter packets, >> because >> every binding may have been overdue. >> >> > what do you mean by overdue? > >> If you think that is not enough, >> OK, please design a SAVI solution that can protect _all_ the IP address >> in >> the >> > > the point is that protecting an unused address i by far less imporntat > than protecting an actually used address, especially in SLAAC. > the only differenc ebetween an used and an unused address is a DAD NSOL, > so there is not much gain protecting an unused address in SLAAC Did you really realize the problems of FCFS ? thanks, Jun > > there is however, a lot of benefit in protecting an address that is > currently being used by a host > > regards, marcelo > >> IP subnetwork with only _partly_ deployment and _without_ modify current >> protocols. >> I think you may find it is impossible. >> >>> This must be explicitly mentioned since imho it is a severe deployment >>> limitation. >>> In other words, if we want to deploy CPS in a subntework, then all the >>> devices MUST be SAVI devices. >>> >>> Regards, marcelo >>> >> >> [Guang Yao] >> >> >> > > From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 09:33:57 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E8A4A3A6849 for ; Thu, 23 Jul 2009 09:33:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.437 X-Spam-Level: X-Spam-Status: No, score=-2.437 tagged_above=-999 required=5 tests=[AWL=0.163, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id mv6AHg0Wl8rQ for ; Thu, 23 Jul 2009 09:33:57 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id AC08E3A6B0C for ; Thu, 23 Jul 2009 09:33:39 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MU1DX-0007qp-Qv; Fri, 24 Jul 2009 00:32:27 +0800 From: "Guang Yao" To: "'marcelo bagnulo braun'" , "'Jun Bi'" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <720C8A3E452D49CD8DA2221E6818EDD8@userPC> <4A688CF4.7080102@it.uc3m.es> In-Reply-To: <4A688CF4.7080102@it.uc3m.es> Date: Fri, 24 Jul 2009 00:32:27 +0800 Message-ID: <001e01ca0bb3$2a600db0$7f202910$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLsP2UKsNkuX4ETTWQUI3n39rAHgAAFeQw Content-Language: zh-cn Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:33:58 -0000 I want to summary my personal view on FCFS here: [Guang Yao] 1 The first weakness point is logic error. As we know, FCFS currently uses the following logic: "Bind the address if it is first ever appear on the switch, and drop the packet with address conflicting current bindings." And FCFS_with_BDP uses the following logic: "Bind the address if it is first ever appear on all the SAVI switches on the link, and drop the packet with address conflicting any the current binding on all the SAVI switches." The problem is, whether it is reasonable and sufficient to set up bindings when one address is first ever appear on one or any of the SAVI device? In a SLAAC only network, an implicit rule is that if a host uses an address first, it has the right to hold this address and ask others not to use the address. In another word, a reasonable binding is set up based on the clear knowledge that the sender is the _first_ to use the address on the link. However, both FCFS and FCFS with BDP fail to be compatible with this rule, though it is not obvious. FCFS actually takes "first appear on one of the FCFS device" as "first used in the local link". Unfortunately, they are not equivalent. For example, host H may be the first to use an address ADDR, but without sending any packet to pass any of the FCFS devices, thus no binding will be set up for it. Then, another host has the chance to trigger a binding of ADDR. This binding will cause dropping of legal packets from H. The wrong design principle of FCFS results in a lot of potential problems. 2 The failure model in DHCP only scenario Recently FCFS is declared to support DHCP, except for no protection for unused address. The first problem is that whether it is reasonable not to protect unused addresses in DHCP only model. It is clear in a lot of DHCP only scenarios, to allow other kinds of addresses will cause management problem. Another problem is, since DHCP is the only used address assignment method, why not choose a more stable and simple solution based on DHCPv6 snooping just as DHCPv4 snooping, but choose an untested and potentially dangerous solution? What's the benefit? And a more serious problem is FCFS model will give chance to attackers to trigger evil bindings to filter legal traffic. Because DHCPv6 server would be likely to assign to a host the same address (Also an attacker may has the chance to know the assigned address before the host if it is in the middle of the victim and DHCPv6 server), an attacker has the chance to trigger that address binding first. When a host gets a REPLY from DHCPv6 server, it performs DAD but the attacker doesn't reply. Then once the victim sends packets, these packets will be discarded by FCFS. 3 About BDP FCFS relies on a BDP to sync all the FCFS devices in order to make it work "more correctly". (See section 1 to find why FCFS will never work real correctly). BDP has been regarded as a bad idea by a lot of people. Here just to list some of the defects of BDP. 1. Violate charter. 2. Heavy cost. 3. Incrementally deployment problem. 4. Secure problem on authentication between SAVI devices. 5. Real time problem. 6. Reliable problem. 7. Economic problem. Recently, there is a trend to use DAD as BDP. However, we don't think the above problems are really solved if DAD is modified to have the function of BDP. 4 The problem of clearing binding FCFS doesn't have specified design of when and how to remove a binding. This problem is same important as the problem of setting up binding. No binding clear mechanism will surely make the binding table full and no new binding can be set up after a time. However, it is hard for FCFS to design a binding clearing mechanism. We think this problem is due to FCFS sets up binding without regarding the packet is from directly connected hosts or not directly connected hosts. If a not directly connected host is disconnected from a switch, the FCFS switch receives no signal and cannot drop the corresponding binding. Though a BDP can make things better, the problem returns to the problem of designing a _useable_ BDP. 5 Binding lost problem FCFS has declared its robustness when binding lost. However, I don't think it is reasonable. Whenever a FCFS device reboot, an attacker can easily set up bindings of all other addresses on the reboot device before any other hosts. Then all other hosts will be blocked from network. Although FCFS can learn bindings from data traffic, the problem is, it may not learn correct bindings. 6 Filtering cost The filtering cost is rarely high for FCFS. 6.1. It will take every data packet into CPU 6.2 It must go through a long "deny" list to make sure whether a packet should be forwarded. IMO, I don't agree to move forward with FCFS. From junbi@tsinghua.edu.cn Thu Jul 23 09:35:45 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 41DBD3A6B80 for ; Thu, 23 Jul 2009 09:35:45 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.718 X-Spam-Level: X-Spam-Status: No, score=-0.718 tagged_above=-999 required=5 tests=[AWL=-0.214, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495, J_CHICKENPOX_44=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id WYAj3RvDDLqX for ; Thu, 23 Jul 2009 09:35:44 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 1BD903A6B07 for ; Thu, 23 Jul 2009 09:35:44 -0700 (PDT) Received: from th024040.ip.tsinghua.edu.cn ([59.66.24.40] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MU1Ft-0003Dr-Fd; Fri, 24 Jul 2009 00:34:53 +0800 Message-ID: <57495216533B4936BD4F4AD92E6BDD30@userPC> From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> <4A6888F3.5080809@it.uc3m.es> <4A688DDF.6080105@it.uc3m.es> In-Reply-To: <4A688DDF.6080105@it.uc3m.es> Date: Fri, 24 Jul 2009 00:34:45 +0800 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:35:45 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" ; "Guang Yao" Sent: Friday, July 24, 2009 12:20 AM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > Jun Bi escribió: >>>> >>> well, you could achieve better security if you used another approach >> >> >> >> Please let us know the approach with better security. >> In my option, FCFS will lower the security. >> In CPS, the host under SAVI-swtich can't spoof. it's >> reasonable, predictable, and dependable. >> In FCFS,even the host user SAVI-switch can STILL spoof, it's >> NOT predictable, and dependable. Will you call FCFS brings better >> security? > how is that? > ... Did you really didn't realize that FCFS will permit the host directly under SAVI swtich spoof? Please read the msg from Eric on "not fixing the inaccuracy of our binding table". I think FCFS is A2. ----- Original Message ----- From: "Eric Levy-Abegnoli" To: "Christian Vogt" Cc: "SAVI Mailing List" Sent: Thursday, July 23, 2009 4:25 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses >>> (A) In networks where SLAAC is permitted for address configuration, how >>> should a SAVI device treat packets with a source address for which >>> neither a successful DAD procedure nor a DHCP assignment was seen? >>> >>> (A1) Discard the packet >>> (A2) Forward and optionally log the packet >>> >> >> [..] All devices are not equal (hardware/software wise, but also >> deployment-wise), so would be acceptable to habe those which can't >> verifyi the assumptions to not drop/log in my opinion. > > Eric, are you saying that you prefer (A2) without logging? Christian , in the current state of the proposals, I am against both A1 and A2. A2 is the worse though, because it's "politically correct": it does not break anything and provides "on the paper" all the tools to further investigate anomalies. In reality, logging in the data path is not safe, not reliable (must be rate-limited), and prone to attacks. Logging it a useful and necessary tool, not a solution in itself. We should not use it as an excuse for not fixing the inaccuracy of our binding table. As far as the "optional log", if we forward and don't log, what have we accomplished? Isn't it what current non-savi devices do today? >>> From junbi@cernet.edu.cn Thu Jul 23 09:40:13 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1CEAE28C0E3 for ; Thu, 23 Jul 2009 09:40:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0c3b+SLXXMP7 for ; Thu, 23 Jul 2009 09:40:13 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 9970E3A67B3 for ; Thu, 23 Jul 2009 09:40:10 -0700 (PDT) Received: from userPC([59.66.24.40]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm104a68d8d2; Fri, 24 Jul 2009 00:38:47 +0800 Message-ID: <3E9C65CB8925400B95B10362DF5B8055@userPC> From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <720C8A3E452D49CD8DA2221E6818EDD8@userPC> <4A688CF4.7080102@it.uc3m.es> In-Reply-To: <4A688CF4.7080102@it.uc3m.es> Date: Fri, 24 Jul 2009 00:38:09 +0800 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_07C3_01CA0BF7.04650F40" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: GifTB4WB Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:40:13 -0000 ÕâÊÇ MIME ¸ñʽµÄ¶à·½Óʼþ¡£ ------=_NextPart_000_07C3_01CA0BF7.04650F40 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "Guang Yao" ; "'SAVI Mailing List'" ; "'Christian Vogt'" Sent: Friday, July 24, 2009 12:16 AM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > Jun Bi escribió: >> >> Hi Marcelo, >> >> By reading all you emails, I think you also recognize the benifit of CPS. >> Yes, you may ask more benifit, but please trade off the cost and the >> benifit. >> CPS is really a low cost solution and be implemented in switch and >> tested. To recognize the benifit, >> the WG at least could made some progress (having a solution works in some >> situation). >> It doesn't mean CPS prevent other new technology. You could continute you >> work, but at >> least now we did see FCFS has much more problems. > I simply fail to see how you conclude that. > > Let's consider CPS for SLAAC > > The main problem with CPS is that it hard-codes underlying assumption in > the network architecture. What do i mean by this? Well, basically, CPS > assumes that in order to allow a host to send packets, it must have been a > prior DAD. While this is common, it is not required by the current IPv6 > architecture. But CPs hardcodes it in SAVI. The result is that the fate > sharing domain of the node is significantly increased. If the SAVI device > looses state, then the host is blocked. If the DAD packet is lost, the > host is blocked. The result is a significantly less robust network > architecture. > > I simply believe that is not a good tradeoff. > > then we can go to more practical issues. > > The CPS solution requires manual configuration of the ports (whehter they > are connected to a SAVI device, a host or a legacy switch) > IIt doesn't protect from attackers connected to a legacy device from > spoofing any address in the subnetwork, even if the target host is > connected to a SAVI device. this means that either all the devices of the > network are SAVI devices or that significant attacks are possible. Hi Marcelo, Finally, I am happy that now you come back the technical questions, not keep arguing. Is the above two questons are what you concern on CPS ? The attached file is CPS-01. Please read and I think you questions are anwered. The testing for an implemention in a switch also shows it works and we will have a demo at IETF75. The let the operator configure the switch port is also reason. The operator could have the right to decide which port is for host,which port is for trunk, which port is for HDCPv6 server, etc. For port enabled binding, the port anti-spoofing. Otherwise, it doesn't. We should provide the flexibility for users to configable. Indeed we have implemented it. You could see the swtich at IETF 75. For the ND loss, I think we discussed many times. (1) We did a lot of test with our switch impemented CPS, we never found the ND loss. (2) In IPv4, it requrie 3 redundent. In IPv6, it's configable. it's one of the possible way to fix it to ND packet redundent. Best Regards, Jun ------=_NextPart_000_07C3_01CA0BF7.04650F40 Content-Type: application/pdf; name="CPS01.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="CPS01.pdf" JVBERi0xLjUNCiW1tbW1DQoxIDAgb2JqDQo8PC9UeXBlL0NhdGFsb2cvUGFnZXMgMiAwIFIvTGFu Zyh6aC1DTikgL1N0cnVjdFRyZWVSb290IDExNSAwIFIvTWFya0luZm88PC9NYXJrZWQgdHJ1ZT4+ Pj4NCmVuZG9iag0KMiAwIG9iag0KPDwvVHlwZS9QYWdlcy9Db3VudCAyMy9LaWRzWyAzIDAgUiAx MiAwIFIgNTMgMCBSIDcyIDAgUiA3NCAwIFIgNzYgMCBSIDgwIDAgUiA4MiAwIFIgODQgMCBSIDg2 IDAgUiA4OCAwIFIgOTAgMCBSIDkyIDAgUiA5NCAwIFIgOTYgMCBSIDk4IDAgUiAxMDAgMCBSIDEw MiAwIFIgMTA0IDAgUiAxMDYgMCBSIDEwOCAwIFIgMTEwIDAgUiAxMTIgMCBSXSA+Pg0KZW5kb2Jq DQozIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9G MSA1IDAgUi9GMiA3IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJ XSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9Db250ZW50cyA0IDAgUi9Hcm91cDw8L1R5cGUv R3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMg MD4+DQplbmRvYmoNCjQgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTkxOD4+ DQpzdHJlYW0NCniclVlbT9tIFH5H4j+M+gQr6tjje1VVIgEq0LZCJburVenDxJmQWRI7ssdA/v2e M85lJmFsVxXFhO+cOff5jhlcllLMWCbJ58+DSylZNudT8nMwLla/BuP1ig/u2ZPImRRF/uULGV6N yHB8ejK48YhHyXh2euIRF/55xI9I7LmOn5Dx8vTEJU/439fTk59n5PwXGd+dnlyDIAprElGabCXa cUm0xz1c/n1rgUaBk9DAhNvU0iRx3LAfNnABG5vYO4cMxQWBb//UF+SrQ/5lhUU8DKkD4ep1FHob B3vcbS55mXNJrko2kxYhz4/AcVOwy+8+2BD8Tk3o6PrH9+txh6N9dKOjETUdzadQfZVksq4+2eS8 MHECaso+SJZPWTkl45Jlz5XN8yhygtCU7IpSH2yQBs4B9AaKgz3zsiNOfbRjnEJ3j7t+W4mSt8TH dVUt6DJXPOPLCS8Jdd3UJgdeYHR0ua7o9MGGXuR4JnQkqszWK+iu32MqbE3ogw2gZA6gd/ViTSi9 aIvINkt9jkCz6W9MnT5Y1OlZOolcfxuRgWV6Dwspi2XbANeO8GBq0x6mwKjuA4MZ1wcGE2IHGwrr +HECA2mNqus5UWhAN21ilQhTh5oSuyaxWU0DvAR0ESggGzgInegAbK80H3BB3MvVZtjoyJ+QYW7t Pj92YmrgPRs0CJzUhP5q74w+9qrGeB+mapgM7rF6v41ur4g7+JPlT+SM5x//ejh/r1zdSN3Dbo+5 6cUU52CY6oOnyGVZLKxF4bs4Ag2Re7hQ4PZ9yItiJcC49nwbokMbFqKXHGBZBZ07FPkUzrBl3k8d 35SyOuKl2A9hrE2uaQt/oGF4hP9ovUXB+gPsxNbBNI6xzfopTtQFZGAr9mJT7Xu+Q+N+qn3qYn8Z 2Gxl4wl+QLHK+mkO0iMrXGveoyMrbM3oR76qJx3ryDdbAv2UHqnWi0M1BCmBlEM/hlBIabgljdDH JT89mf1x1LchxMEP93xe8SygZqSYETkXFfnGl7ZrfNt9exUtDCF24DAv2SPHqH3LfK080HMoNeVs WdpwRgOr+DSBc6p6shRSQv/Jgtxej2+IyMmsXixIVuSzolyyPOPkVch5uwMwm3bK5ZyTVVm8iAru XRWw4eiexAkBnto8pk7HPWPoaz05SLQgd0XNCzFqhog1apRi1AysilpFWAkRKcpnnIjTIquXPJeb uuC7xJHrHKgH52XL3GwciF0t98wChYpyYbkzwNUzuSlKSM/jGWbu8fyCiMY8Vl2oYOOPW0ufyqJe VQ4h3wvJwVQm280KtXIpwLNyo4Es2ZqwRVWQqahkKSa1fC8crLOGQzdwPPMcWzIai4LoMBWOdQ0A oklNiXZv6e9XEf2NKqLvV5G6lrSgvbCFmBJoO8IgzG9iWS+xrirx1m49vnvwN+qXcM3PK5V+zNSE k3o1ZdDhFzDqVguW4ROcUEyqYsGx8ydr0iTYdvdCD4TmIXuT2+zy8Q3HVgTqjeVrIsWSQxHequkD 3HwFk2JVCoY1WZC64l1lg3bAtDd028IfeEAATeg2+h2W49uKrUjJZ7zkOAeXYCbYusD4gbWZUJ3E l5v4QVPlqPkDtgMOUvDtCXh45Xyw0s7Y8al5XLthuDX7u5uCkwU0IdZIVpdgo+yK3ob6G2rsZEe9 MjCwm/Bl4ChUFssy8A5KiFmzBS14oKLdv1CrsrmUq0+DwevrqyO4nDlF+TTAh4Enph3+6Wq6/NOx bAIzDZbKqo1vRC7eUYZcu1M0ej9pm2S1v5QwpK15bZZAA2v1G6ZjcoBtCMHDnE2LV3IFy2Mmi1Lw 38g08osDpe1Bwe2+LdOVMsaZy+XCSppd5YiuqXXH8rp2LGUZTV09Xb3ZmCHXwcYMbBP8VwGsi6vN nRS5lSC5KXJjQ/6O5TUr1+3lakjYF9YYGb2BbdnzkwR3uX6a0+jICiha27oQAA9MTbTtsg982Mf7 uqeafgsbFat1KZ7mVia04RG6DLAnkVk7dlMIGr61ByhuCEfGPJ5lj+cdb4B1ybb3molaQXW0VXEz bXSo2gfGZV1JRScUr+dlhaReTOGyETOBE6FSv2n103d3SrfUgbBazosSGOkl1L3yvAKGUvHyhU9t ufZ9T9Wnpq/9YHefCdXJu9Ob3ec/nh2ID27o4V93KPVVEPe6PrtuGLuu6zffQ9o80xC+Inj0m5+9 S/gaNs9BADgPvmtyAfwuSDayI/iCZx8+h1pWn+FzCDpD+DyMGplh1DwrmZtGPrhs9Ac3+PmXQ4eO /lylQoP53obmfr+t/eALJpHKb/fBqy6qt8mJrg+oD5/N4A7BQYbFgQQUL7y2XHnJvvJW9WQhMvXi drdw71LXfp3rah63F4vEIuZ8f7mAdp5Xtj4OYFilhibrZqKWGB0pYG1+PLcuuI2r8b5+7xewrnGo /BfBXzFY8MOeXmewJuA6vr7Y9NmaTHmVwdrFybqorZy9OQZ3qy2JbRoM+xiaDPa2DINrfYUW4Yt6 Xb5qXgKA7ArzCtVhJMU6nBX/0xW1zGbP35fQ5YaIWdCp70SwD+sSRzf//xBxlm0NCmVuZHN0cmVh bQ0KZW5kb2JqDQo1IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0Yx L0Jhc2VGb250L0FCQ0RFRStDb3VyaWVyIzIwTmV3L0VuY29kaW5nL1dpbkFuc2lFbmNvZGluZy9G b250RGVzY3JpcHRvciA2IDAgUi9GaXJzdENoYXIgMzIvTGFzdENoYXIgMTIyL1dpZHRocyA1NTQg MCBSPj4NCmVuZG9iag0KNiAwIG9iag0KPDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9B QkNERUUrQ291cmllciMyME5ldy9GbGFncyAzMi9JdGFsaWNBbmdsZSAwL0FzY2VudCA4MzMvRGVz Y2VudCAtMTg4L0NhcEhlaWdodCA2MTMvQXZnV2lkdGggNjAwL01heFdpZHRoIDc0NC9Gb250V2Vp Z2h0IDQwMC9YSGVpZ2h0IDI1MC9TdGVtViA2MC9Gb250QkJveFsgLTEyMiAtMTg4IDYyMyA2MTNd IC9Gb250RmlsZTIgNTU1IDAgUj4+DQplbmRvYmoNCjcgMCBvYmoNCjw8L1R5cGUvRm9udC9TdWJ0 eXBlL1R5cGUwL0Jhc2VGb250L0FCQ0RFRStDb3VyaWVyIzIwTmV3L0VuY29kaW5nL0lkZW50aXR5 LUgvRGVzY2VuZGFudEZvbnRzIDggMCBSL1RvVW5pY29kZSA1NTYgMCBSPj4NCmVuZG9iag0KOCAw IG9iag0KWyA5IDAgUl0gDQplbmRvYmoNCjkgMCBvYmoNCjw8L0Jhc2VGb250L0FCQ0RFRStDb3Vy aWVyIzIwTmV3L1N1YnR5cGUvQ0lERm9udFR5cGUyL1R5cGUvRm9udC9DSURUb0dJRE1hcC9JZGVu dGl0eS9EVyAxMDAwL0NJRFN5c3RlbUluZm8gMTAgMCBSL0ZvbnREZXNjcmlwdG9yIDExIDAgUi9X IDU1OCAwIFI+Pg0KZW5kb2JqDQoxMCAwIG9iag0KPDwvT3JkZXJpbmcoSWRlbnRpdHkpIC9SZWdp c3RyeShBZG9iZSkgL1N1cHBsZW1lbnQgMD4+DQplbmRvYmoNCjExIDAgb2JqDQo8PC9UeXBlL0Zv bnREZXNjcmlwdG9yL0ZvbnROYW1lL0FCQ0RFRStDb3VyaWVyIzIwTmV3L0ZsYWdzIDMyL0l0YWxp Y0FuZ2xlIDAvQXNjZW50IDgzMy9EZXNjZW50IC0xODgvQ2FwSGVpZ2h0IDYxMy9BdmdXaWR0aCA2 MDAvTWF4V2lkdGggNzQ0L0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUwL1N0ZW1WIDYwL0ZvbnRC Qm94WyAtMTIyIC0xODggNjIzIDYxM10gL0ZvbnRGaWxlMiA1NTcgMCBSPj4NCmVuZG9iag0KMTIg MCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUg MCBSL0YyIDcgMCBSL0YzIDE1IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMv SW1hZ2VJXSA+Pi9Bbm5vdHNbIDE0IDAgUiAxNyAwIFIgMTggMCBSIDE5IDAgUiAyMCAwIFIgMjEg MCBSIDIyIDAgUiAyMyAwIFIgMjQgMCBSIDI1IDAgUiAyNiAwIFIgMjcgMCBSIDI4IDAgUiAyOSAw IFIgMzAgMCBSIDMxIDAgUiAzMiAwIFIgMzMgMCBSIDM0IDAgUiAzNSAwIFIgMzYgMCBSIDM3IDAg UiAzOCAwIFIgMzkgMCBSIDQwIDAgUiA0MSAwIFIgNDIgMCBSIDQzIDAgUiA0NCAwIFIgNDUgMCBS IDQ2IDAgUiA0NyAwIFIgNDggMCBSIDQ5IDAgUiA1MCAwIFIgNTEgMCBSIDUyIDAgUl0gL01lZGlh Qm94WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDEzIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9U cmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgMT4+DQplbmRv YmoNCjEzIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDI3MDk+Pg0Kc3RyZWFt DQp4nK1cbW/jNhL+HiD/gR+zh1aWKOrFwGKBvOxes2jujLV79yHdD4pCJ8I6kiHLSfd+/ZGSnMw4 GlIi2gIFtp15SD/PcGb4os7O66ZYZ3nDPn6cnTdNlj/Ke3Y7W1Xb77PVz62cLbKHosyaoio/fWIX V5fsYnV6MvsSsICz1fr0JGC++jtgYcySwPfClK2eTk989qD/8c/Tk9uz67KRdSmbD9/Z6uvpyWfl rzEOjvPQi7mAzrdnvxK2ge97Kce2V3W2prCDMH5nzyjbSLyzvazKpq42bJHlP2TDlmVVbYvygV1k O0XTRVHeqz8ReIIHXjhuaMFTLxppmibHqF/3m5+EdRTEXjAOOOLhMTD3/TllHXEvGElslHgxi+fp sCX7fHPJZkQYXlRNUz2ZIhGEX6Amw22TUXZqJmPM0vjN7KKgfpvvCWRJAXI/8OIImX7+a1vUckd6 RHOPY4+vWbnPakrs0J97cTJqNqGKixSbcv4LZRymnhiJK6LjKagf7lPWiRgLLObCw1zcqnCQZMiF iZdwPA/KVAhvjk2/m4N+zHzbmFc/b9CwDXk2W+hgv7m8vmL+7PdMZZUzWf76x/LDQHR3S0jhvS6h 1WOxY/dVvn+SZcN2W5kX60LuqFhSi1vFEkIg4y5UMX1k2zxKRuXCP88uF8s/P7AnmT9mZbF7MueB mL/BrquaXS/Ys6x3alUzwbLyHv6L2GPt73yDVn/Y69TbVGynJrHfmgeLQHq667I1u5PNi5TlsePs Cz8uaUHCdUWAKB99/yL8dOz5rhgGqe/5ER4/2zePVV38T97bR+Yq0o789cjCPnKfNdDIpNJx3CoN bXfVvs6lFiG7v1fZaceqNXusdk2rjZHsEGT4vKqV87bqKM/K/LGiyq5a2XoS0LtmSnwdc1me6ymo 5uGlqn+we/lc5PIXVpT5Zt8i716KJn80z4vHQAT1I15U1t1o2B59WxVloyNNsj5G1H+q5WugbWWt AvWJ9dQYxwrAojkQ+Jxtivu2bumftW2Xz06Fr1q3dz9bbj2yCiUeTzCqoWJFcyDkKrvbSC2eXrdq LCo1BJHK7hz7GpNVMCpZRSq2wmgMHu8h2smwWvWNHUAUePNIdXyp57fro5anJ+t/vAIst1n5ihGO m5Pq8Po5tf3p7VngsWud1e73udaHoihWVY1D99szz/IXpdI89vzECkWWNa5rFfIOTdwKipfZl1BR 60UxSh6R8HWBQ/hG7SJCu3CutWtzUWLTLqbn+C67deiCH8nIPR3lzyrKlYh9hSh0BgE10twJAUyb thZtIJBRm8RNG4g/oA2iNp1Mrar9b7Onfqoqi77asSFjKi0lKgSObVeyfirKalM9UK3sISlBL9cV l6atwDYoi6yIGJOsczdZKS6HZA3IfpHUNUjf4IVNV2hs0xXa3ry2af9WHdxzIV/IzZDSJMLOjvIK lWpCA5JFVuhnlDUgy55ZV4rLQV35ZF19UGUjm64+UZKHdIW23+Qma1RKXdRVU+XVhtxldHtc5Oss q9pqmZAsukJHYdSVbB3MulJcDupqKMPDuurt7it8bNEVGVt0RbZXcl2URdeYrtm5btJr8wYSubtK G4VeQiKZdUVekVHXyElXkstBXSe3LiIF1Tux6ZoSpX5IV2ireqFcbpt9tmFXWZOxZVOr/nZf08cD 3UYQgbiqqxrc+QCSRVdoHxt1dWubSC4HdZ3cN4kElO/UY8tcllldVOSmSwi9q0FujoT3h2gjoCwS QIDEKIFbi4MGsEnAp7Q4hzUQpVAEtbdbdqcDu14NS26L/oZupMttBJJFAOhlFIC79SJoAKsAU3qR /lpGiBgLoCRYVHXDzpumLu72DZ2AulMrBOAqQTrXErxHsrCP5m5k361jQANY2Z/SMQSc682SCMUx +3oJnP/nmiJdbX39CPtRF2+HNQJtf9Ongq/SUumJC33ggRxdZD3IhH6kUSbHBiCc0ADwKQ3AQSbO j2Xio2SCfjaZoO3Vb5cLctnx8dD9EoW2q3o/JgS6U0zk6SY+os4ovmOXwCd0CXxKl3AQX9+Xhkj8 cJT40M8mPrT9dk7e8iR6rzYOWHUr6ZHtSOlVgKUJ9nRd+Yg6o/iO/QkcwCZ+OKU/6cUP9RU4Fl+M ER/5WcRHtkqj8gcjIyAJdQQgD5ucYaBXMnJxz+UIZm5SNHRreNAAVkWnNDx9xxmmMVRU5fH/Hu6W lpaes1t+CMBYFmk2RaxiiUCyCAB9zAK49TxoAKsAk09J9Nbnbf6W3TQytuymke2iluviL33BsC4e 9nVmuCg6LELo7qpqu5OgkCy6Il6Muro1SSSXg7pOPiUJ9RuBA7yahEUsaE0JqwJRHNv2z7fYUjbs jy21U0+TVlLo6CppkGhJDUiUrDw6dkRvat7L6tb+kEwOyjql/TlIFflIWLU/0d3ps3h9TWJ+k4L8 ndOl780JJDP/ePJG/t06EDSCjX8xqQPpNuj6JRfmX+/Q6yrv33mME6N/5IXApqrQU4rnY7zJdmwB wgktgHA48wh5fESp3s01WSPZTZY/FqWcQGx3VYkgJ1OK5hMYKXUs6nxCURdTivohSwQCUcr7LBGP zRLB31B+uywxiGTmH03ezL9j8Q0mFF8x6YSiD2mfH/E/kCV6McynPgjJnlD8MTXWzD6aupl9xxrp T6iRYtIRQcc+n/tH7JMJxbog+oSCIKdSiufDjZS6lT00go3SyOFigCe47IUe+9eVNZl0l9nI1zWZ tJfZNJKZfzR54xuFyK1GohGs/DvUSH29iOhH+cSczKEv/WK53UxDU7u+/cMv6OSibS8S/IVmjdyK LkXDoESTLg96ifSTPyjRUNIZQaoqmyrvQzQnOuFszHS61VA4gJXOKSX0kHH0K703OskXV0EQKXtk Tn6e1B0iQtPzbwt7FmtfWkEv5ySmH1pRQGY5IRvG1ziRW1Gm+BuU06Um69d5UE7cEI3QoW+IIJB7 soGzMdPpWJDBADY6Y4dtKNeP4iCdQ8lmDKndxRKEc6ETzsZIZ+xYX8EAVjodTqG5j8pr5Ckay322 2fy0fKF4qJv+yBJoSA7tGfQQkJl6OHPjc67YsWz648tmPPn8WX+68rbZsBxTQmPLKSU0vdzIrLbo 2H9tBN1cddTLMTEiGQVFjJgFdSvcFIuDgk4+eA5SUKi4TdDUXrQPggLTL8WmkXV77tx9tJcbbxS6 G3oI4CqtghgCMusJCTHr6Va5KRIH9XQ4cQ4SHyqq6nbHf/cwsvuU0UJ9Mq5k26l/B2SmHs7cTL1b lYcD2KhPHHbd+hsOQD0/UE8lse4jK+hFtsLdd5nQFH+car7xhn6Oika+6gGPgcxyQjaMciZuXQZF 3KCckz80CATc4Noyo7Dv2Q+ZEZguq82+fYyuPwtuk2O2sWz5kXvR7NtUSj0y7L+Phz5u4neCQkaM T5YTt96FYnFQUIdj9iCEm2yP7F/6PSo0t+xRoekNaTpvlzsw3W+aYrshP7Dtb2KhB/Vwpv+mGJrq /wfJOsttL1Chi3O21w9Q3wGZgwlqYQ4mx76JUG8wmBwOPLTyIJjI3ukQTHz0gQc0bR8T31TP0vBB Z/9oCrq5CqkWIAlklhOyYXzKnTi2TQR/Lf7/ARnU+JUNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxNCAw IG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDU1LjM1IDU1MiA1NDIuMjUgNTY0XSAvQlM8PC9X IDA+Pi9GIDQvRGVzdFsgMi9YWVogMzMgNDkyIDBdIC9TdHJ1Y3RQYXJlbnQgMj4+DQplbmRvYmoN CjE1IDAgb2JqDQo8PC9UeXBlL0ZvbnQvU3VidHlwZS9UcnVlVHlwZS9OYW1lL0YzL0Jhc2VGb250 L0FCQ0RFRStDYWxpYnJpL0VuY29kaW5nL1dpbkFuc2lFbmNvZGluZy9Gb250RGVzY3JpcHRvciAx NiAwIFIvRmlyc3RDaGFyIDMyL0xhc3RDaGFyIDMyL1dpZHRocyA1NTkgMCBSPj4NCmVuZG9iag0K MTYgMCBvYmoNCjw8L1R5cGUvRm9udERlc2NyaXB0b3IvRm9udE5hbWUvQUJDREVFK0NhbGlicmkv RmxhZ3MgMzIvSXRhbGljQW5nbGUgMC9Bc2NlbnQgNzUwL0Rlc2NlbnQgLTI1MC9DYXBIZWlnaHQg NzUwL0F2Z1dpZHRoIDUwMy9NYXhXaWR0aCAxNjkwL0ZvbnRXZWlnaHQgNDAwL1hIZWlnaHQgMjUw L1N0ZW1WIDUwL0ZvbnRCQm94WyAtNDc2IC0yNTAgMTIxNCA3NTBdIC9Gb250RmlsZTIgNTYwIDAg Uj4+DQplbmRvYmoNCjE3IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgNTUuMzUgNTQwIDU0 Mi4yNSA1NTJdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAyL1hZWiAzMyAzNjAgMF0gL1N0cnVjdFBh cmVudCAzPj4NCmVuZG9iag0KMTggMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA1NS4zNSA1 MjggNTQyLjI1IDU0MF0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDIvWFlaIDMzIDI4OCAwXSAvU3Ry dWN0UGFyZW50IDQ+Pg0KZW5kb2JqDQoxOSAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDU1 LjM1IDUxNiA1NDIuMjUgNTI4XSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgMi9YWVogMzMgMjQwIDBd IC9TdHJ1Y3RQYXJlbnQgNT4+DQplbmRvYmoNCjIwIDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVj dFsgNTUuMzUgNTA0IDU0Mi4yNSA1MTZdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAzL1hZWiAzMyAx OTIgMF0gL1N0cnVjdFBhcmVudCA2Pj4NCmVuZG9iag0KMjEgMCBvYmoNCjw8L1N1YnR5cGUvTGlu ay9SZWN0WyA1NS4zNSA0OTIgNTQyLjI1IDUwNF0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDQvWFla IDMzIDM4NCAwXSAvU3RydWN0UGFyZW50IDc+Pg0KZW5kb2JqDQoyMiAwIG9iag0KPDwvU3VidHlw ZS9MaW5rL1JlY3RbIDU1LjM1IDQ4MCA1NDIuMjUgNDkyXSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsg NS9YWVogMzMgNjg0IDBdIC9TdHJ1Y3RQYXJlbnQgOD4+DQplbmRvYmoNCjIzIDAgb2JqDQo8PC9T dWJ0eXBlL0xpbmsvUmVjdFsgNTUuMzUgNDY4IDU0Mi4yNSA0ODBdIC9CUzw8L1cgMD4+L0YgNC9E ZXN0WyA2L1hZWiAzMyAyODggMF0gL1N0cnVjdFBhcmVudCA5Pj4NCmVuZG9iag0KMjQgMCBvYmoN Cjw8L1N1YnR5cGUvTGluay9SZWN0WyA3Ni45NSA0NTYgNTQyLjI1IDQ2OF0gL0JTPDwvVyAwPj4v RiA0L0Rlc3RbIDYvWFlaIDMzIDIyOCAwXSAvU3RydWN0UGFyZW50IDEwPj4NCmVuZG9iag0KMjUg MCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA5OC41NSA0NDQgNTQyLjI1IDQ1Nl0gL0JTPDwv VyAwPj4vRiA0L0Rlc3RbIDcvWFlaIDMzIDY0OCAwXSAvU3RydWN0UGFyZW50IDExPj4NCmVuZG9i ag0KMjYgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyAxMjAuMTUgNDMyIDU0Mi4yNSA0NDRd IC9CUzw8L1cgMD4+L0YgNC9EZXN0WyA3L1hZWiAzMyA1MjggMF0gL1N0cnVjdFBhcmVudCAxMj4+ DQplbmRvYmoNCjI3IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgMTIwLjE1IDQyMCA1NDIu MjUgNDMyXSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgNy9YWVogMzMgNDA4IDBdIC9TdHJ1Y3RQYXJl bnQgMTM+Pg0KZW5kb2JqDQoyOCAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDEyMC4xNSA0 MDggNTQyLjI1IDQyMF0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDcvWFlaIDMzIDE5MiAwXSAvU3Ry dWN0UGFyZW50IDE0Pj4NCmVuZG9iag0KMjkgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyAx MjAuMTUgMzk2IDU0Mi4yNSA0MDhdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyA4L1hZWiAzMyA1NjQg MF0gL1N0cnVjdFBhcmVudCAxNT4+DQplbmRvYmoNCjMwIDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsv UmVjdFsgNzYuOTUgMzg0IDU0Mi4yNSAzOTZdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyA4L1hZWiAz MyA0NTYgMF0gL1N0cnVjdFBhcmVudCAxNj4+DQplbmRvYmoNCjMxIDAgb2JqDQo8PC9TdWJ0eXBl L0xpbmsvUmVjdFsgNTUuMzUgMzcyIDU0Mi4yNSAzODRdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyA4 L1hZWiAzMyAzNzIgMF0gL1N0cnVjdFBhcmVudCAxNz4+DQplbmRvYmoNCjMyIDAgb2JqDQo8PC9T dWJ0eXBlL0xpbmsvUmVjdFsgNTUuMzUgMzYwIDU0Mi4yNSAzNzJdIC9CUzw8L1cgMD4+L0YgNC9E ZXN0WyA5L1hZWiAzMyA1NzYgMF0gL1N0cnVjdFBhcmVudCAxOD4+DQplbmRvYmoNCjMzIDAgb2Jq DQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgNzYuOTUgMzQ4IDU0Mi4yNSAzNjBdIC9CUzw8L1cgMD4+ L0YgNC9EZXN0WyA5L1hZWiAzMyA1MDQgMF0gL1N0cnVjdFBhcmVudCAxOT4+DQplbmRvYmoNCjM0 IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgOTguNTUgMzM2IDU0Mi4yNSAzNDhdIC9CUzw8 L1cgMD4+L0YgNC9EZXN0WyA5L1hZWiAzMyA0ODAgMF0gL1N0cnVjdFBhcmVudCAyMD4+DQplbmRv YmoNCjM1IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgOTguNTUgMzI0IDU0Mi4yNSAzMzZd IC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAxMC9YWVogMzMgNTY0IDBdIC9TdHJ1Y3RQYXJlbnQgMjE+ Pg0KZW5kb2JqDQozNiAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDc2Ljk1IDMxMiA1NDIu MjUgMzI0XSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgMTAvWFlaIDMzIDMwMCAwXSAvU3RydWN0UGFy ZW50IDIyPj4NCmVuZG9iag0KMzcgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA5OC41NSAz MDAgNTQyLjI1IDMxMl0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDEwL1hZWiAzMyAyNzYgMF0gL1N0 cnVjdFBhcmVudCAyMz4+DQplbmRvYmoNCjM4IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsg OTguNTUgMjg4IDU0Mi4yNSAzMDBdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAxMS9YWVogMzMgMzcy IDBdIC9TdHJ1Y3RQYXJlbnQgMjQ+Pg0KZW5kb2JqDQozOSAwIG9iag0KPDwvU3VidHlwZS9MaW5r L1JlY3RbIDc2Ljk1IDI3NiA1NDIuMjUgMjg4XSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgMTIvWFla IDMzIDY4NCAwXSAvU3RydWN0UGFyZW50IDI1Pj4NCmVuZG9iag0KNDAgMCBvYmoNCjw8L1N1YnR5 cGUvTGluay9SZWN0WyA5OC41NSAyNjQgNTQyLjI1IDI3Nl0gL0JTPDwvVyAwPj4vRiA0L0Rlc3Rb IDEyL1hZWiAzMyA2NjAgMF0gL1N0cnVjdFBhcmVudCAyNj4+DQplbmRvYmoNCjQxIDAgb2JqDQo8 PC9TdWJ0eXBlL0xpbmsvUmVjdFsgOTguNTUgMjUyIDU0Mi4yNSAyNjRdIC9CUzw8L1cgMD4+L0Yg NC9EZXN0WyAxMi9YWVogMzMgMzM2IDBdIC9TdHJ1Y3RQYXJlbnQgMjc+Pg0KZW5kb2JqDQo0MiAw IG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDc2Ljk1IDI0MCA1NDIuMjUgMjUyXSAvQlM8PC9X IDA+Pi9GIDQvRGVzdFsgMTMvWFlaIDMzIDY4NCAwXSAvU3RydWN0UGFyZW50IDI4Pj4NCmVuZG9i ag0KNDMgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA5OC41NSAyMjggNTQyLjI1IDI0MF0g L0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDEzL1hZWiAzMyA2NjAgMF0gL1N0cnVjdFBhcmVudCAyOT4+ DQplbmRvYmoNCjQ0IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgOTguNTUgMjE2IDU0Mi4y NSAyMjhdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAxMy9YWVogMzMgMzM2IDBdIC9TdHJ1Y3RQYXJl bnQgMzA+Pg0KZW5kb2JqDQo0NSAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDc2Ljk1IDIw NCA1NDIuMjUgMjE2XSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgMTQvWFlaIDMzIDY4NCAwXSAvU3Ry dWN0UGFyZW50IDMxPj4NCmVuZG9iag0KNDYgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA1 NS4zNSAxOTIgNTQyLjI1IDIwNF0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDE0L1hZWiAzMyA2MTIg MF0gL1N0cnVjdFBhcmVudCAzMj4+DQplbmRvYmoNCjQ3IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsv UmVjdFsgNTUuMzUgMTgwIDU0Mi4yNSAxOTJdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAxNC9YWVog MzMgNDkyIDBdIC9TdHJ1Y3RQYXJlbnQgMzM+Pg0KZW5kb2JqDQo0OCAwIG9iag0KPDwvU3VidHlw ZS9MaW5rL1JlY3RbIDc2Ljk1IDE2OCA1NDIuMjUgMTgwXSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsg MTQvWFlaIDMzIDQ0NCAwXSAvU3RydWN0UGFyZW50IDM0Pj4NCmVuZG9iag0KNDkgMCBvYmoNCjw8 L1N1YnR5cGUvTGluay9SZWN0WyA3Ni45NSAxNTYgNTQyLjI1IDE2OF0gL0JTPDwvVyAwPj4vRiA0 L0Rlc3RbIDE0L1hZWiAzMyAyMTYgMF0gL1N0cnVjdFBhcmVudCAzNT4+DQplbmRvYmoNCjUwIDAg b2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgNTUuMzUgMTQ0IDU0Mi4yNSAxNTZdIC9CUzw8L1cg MD4+L0YgNC9EZXN0WyAxNS9YWVogMzMgNTUyIDBdIC9TdHJ1Y3RQYXJlbnQgMzY+Pg0KZW5kb2Jq DQo1MSAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDc2Ljk1IDEzMiA1NDIuMjUgMTQ0XSAv QlM8PC9XIDA+Pi9GIDQvRGVzdFsgMTUvWFlaIDMzIDQ2OCAwXSAvU3RydWN0UGFyZW50IDM3Pj4N CmVuZG9iag0KNTIgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA3Ni45NSAxMjAgNTQyLjI1 IDEzMl0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDE2L1hZWiAzMyA2NDggMF0gL1N0cnVjdFBhcmVu dCAzOD4+DQplbmRvYmoNCjUzIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291 cmNlczw8L0ZvbnQ8PC9GMSA1IDAgUi9GMyAxNSAwIFIvRjIgNyAwIFIvRjQgNzAgMCBSPj4vUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L0Fubm90c1sgNTUgMCBSIDU2 IDAgUiA1NyAwIFIgNTggMCBSIDU5IDAgUiA2MCAwIFIgNjEgMCBSIDYyIDAgUiA2MyAwIFIgNjQg MCBSIDY1IDAgUiA2NiAwIFIgNjcgMCBSIDY4IDAgUiA2OSAwIFJdIC9NZWRpYUJveFsgMCAwIDYx MiA3OTJdIC9Db250ZW50cyA1NCAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5 L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDQwPj4NCmVuZG9iag0KNTQgMCBv YmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjg5Nz4+DQpzdHJlYW0NCnicpVvrT9y6 Ev+OxP9g9RNc0ZDYzkuqKvHqvVRQuGX74Qr6IWS9EHVJoiQLh/PX33Eeu3Y24yw554hCuzNje+Y3 T5vjk6JKFlFckS9fjk+qKoqfxZzcH8+y/Pfx7D0Xx7fRU5JGVZKlX7+S0/Mzcjrb3zv+5hCHktli f88hNvzvEOYR37EtFpDZy/6eTZ7kH//e37s/uEwrUaSiOvxNZt/39y6AX8roGENmeZSrzPcHnxFa x7atgOq050W0wGQ7zNuiJxity7doz7K0KrIluY3iP6Iid2mW5Un6RE6jEtR0mqRz+Bsij1PHYrst zWlguTuSBn5f6vfV8h2hdh3PcnYT7FLWF0xtO8SoXWo5OyrW9S2PeGEwTEkurs/IMQLD06yqshcT EhX4ObAZOrYZoIOd7EIWeBuy0wQ7m21xjRITSG3H8lyN9OKvPClEiXK4oUV1ju9RuooKzNjMDi3P 32k3DHAR6KSUHmHELLD4jnK5298CHNzGqH2+q2AeckvXxT3AQaCQY77lU42eYaScW6FO+tsM+l32 W2MejjdIWEOeHN/lUSrxfn12eU7s46sIAsuBSD//ujscAHjjRSBy7UUOt5DVfUAOhFSNGtspnIb3 aSHslclcFLWzlSRLyZ2IV0VSvZOfSfmnNKNKE2WZ/kNDkWv1xDj+tv5u18pzMOUdf2OQMyzX01KV y21pR1Q9Q/ah+BJbqbBTv0c1YznYeR3HBQadHs1SlIK9dNoblBYCQo82r62KMfhUpkCNAc1vDmQi iE+77Rrcl/doMRS1kVKjfS8r8ULKVZ5nBZbraehu7ceIvlEAavYLTABk0wCIqW4IgHwCAF1bAyAd A6C7S5nUAlClvY6WSZxkq5IUIl8mosBMBLE2cHXeiSbivgvlypAks001lRht6k6zKabDIZt6E2zK As2mbMymDKm7hmyq0l6mUI4lr4Kk2Vxg9oSAb7s631R7cs/CJZltqqkkNNnUn2ZTTIdDNg0+YNMm p1NP2b5rkZPHbFXViZZkC3JeZHndc1yJp6jrRNAM3NRfmsiJwU/blVGp4TSlqguMKdVByyNUq45a PXhW16yRO7T9c2p/UfmqqBLkKisrcltkj0vxgvmBz+qU5exa+Bi0b0OhsCXJbCqVmNomUzkTKyXn A5WS85FSqbGVrSZaf6yqtXcoOLqqVqWVVW0VpajzdAiw/3kBwQKn9sMxUWa7qtwjdp1YgGCq3F6A tzJrRZHiaX+vNp0LRWAYdPUdiCzE/t7iXwgyDCl1GBluqE+UZM4egYfCMgoPjXbd4ujdD9qdU5n6 NAkTwcIDag1KMqJDox9Bh6HOMKAD1eT2Aj6CDijSJDo8V4bHMXR8OHO6ftBHR2iRy5MfJzvakDLZ MShiptvQZdImw5LMdlR5qGNU87RMq61gtCO1ETt6zArdbvrqAPLBeUy2pIY8g9jSg3LAVW1JbYv8 FAtRiDQWeMwOZOWqcP+DmB3I6cWYKLMxVWazMakhTZqMqa5gNibbMmYXIiHRSXPKBp6OuSWd0Hi6 Lt825tj4Q2Ea7VQ02h9Z8RLVrcooXChoD/KUxj7V40PPCrclmeGhUo/AY1r7iSpxewEPhQcLJTzq Ocw4PAwtFQoPTrfhQSFyp4sPmDKw5SxBkTW95nbkTU1PktmQKu2IIQ1pzWRIdQWzIUMkaFO/9nJ5 BTaafNmHGyyX2X0joh6+BpY97uFdaabSnsR/0uxtKeZPL8JQvzdFqMY51bkpl86NSzKjQ+Uzo4NN a8hQTQ7a9sMNmQtV9kb5eS6gdf6LnFjkphkfyza6GcnerfLcPI/VZGVFRe6SalWXZSN5WOX7cB5W mSk1WmBa66StYPRPhrVOdlNUySH9uH8a0gEdtqHdK6i+2FC12bYbwJdv2/wUvlP4cuHLs+1T+LJZ Q8P95kt+xoPmc/nV/PxV1/wAiNqrAWUL0z3R8aU9DZLMQFAZKTPaaWKXZO9akLGPpMrahvLWc0fZ wTDIuF/n8jaoKiBj688gbHsD8FNkh8pWlQty2bfqGcCxjJvk9oCgZpuBku0u5ZuL+SruxYhtcc6A OIdz6E50geZNodFR36Gr+PvsOSlJmYs4WSRxHcvIXCySVJSkehYEezXycHB2e/dwaLwzlnPw9Tov In6O0qR8wcvh+oZPY4IainRPbuTcssrizDy31NiX6HsEiMt2j/hVFKU8PYezXd6+8odDzI0h2FFf Z0bv+sHXeI82SuebQxn1xxSXaU8PR/rshd1mDz+HB80/eM23euvew6HV/PUklkUnEJXN3+fiNYlF 2dGibxmo5br68kkaL1dSUj14rvkjKbyVVb4llfw0fhblkflQlOqqeEsKsZSCWnl5lqTVcdzgbimK IyKqGNupS2V+1WSidmOebdk9YvzNjF/bWKWNIYetSgFuAR6zgXOVmc8rnxWx7p4YLL7KyWMzvy/J o6jehEhJma2KGL2ZapGtCsKBXXcSGu3lrbmq2Ukws2kNZJU2ms8LsNiIbVQOtAPq9L3TVpqnNhpt tiDPWVkBiABRJnMw+Xar44qzAg6QZ81tSpTGz1mBw7cdsWkSklTCdiQmaRzFHNYRgPrq2aw4jQvH aY1pjVaG7Siv3UjMSWsks1Igp26sWpbJUyqbEwB59ZzNLTRiN02Kxj2DACA2AJc+8yik28ylo7xG y2QuL6LkHhvQmzcmn7VscLw+DKhdSsibC0RI97GARntOFkWG3Wu1L780iSNPvzTaOYSpuEJfJ7ZJ YSfxbVLQaKPuoWANY1TlTSWIrrJdEWwPzhrFcmioGaHM7xXsbPPZWC3F+XAtxdy1Y3bd9Egt5WKV iiKqvvN6BVTWz7hqQNUogFg8z+KVxKtxDW9gjTYAaquYd4pcDjAIDaCy+vZjaMykSAjQs1Kvpzbw JfJHvJO3rJiX5NP1r7vZp6PmO/lxU//88+K/vy5/XpzLn+/+c3J19cm4/aHql7PQYurq9wedsHYV RWT/3I7TnDuUTxRN53bRepk5vHduWPzm11V7JvnT5rRnN9fXFz/OmwNfn/wPvsmI/+nmdnZ58+Pk 6tMaFPimaRjWm7YDyzHveagob/YsLxu1PXcYJFEhZKR7FEYguXSo3m/j6Ua4TDBQKOaFqEM5QF2U cZE8NuA3LsC0noxvPXEPvTpxqGvdGwVyc5PHQVJf4M9vZ0aRQ37Pqbx90sRQx/xow/XMZ+WuvJTU RP42yvNHjuoGfXmWUd6Qz3PP7Z/TbFD0wkwJvdRX6gCGZ5HaDVTamShekjRbZk9Ygmt//UDjMm7Y 2+0ZMJVT/m48h6ztyd9m4BppXathW23u9lTykTsYlRT9fY2mP91JaqsrhVTGcpm8qvc6OkB91NU/ Slkji0J0eFSHaWz1be2jw1gVLnL02krjI2hRSK/Xvc8N9KGviXjD9NDMzlRe86Z3m19QOaZSxxeb ZiypQyTUr029ic5zmzZJFVRkr8kcCue6ACNL8SqWAxYyqUiG705aW+jKecJTEaWrZSSfYxzJEB6h /UVzoaeKka+El6JX2wxUtSrPSFGrkkLXdHp2CyLIthqNJ5UTqa4uFvkyewd1Z01N3nbxzaSBPDSD g6a/aj6Ro4L4+WjT9xtX8jfQMc0HHg6bQiAXhbx3g8ajnVs1LQIpu7mVcTE5F+uaqIzozToKcVtO klTWTVvf4xkYb7dPbxT2L7Z9ysbH0u1v1KjrRivo1orkbzEfX5cxR7YrvXX5+Lod4JR1xwCnqmbL ocb6dYdvXHSwXbfIJRRdyzKDP5bZG6BY/mLRcvkuIbBInlYFYLO1oTnEOUwP1+smti7pnkW6bmOh UYv/qD1sry81rkI3vtP1r7JtrRm7JpP02kHzpEAVuRVf/w/cTEUaDQplbmRzdHJlYW0NCmVuZG9i ag0KNTUgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA1NS4zNSA2NzIgNTQyLjI1IDY4NF0g L0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDE2L1hZWiAzMyAyMTYgMF0gL1N0cnVjdFBhcmVudCAzOT4+ DQplbmRvYmoNCjU2IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgNzYuOTUgNjYwIDU0Mi4y NSA2NzJdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAxNy9YWVogMzMgNjg0IDBdIC9TdHJ1Y3RQYXJl bnQgNDE+Pg0KZW5kb2JqDQo1NyAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDc2Ljk1IDY0 OCA1NDIuMjUgNjYwXSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgMTcvWFlaIDMzIDM0OCAwXSAvU3Ry dWN0UGFyZW50IDQyPj4NCmVuZG9iag0KNTggMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA3 Ni45NSA2MzYgNTQyLjI1IDY0OF0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDE4L1hZWiAzMyA2ODQg MF0gL1N0cnVjdFBhcmVudCA0Mz4+DQplbmRvYmoNCjU5IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsv UmVjdFsgNTUuMzUgNjI0IDU0Mi4yNSA2MzZdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAxOC9YWVog MzMgNTUyIDBdIC9TdHJ1Y3RQYXJlbnQgNDQ+Pg0KZW5kb2JqDQo2MCAwIG9iag0KPDwvU3VidHlw ZS9MaW5rL1JlY3RbIDU1LjM1IDYxMiA1NDIuMjUgNjI0XSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsg MTkvWFlaIDMzIDU0MCAwXSAvU3RydWN0UGFyZW50IDQ1Pj4NCmVuZG9iag0KNjEgMCBvYmoNCjw8 L1N1YnR5cGUvTGluay9SZWN0WyA1NS4zNSA2MDAgNTQyLjI1IDYxMl0gL0JTPDwvVyAwPj4vRiA0 L0Rlc3RbIDE5L1hZWiAzMyAzNjAgMF0gL1N0cnVjdFBhcmVudCA0Nj4+DQplbmRvYmoNCjYyIDAg b2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgNTUuMzUgNTg4IDU0Mi4yNSA2MDBdIC9CUzw8L1cg MD4+L0YgNC9EZXN0WyAxOS9YWVogMzMgMTY4IDBdIC9TdHJ1Y3RQYXJlbnQgNDc+Pg0KZW5kb2Jq DQo2MyAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDU1LjM1IDU3NiA1NDIuMjUgNTg4XSAv QlM8PC9XIDA+Pi9GIDQvRGVzdFsgMjAvWFlaIDMzIDY4NCAwXSAvU3RydWN0UGFyZW50IDQ4Pj4N CmVuZG9iag0KNjQgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9SZWN0WyA1NS4zNSA1NjQgNTQyLjI1 IDU3Nl0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDIwL1hZWiAzMyA2MzYgMF0gL1N0cnVjdFBhcmVu dCA0OT4+DQplbmRvYmoNCjY1IDAgb2JqDQo8PC9TdWJ0eXBlL0xpbmsvUmVjdFsgNzYuOTUgNTUy IDU0Mi4yNSA1NjRdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAyMC9YWVogMzMgNjEyIDBdIC9TdHJ1 Y3RQYXJlbnQgNTA+Pg0KZW5kb2JqDQo2NiAwIG9iag0KPDwvU3VidHlwZS9MaW5rL1JlY3RbIDc2 Ljk1IDU0MCA1NDIuMjUgNTUyXSAvQlM8PC9XIDA+Pi9GIDQvRGVzdFsgMjAvWFlaIDMzIDQyMCAw XSAvU3RydWN0UGFyZW50IDUxPj4NCmVuZG9iag0KNjcgMCBvYmoNCjw8L1N1YnR5cGUvTGluay9S ZWN0WyA1NS4zNSA1MjggNTQyLjI1IDU0MF0gL0JTPDwvVyAwPj4vRiA0L0Rlc3RbIDIwL1hZWiAz MyAzOTYgMF0gL1N0cnVjdFBhcmVudCA1Mj4+DQplbmRvYmoNCjY4IDAgb2JqDQo8PC9TdWJ0eXBl L0xpbmsvUmVjdFsgNTUuMzUgNTE2IDU0Mi4yNSA1MjhdIC9CUzw8L1cgMD4+L0YgNC9EZXN0WyAy MS9YWVogMzMgNjg0IDBdIC9TdHJ1Y3RQYXJlbnQgNTM+Pg0KZW5kb2JqDQo2OSAwIG9iag0KPDwv U3VidHlwZS9MaW5rL1JlY3RbIDU1LjM1IDUwNCA1NDIuMjUgNTE2XSAvQlM8PC9XIDA+Pi9GIDQv RGVzdFsgMjIvWFlaIDMzIDY4NCAwXSAvU3RydWN0UGFyZW50IDU0Pj4NCmVuZG9iag0KNzAgMCBv YmoNCjw8L1R5cGUvRm9udC9TdWJ0eXBlL1RydWVUeXBlL05hbWUvRjQvQmFzZUZvbnQvQUJDREVF K8vOzOUvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL0ZvbnREZXNjcmlwdG9yIDcxIDAgUi9GaXJz dENoYXIgMzIvTGFzdENoYXIgOTMvV2lkdGhzIDU2MSAwIFI+Pg0KZW5kb2JqDQo3MSAwIG9iag0K PDwvVHlwZS9Gb250RGVzY3JpcHRvci9Gb250TmFtZS9BQkNERUUry87M5S9GbGFncyAzMi9JdGFs aWNBbmdsZSAwL0FzY2VudCA4NTkvRGVzY2VudCAtMTQxL0NhcEhlaWdodCA4NTkvQXZnV2lkdGgg NTAwL01heFdpZHRoIDEwMDgvRm9udFdlaWdodCA0MDAvWEhlaWdodCAyNTAvTGVhZGluZyAxNDEv U3RlbVYgNTAvRm9udEJCb3hbIC04IC0xNDEgMTAwMCA4NTldIC9Gb250RmlsZTIgNTYyIDAgUj4+ DQplbmRvYmoNCjcyIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8 L0ZvbnQ8PC9GMSA1IDAgUi9GMiA3IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFn ZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9Db250ZW50cyA3MyAwIFIvR3Jv dXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1 Y3RQYXJlbnRzIDU1Pj4NCmVuZG9iag0KNzMgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggMjE5Mj4+DQpzdHJlYW0NCnicjVltb9s2EP4eIP+BHxPAk/VueSgKOEm7pVjXYHG3D00/ yBJlE5VETy9JvV+/O1KWRdukhRZF4h7vOd4990ZPF1XDsjhpyLt300XTxMmGpuTbdMm336fL3ZZO n+I1K+OG8fL9e3L3cE/ultdX048OcVyyzK6vHGLDH4d4IZk5tuVFZFlcX9lkjf/8dn317eaxbGhV 0ub2O1l+ur76AOdRx/7g3LNC1x8e/nbzi0bWsW0rclXZhyrOdLodLzyRJzrZwD+RvedlU/GcPMXJ D9qQ55LzLSvX5C6uwU13rEzhN40+33Usbxy070ZWMFI0mh1r/dTmO4104ISWM05x4HrHil3bnuuk A9dyRjo2mFkhCefReUny4fM9mWpoeMebhhcmJg7o54Ax7iVjQA4sGSMWhQexO6a7m235iqROoWs7 Vhgooh9+bllFa+2JYG656olPcdnGlS7Ynj23wtkoazzgRaSKuu5EJ+xFlj9Srx8cmwAXt3XSM3+s Yn/uW6ovvgEdqJZy3syauYq8rxP1fWuuin43k36MvYLzcL2zgoLyZPqEZP98//hA7OkfMVSVG1r+ 8vX59gy7ZQqBvj6FlhtWk4Imm7hkdUEq+m8ryFRygp+Ba3hJNrw2B0pR2UxIXKaooaRvZFvxhidQ +5iWodKq0D2oSGnN1iVNLbLcaIPjBMAn9/jgNuc7mupyAfhqB+oRbd5AIXODY/WvLKEkiUvyxqsf 5I01G7hoqfPOHOBmqgpdS/JtgJudv42WzWEEZfmMhdoyjq1k1O0DB1uJItpwcwCDQQ2v2+2WVw1h ZVLRgpZNnOc7Iu+Dv5KXmzIuaGpyXjgTDglG9POuAiiyz4u/H4l0x8utRb6UYECjZ5O8gxed8X5c 0Rjpi1SmSSNpqaSNSgi462UkNxx4q4GEiStASlNIvho18ES0KADRDSVuBENMoGra8LSeoNfzFkcK 8vD7/RP4+q+P967jOS+3E7NRziCN8ehrKA97nhPg4ec/Fot7+ZEfhS5+hKleYD/JScLLjK3bShqe 8YqsOLjDiGgPCPb49OoLffBDaF3IensMiREimEXacreJwdclWTw/f/38tHz88ifELW7gox35AUMZ 4VkfEjjX1vpUlFAhhCLooDgSDkZKWpGaF5Sk7TZnXVBTikTCn17w1iF56P4TABYdoBEIZswe6KFX pqvS3fiqnNrShGUM8FhJunBO9s73eyNgcM3AsIYcQIx2+e4BQSoOXHf2civSh1bAiQLT5zFDtx+7 FpOHt9L92woyl7cX3ODZB7iz/p2Quk02ZCvm7hoQIDVXFNrcGtINUxuhMVGOYKYf3ePFRCJCWdwj vrPtO+/98bmThSbEdcBXTt60ZdzCXSv230mrOoPsBI7luifY/mXsLlkUbG07DaGVH8n29Qh4kbI6 EU6zyCLHQK03osoN/W4Mlj1IDhEg8yKnyAvtmK0rSkskR51UbCUDeNmB7jzAVj7UODJ4HpQZaCyK LZ+/Pi8vY0LJxPZ1jDkiaN2crGBeGJQV2ZebuktVGDPJIQtFFE0RwuG417LXEcBicigRWPGxsMck 5w2WR2iNNS9rLB1QOfqULuId5pkRLRrUCiX/++y1yDNWTg6VQ/Kr3tUNLaT6EgzoSooZZ3amSNBB CV5R0EGBSThzYi0YlCaYeRg+O8BOCXZolzcfHK3gQM2nl7wdDBJNFigsg4Q1SOqatxVAdnZ0A0fN mlY6An6BQR2ukfCi6JqtEcwfdqY83XtyQlbgcJzT966N0RX5W7wDODnEoUsahM/asguLEcobsAjH 93i7BV+wn2RB1uwVdgtR40nOasGgDgXifxrni4x1BxxCQhyUdSosckeTGP3aqK2f6ZplN4grqrUD uGNjqiqy8YiC5LuwLCrHRtYj38OcVvBSmsVtrhsSMcsC9YB2A4nm1tFdeJaNaIxiqzi+zIhCJ3eM UY6W0cZXIq+T7CM5EV0ohwRCNp2fskTf39OA4j7bGJE8fGXyDs16lVMsBSKnD7NEIxugmqoT8rZh MHJgierHDCNWFB6wIPNzOARDyq63FJO/Eu02hjtUNGvFqF2zdJ8u8BeFV7SkGbtwM9zUezRs61X8 tuqct6JnRqGj3VlRANVnCyaAe7Q7SnRySAsgu7QiK5ysfU8SHVaRF9PeSR2ZYFG98P7g4arr9TmV sFRspw3GfSXqbHdTGfizQFBN6YFlRrRgQOXu0UXsxRAF83ymnESraMPQBJ1TfR+XROWU/qXQFcEa yorMoXBjWGOA3lBocBqADtmWMCG01YVreoM8qnneSrri/ICm5/Qn6T+VabOqgII1/G/dTHCvjNfS L5c6gecOskhYxhrcIjhErLCI1qkw8viBetqMYw9ogt1tZXy87zYv5ZTWFgiVfSQLV68YtMw1pHYl 3lCwPyMtLyTFUAmwFDwJqszPVMoZi3yIMRzydnJRNjrGnQ9Yk7MMaFlQuVGK9Ze+YhixKsKN1mug U3PwHpTqnMrR4p8NNe8R7mzAKdDBKrKHI1Q+hU+QYqhegm7EBFJPjkcAwW0jFO7zfUkAC2ViJ7wC kC2XpmOIdgJxP42K+wL1EpzctE93NkwAQwCzJbhYn7LuApWGpzp7yEp85QT5Jt53fCyLrKzRbem+ 6YiXLChEMM8bbcLtu89t0QPXLfQ7i3xpK6kElKcsy2iFYcgqXqDOoey+dRlxcCM9XyoTnsMYebTx y0LST8hQjrFjYtUyw9iHWBRQ5xiUp8ODnFgOBGxBG3xlg7i/soqLz7RBlqPkULPx/d659H6P305F h5gG5kl8KPoXzcXr0lP3HK99Kops7AHDo0aT3VFfOeA7xF7dwvw66jgBPnYMT+y/QqihA8lb9LPX YOUchAhrpIlVbgCD7hCBmUuO4x8CKCa+BDo/8k8tKIOH11/N34ENFZ6493+GT58XDQplbmRzdHJl YW0NCmVuZG9iag0KNzQgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2Vz PDwvRm9udDw8L0YxIDUgMCBSL0YyIDcgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0lt YWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDc1IDAgUi9H cm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0 cnVjdFBhcmVudHMgNTY+Pg0KZW5kb2JqDQo3NSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2Rl L0xlbmd0aCAyMDU4Pj4NCnN0cmVhbQ0KeJyVWdtu2zgQfQ+Qf+BjCmRlibp6URRI4u5uijYImiz2 oe0DI1M2UVk0RCmu/36HlGSTikmrKFAkwtw4c+bMkJnd1A0rSN6g9+9nN01D8jVdom+zZ779MXve b+nskaxYRRrGqw8f0O3iDt0+X17M/gpQgNFzcXkRIB/+BShMUBr4Xpih583lhY9W8r+/Ly++Xd1X Da0r2rz7gZ4/XV58BH1pY1Cch16CI13529UfFtnA970Mm7KLmhQ220GYvJFHNtk4eiN7x6um5iV6 JPlP2qCnivMtq1bolghI0y2rlvCbxV6EAy+c5jrCmRdPFM3SsdVPbbm3SMdB4gXTDMc4HBvGvj+3 ScfYCyYmNk69BCXz7LQk+vjlDs0sMLzlTcM3LiRq8AsgGHwuGJCDSKaIZclR7JbZzuZ7kSFpM4j9 wEtiQ/Tjry2rqbBqxHMPmxqfSNWS2lbs0J97STopmhBwkZmiGF/bhMPMiybajeJxCHBw3yadRlMN R/PIM3PxDeBArZALUy/FhnxsE40ib26K/nCDfkq8CvNwvJOCCvJo9ijB/uXufoH82WcCrHJFqz/+ fXp3At1dC4G9I+vtK7JhOfqHiwYBTRVs1daqOdBjzRueA2u90lrIDxH6frX45+7xNfr+bhzw7C88 ZvIoDr3U8Pbe92+DD2PFNyMgSnxvboZprWeSATEZojdoLc+yIXs3kST4qNMKipo1s/ZQgLEXYVNn 26fHppL5nh+bKlbzQMZ4JNtwtIJRQSp0DwlHZLmEHheerQUAUtCIk7x1xw8zCwisYy3wMDb1zuAl sbZ3lqlodVs9tJLfgZam/3vQCi1D5AS0dNGp0MLJCWgNeEFGZZOpldVtur37GgYeKFutX3iNFkzk HAqzP5bp+9XD4nFSukMwCQSrW56Y736WGDGdGSaG7H9rWrlnhCFO4YSIdFXakaoRMtlECLaqnDmL 59r+MSqMNMHAEpPrJ+wW9Bp+RZsWXGzhA683aNFuS5aThqKbXsfpLNVbjzY0V+1TsFo012i3Zvka AV5yvtlyuR7yAkGh0FbtjsKzL38wgEzjz2uKHqzw9sfi4AT8klJwd/wJQDE+wnspM7RU54DoabM+ 1gDMiYaVJaoprGLkpaQeemrhfNqB3L5gmT74yqEyLxTpLusNq+jBq/pYwmfw/9It1QiwX/HG1l1R NgciMby44wn9o+RQ7K9U8LI1OfD71c3X32ou3fLvNZcR05nmMmRlc73tmL5dyJmOCbKjIX1CnW6X nQSBoNUSfLmHgmF4VRNb4WBJj0bSTcsa3go34HUFN/UbolBNebIN+WlfFlVefK05RFv35D8kB34E NAKKJTQlkD0YujtZhOtOsGirjg7kkJGiLmdymz04g84Q7XbL6wba42UPfQyjZm2NFgMSotg0wYHQ YJZbr6J4Hss9xdCxlrODtSEr9qKhG6Awmc2BaoZ2dh40w0crb/v+HNtIdwPb9CTi9Jb6pwnOxjbu njPMTSamcA7XaEPVHXOk4e6J5hJ57uH/RB8W0wgKGsdPDQ9TCSqBvdbUtOOlu8SNzvGwUDhBYktz RkqonjhTu1DHs5qc1okZBLFcaQ2V+wK8gdcOLgeQEqRi6b5eq756JSVbsmYv57Ojz7qosIZfwds6 pwdKUJsEIDJfUzC+7PYA+ACbxbA5HmJpgH7cvCx5MQx7T8DBXMUGu2cufalQwc6GQn9UTGw8BDtC 7d6wDJO0ozDEVQssWVHQmlZwHAjXGVgoH24GKzKmQwyykYYAtyVhlZZ/AhNDy7y1WxRhGy6cF+Xg 3EU5TBQgD9YSK4i6w+myC1qwiikSh3zfVPma2zLcv+YY6s7A8aQbfhhrFesCUEiuENvIAQFzHtZL qNq2UXUbY+K+6j4ted5uaAWAdx4+1NJODt5kjUFXdggUWLIeGiF/x5o1ALCfqud6KJQ3oMHNQKJC MZ3txSlIAMDY1LSSQYrls60ha30O7u72hixEP5y9EbQsDn3dVmLLedGNIxt+1X3WsPc37GY1zPD9 meQHGnQKXpZ8J/OiEs/oYdypKUZEH+Kf7rumYdPmPZ0Dd0awEmhQ+/grL1vBXmETgdrC4JVgmzBh cJjKNtBtTZwwOIq8zNS0P53C6fyRrFyB5XjRwgXo0sM5ZHdYN9YhBamGf7mI9KvcYE0DgLLXUacU tKHBD+XYNOxat9puDzZkrSwZpN5I9NzR5MWoF/1yc3dcYyuUwX4XEDojhSJp9WvApqwTHcg005O3 CbWH6DHZn93V4qGLjuK1pSiNQeON3tuDjRMV4YOGfOiRd2FJaIqf+iVBS6CHFPCEXE5Bdl3xkq/2 yP4AObiR17fDGrwt+R7amlXKVUWbHa9/Xut+Tre/DR+xH3mB4cNJPVhedXrBwyVmp87V1AwS0JEz Oo4EeZ+BzZzRV9UM48BdzoL5sSQl56JPLbUxNPCCjw2tMw+bumgfsXto6wpamj10nrn7XVe3INak pktn4045TPcIZBhW1ObcmyYZVo2hSyp6c7RSV7YMnyQQOCzSy9iDxP4KCueC3tfNWZMbBrL3ddHP bz2p+3VO2jPXiSA9NkMBNwGrdP8XZV2+oiu4TL9aIRpn8m8KuoYcHK2Q7yV9s9Q05xvYwJbdHVRG qzjjTLbiQP7JWLfsPmR0bORnfe+DH6gYv7+eoHQJiyjW7UhKTyaM776VtACa7q5X7PuXUPcmc4Y0 Qr2nlzBzdwMKgHjEWdThJFHnCk/3h9rO/wf0HrUIDQplbmRzdHJlYW0NCmVuZG9iag0KNzYgMCBv YmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBS L0Y1IDc4IDAgUi9GMiA3IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFnZUMvSW1h Z2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9Db250ZW50cyA3NyAwIFIvR3JvdXA8PC9U eXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJl bnRzIDU3Pj4NCmVuZG9iag0KNzcgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg MjA2NT4+DQpzdHJlYW0NCnicjVltb5tIEP4eKf9hPyaSi2FZMJyqSraTXFOlbdS4dx/SqiKwtlFt 8AGO639/swu2d3EGVpWqNH1mdnZen1mG46JK51Fckffvh+OqiuIlT8jzcJZvfg5n+w0fPkaLNIuq NM8+fCCTmymZzC4vhncOcSiZzS8vHGLDH4e4Phk5tuUGZLa+vLDJQvz19+XF89V9VvEi49X1TzL7 dHlxC/JCx0EwdC2fMlX4+eodgnVs2wqojr0pojmm23H9MzzBsB47w07zrCryFXmM4t+8Ik9Znm/S bEEmUQlumqRZAv9C9DHqWK7Z0YwGlmcIDUZtrZ+2qz2C9hzfcswUe9RtK6a2HWJoj1qOoWO9keUT PwzeRpLbz1MyRNJwkldVvu7KRCX9HDCG9hkDOLDEBBb4J9gkxe5mW0xDYgqp7Vi+p0Fv/2zSgpeo hBdaVJf4FGXbqMCC7dqh5Y+MrHEhLwIdSukAA7uBxQz1Mq9tArVRF9uWrWMdFDtipiawkFm6154h cTianO7IGlEN72NQxqxQh/7sLg8Te2V1wPXeBMriIMNHURafp/c3xB4+RNB/rnj27vvT9dt14IO2 Y6mNrO6yVLHQ7WK+qbbRitxEVUSesE4ZQOQ8XbYqtnG1hXTGshmcF7RkOm/q9N20tt9TGtBsmZak 5LFoESThZVykL1Bf1ZKTTV6W6csKTYOmIDR18dEdmFAQnAmhB4S+yHYNmwgnl0fPka0YKp3RcpUm mmZwM7jwmsfLKEvLtYWGayQaiSaMDkGoHmaIrU1ylIDOdjlZR2BY+2ZRwevbVTkpeJwXCXmphyf8 X5aIEKVF9zk2PZ1TVlElGuc7P7wC9RsR8tfrd+EVX+2t+tezJYcz5Y/icCwrA7De1ZUXUlGyzZIo i9Fe6/miIWmC+CyBjuTo2Bde7TgXJ2W1kSJJ6x/Ah/KH2n0CIlw46PSOFyppNc8LmfOQv2Wa8EKO TJLPUSdAC4TRpOko+SY6CcpwblZRxmW04oYVyd9gWecxICpU19p9B9+3XK8HOYKZCGRRwzY0jDyJ rCCzCMocuylUOTQuo5Mo8CHawv64mjzNflx3D2xU+1mLo30tTlSuOwJX0pPGNjUe3nltKi6K2GuJ ta/5BoOndiBatCYmW2olXCqjDrVd1l1HlqDIjaaOcd7jySu49klpnfwZKfNtEUNKJQkkeN0IoOSW eWGRW8iwtGkcPZqd4KT5N99Dk4GkxWRGtuW0ZGTlIXCgimGow2sLpbGN/fePhyugJNGGFUdXA1cE ktt3N1tJJQ4u2ZNlBE4hq3TOq3TNSVrxNdktU1BV99V63HWrFRTpqLbg6whtDEx4S4OnmQi2OB9l obByhLqQNBVyRWaOvMeAYIcyaAaM6vIZhoXO6rewKC8cOWK90y9z8l6PxwKqeuzk6GMZyKu9dC+E zLVsqutCrQWeQFvYuj7qkPeYO7Lb5pIczC1ImsF0WMvGjlLtQMZPVYH1eDeA41pYnABRy2th/13y jL/yelwdc7rnbp5SRbxeoQZSQV0g5TLfroBecGCAK17xpCd3VHUDwv8IykfECO0xg/l6C+FNx9ql FZpNLoVlI9Rlbz5OH1/Zr55oaBK3s9vp7P7rl548U2WGPXnGTCZic3OXnVnfZ5JLbRl8VRQz6eAk Ffs0nv56mo2/zXqSy0h/GJ7p/zz+8n388NrjJFWCddrTdHxNAiU/9kg2JhUr2wpKrFwrYDoeJWGe Y9kMt+OMkrgG+yUTjz6uCaUzQjaUTsPepauKF2LSdNG5ZrExOqVZbDTsj6u7DjZX8z9U+ZnrmCGb cwP/pNGczWli5mxOE3ubzfHTLnZgZg3J6W4E4lHmqFoOp5oFDciRhh3onHJwkvOyPXuGd7Rtvuf6 ls+0M97b9sT/0Hvxpj4066q+q/j0BG5cA8bv1fl+dJN2nRR/v2tUe0oCHXbgucxvspHPyuh09V3R qDQF6GSBsRq2sOM4FrT68Ib9kJYViSOcGzf2itX/oAKmaMEXUZGA2YJ4AvvIwCVZjLK/uhFrSnBG IBuxhj0wKelctKvV3RU95Kw0PaO3JNdhaqk05K5UlhzUc3WpqfKol+sVVMNCrpnvsM1TqNFhbuCI 51gNKzYqCOU8X63yXfkX+pkBYmN2iPQdDc07vYbtpj8ODUWkNQk5dwlBG309FDSRMamPgWT+b8uh DCDDgBbz9BXyel7ka7LMS+wbEvOhtHR9A7n+pRVZR/suO6Cc6EhJUmCIiwXUfUQyvju2k463dCgP TUF3DDyIlmEIFGgTgYf7f27RL2OBWMlM9Du+JwNmAm0CpUBF0TWROjwK4P21+dagykM7zfLdiicL rHoYZSKYigysCnt5KCl5AbtIz3uWyc3qaIgXD8NoKFBDQt3QGZNDRHcSiahAx2RRRFi+U+CMno7f plW+Lcn426N8f3iRjzew8AjXicEoqkeWRI8J4gHkuHqL0O6itBJt7/BkWfDNao9FgNmhmHGqls4I CB8ZRkCFNhGYfP3+5aY7y00OaLLcBNp4SYWKgjhUgvD8JioFg0i2m1Uai0mRwIZbf+/od78jHhM0 97/kW5CSG6vwfsPWut2vaul2v9cfp4P7Fah0v9+5XR3cb3DAwf0KtBkG/nEYQO4B5ZunxfrtudDT ETAzzliIb8RCHNc8a13Wdlt/FzfRf3CwCbRxsAIFB08/1g6GaibYp3PXpoLIqJJt79cdedC8DPel Nz0lpjI9yi2M3LLiCTpnvVBQVlX8LIz/A1+YvMQNCmVuZHN0cmVhbQ0KZW5kb2JqDQo3OCAwIG9i ag0KPDwvVHlwZS9Gb250L1N1YnR5cGUvVHJ1ZVR5cGUvTmFtZS9GNS9CYXNlRm9udC9BcmlhbC9F bmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvRm9udERlc2NyaXB0b3IgNzkgMCBSL0ZpcnN0Q2hhciAz Mi9MYXN0Q2hhciAzMi9XaWR0aHMgNTYzIDAgUj4+DQplbmRvYmoNCjc5IDAgb2JqDQo8PC9UeXBl L0ZvbnREZXNjcmlwdG9yL0ZvbnROYW1lL0FyaWFsL0ZsYWdzIDMyL0l0YWxpY0FuZ2xlIDAvQXNj ZW50IDkwNS9EZXNjZW50IC0yMTAvQ2FwSGVpZ2h0IDcyOC9BdmdXaWR0aCA0NDEvTWF4V2lkdGgg MjY2NS9Gb250V2VpZ2h0IDQwMC9YSGVpZ2h0IDI1MC9MZWFkaW5nIDMzL1N0ZW1WIDQ0L0ZvbnRC Qm94WyAtNjY1IC0yMTAgMjAwMCA3MjhdID4+DQplbmRvYmoNCjgwIDAgb2JqDQo8PC9UeXBlL1Bh Z2UvUGFyZW50IDIgMCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA1IDAgUj4+L1Byb2NTZXRbL1BE Ri9UZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9D b250ZW50cyA4MSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0Rldmlj ZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDU4Pj4NCmVuZG9iag0KODEgMCBvYmoNCjw8L0Zp bHRlci9GbGF0ZURlY29kZS9MZW5ndGggMTc3ND4+DQpzdHJlYW0NCnicrVldbxspFH2PlP/AYyKl eIb5XlWVHDu7m6pNs7XzsEqrCo+xPao9uDO42fz7vcxHAk5gqFRVahP3cIF7zj1c8GhciWJFc4He vh2NhaD5hi3R/WjO919H88c9G93SdVFSUfDy3Tt0OZ2gy/npyehPH/kEzVenJz7y4I+PghglvoeD FM13pyceWsu//jo9uT+7LgWrSibOv6L5+9OTKxgvY/QDswDHJFQH35+9MWB9z8Mp0bHTiq5Msf0g foFHJmwUvsBOeCkqvkW3NP/OBJqVnO+Lco0uaQ1puizKJfxmiBcSHwduU4ckxZEjNE2Oo74/bB8N 6MiPse8WOCLBcWDieZkJHRHsOyY2SnCM4ix9HYmuPk7QyCDDSy4E39mUqMjPh8WQocUADlbiAkvj Z9hlYdqbh0MNaQpIPB/HkQa9+m9fVKw2jogyTPQR72l5oJWJ7MDLcJw4rSYAXaQ6lJALEzhIcegY N4yOlwAb90zoJHQNHGYh1nNxD3JgRskFCU6Ihk9M0DDEmQ79ahe9y3obzcP2XgU2kkejWyn2j5Pr KfJGHyi4yhkr39zNzl9Rd1tCEG+w2BIQDbiphp3+Pbn9GX+bXs2vJvPrTzcmA4Qch5HbNMSDck50 7BhND/ttkVPB0Hi5BGnXaMoEy2XJoi9n0/H0yzm6YcV6s+DVUOSYPEeecQhbiKb20YbWaMFYiWpW CrR4NJsqbIfogcSGoQ2vxQWi5RIVYmgRkWJvRY0eaCGk/a9g+TJUxfbbR2xSdwoxMj2G3SJJ7M6v iu34vfx0dzM1cRtDYRK3KXw4YsB4NOwcdks7TiUBe1rLExAo7TMJ6VnwA/z8UIjNUF79UOeEmvBQ nMf4Mt/wypR0AmuPjgZYkx5lDvR0Sdews/Hk22w+/jw3ZRGW7hG3+B07btiWHQ07boi4mb2sjV7w GEkGBa3WbEj0UaKc1D3nwG7JgFhWoTUXaFXxHZKyQyWUQi0rMzdREpEIsqeHtVMCjVgQOVKiYiUl 1iLoKHGJ31PihO0oUbG/t2CikDyHpvYKiFKcHI2wp9tP3dOtYmW6/7m7+vzvQLpd4vfpdsKmHvYi HSvTff4mzs7alDY/tuk/f5Od1e0HRW2yarC6xHebPQhCnBzNvmDyVGjm+CHnO7CqkP+ybiXykGpW VHJZQvK/2g9KLn9eMnzue0NnbeTFzzNer2RpV6wpTGM/6OMs08dxOLPqPS9rGFkiikSxYyiH3wUt 4VSUdmFfhWzEnvfdXoBQveGH7RKcBy3ZFk78pfFMzCIcZXoQqzjDxHMWp4b9OL65G3/4Gdo9ulWS 0yRdkTth+1yp2DFaV1QcCsEPNRp/vh3y6oHQkSK/ztadvHogbKhoxW7rnc9oI+xUEgdH6qlUsU9U Wr29o9Jlkp5KF2yfGBX7e709lHfo4Fe8XRthzXkAd5VBZJdzDQs5tz/BaOiWHutZ0NLjtJ6OHids l0MNK+lps69URGvRP6QzA1VQbZ0XDwWWF5w+cMnBqZFivY2Rl5qnNh/R5m/dW1vTt08mryr9ZNIN ftlfuzuPFsguELjbOwtExYKtzq8nJgahWuQyXIJ3XYIbtu0S3LCdilSsWrigidbgmppVs23Kbezh TI/X8QJKGmKWKPoEGvMN3PeZ+RLjvRhkfT/wh94PAmDaM2jiRTTiEI0kShpSbNWYhp3lrKRVwU2s +c1lQRti6to6lWlY68YCp2cWItv4AXHF8qk41KDzjVRU99hR71lerApWS2EZzZxIS3SZrnsKVKFL tt/yx539KVAdAE2GsaP1MUmcFtI9BarQ2k5okMXYOxphKjAvOF6H0efgBAzdlhz6CdaR8weOFrSG yreqVl6gjvZYIwq+vyzq/NCc+PIY+APVcMjnG9SDGj95KCpwarCZ/lPj7ThMcEC02awaDl2KU95N nmrTN1ZnAgKUKlbgM/sRoEL1XdvPfXWcdXuRU4nKl0rHQ0uFzo6I2jFaAqUdgcBnycQDr77Dob3b 87rrE1B52C2gUeArq178VNFLG7CWnTy4wo5Jvy/qnTx02sKF2GATvGQIevIdB1Xxpq3YGRWfZiBj dRJrHmO3PEav0/JaHhXodfmUtC6ZltMvjbSxBb9AdPtAH6Ft5lXTKR9kpqGN7npfpDmpNeXy7tGn XHVc81d8qTwx1HFUiKpYHITRpUkgrVebymjTQSK/41GxwGqXKLnbi6deY1/xXNoD7JDR3HhFaLcZ PEv4O/QoxnruWnMVLzueHRMbDnpb2d/91WED32KpUHBD+SZ+KOqNpZ1J9UHmb01lmwLO7rKY7pBT oU0uZY7s3zg5RU/94+hApmTRVKEBwb5T6DDIAKPnA+1oSddsJ98Cjgv7f5Zz7s8NCmVuZHN0cmVh bQ0KZW5kb2JqDQo4MiAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8 PC9Gb250PDwvRjEgNSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDL0ltYWdl SV0gPj4vTWVkaWFCb3hbIDAgMCA2MTIgNzkyXSAvQ29udGVudHMgODMgMCBSL0dyb3VwPDwvVHlw ZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50 cyA1OT4+DQplbmRvYmoNCjgzIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDIx MTA+Pg0Kc3RyZWFtDQp4nI1Z227bOBB9D5B/4GMCpLJE3YGiQC7d3RRbIGjc3YegD4pNx9rakiDR TfP3O7woJpUMRRQo4uTMaDQ8M3OGXlz2vN5UK04+flxccl6ttmxNHhbLtvuxWL50bHFXPdVNxeu2 +fSJXN1ck6vl6cnij4hElCw3pycRCeFfROKM5FEYxAVZ7k9PQvIk/vvz9OTh7LbhrG8YP/9Bll9O Tz6DvfAxGpZxkNHENH44+4BgozAMCmpjb/pqg/mO4uwNnmDYNHmDvW4b3rc7cletfjJO7pu27erm iVxVA6Tpqm7W8Anxl9AoiP0endAiSD2hRT71+uWwe0HQaZQFkZ/jlMZTxzQMSwyd0iDyTGyaBxnJ yuJ9JPn89ZosEBpetZy3excTDfpFEAydCwZwEIkPrMiOsKsae7cwSCwk5pCGUZClFvTz767u2YBa pGVAbYsvVXOoeuyw47AMstwrmhh4UdhQSi8wcFwEiaffJJ2GAC8eYug88XWclElg5+IB6MBQysV5 kFMLX2DQJAlKG/rDTXqfeCXn4fXeBUrKk8WdIPvX69sbEi7+rqCrnLHmw/f783fYrUoI/L2WUD0Q vu3bw9OW7AUrdmTVNpv66dDLCgkwUhVFEKa2K5SAZSoIaGGXW0a6tuek4ryvHw+cEYjkv8PA3dWf 0aMPCHTFOg4xB2gvhkMJqW3mzGA0l0Eo6Cw2WlARRPAPez4ccQIzybK4a3t0KhUyWhPNySWGplCm U7ROJmYCTV+chGkyYFiolGSCdaaO+pEv8mBMDh1LpC2aMOZIlnaj6LNmHWvWA2kboDEjMGPl37im F0bfJINz84tFRp2WHvNJR21hL1WYEF5F7i//uSXDc81XW7KqGvLIyABigLdoF4Q+Ad3VcritfjHS tA28Zk/2bS9ft9rt3OHnJke2aLvTdLXgrzlHiZJCW6e2EZb3KEsFZy0sWrs5FTrKwt7Cu6qMbquB QA5fo7uQZ75qe5iEXSv1lDslWRbE6VgDox6rmjXZ1DvQmeJT1+7q1Qt5riG9cFgHodUk0aBVSXah U0bSy3qEiBydSVlQ2mg09DCZOpbZcL4p6NFXtEjb+YesPNsfdrzuoFrkJ0jjeRSe6YO+0L8UrBI/ QGbFX9WHSYrFrzrxV5GrmmnvMmXyp0fxhLQ8E8kLzj+UM3WW0GOsIJo34NSYEQP5+v1+CfTnRvGI cx+q/UzBxyWoUsu9s5nFHnMgjYqjNzUH8EmgNw7LRjQEd3O34Ogyo5YTC/tXi0/SsbBM/OXM5KAg hEB2WjbOBCZe00DIsVnS53GQFomNlY0ATXUJBjZeVkmNt7AyKAu/aKIsD6IJdg36e8V3L0I7NfAT 9Alo81sIcQvncPHaMTBypiCQJsng5ohwlUxSGJyGcpADwsUsJYksM5RZaQQjzcZKZmGtTIsGOybN LFRKqv3EskGlJHS+qf9lf2h+yuJ37x1eD9CLh4WFg7A7jkyxPFPnweTh0Uc1lwVd8JaR233iMS/G 0kkmk+g4Qx1MoWEc0Mg2xphCYWdOJljFlOOAXqHnA/0otm31fUmn7kte5zM6QeGEJykRkwK9oshl vflkMI2B0YWNfcT3RXkysdl4WL9p+/1EOaBZzMRWZTlAS4HGsmxMLHBTUPTQkUd1pYQ1PK0sLeML qX5gmkopjbaqOMj9AkyyEGSNBV1XvNJnOlM71Ki/Td/uj6nD+7KUlpalgwNjp6I+XUfduVhY4MAv UImbGk72sVLKcKan+DxqPBgTC6cxYOcRwx4+xaO+QWeGE+zIkxkpi/p/M/dTD+EUizu82BJOdE44 WTbzwsmCzwgnC3vz1/Wdm2F+rpXGsrAwqHBRpkvfMlCizD02LQOHfisgixO08xwzL/0mbt7e9ffO XuyF1RuohXWsTlGUCoHi5ToCDicT7Iws1Ifo5R0SLM7PxOKykAsqVI+wfgm+QdPuoZlciJXe1RVj cY01Ood2KP1o7UNkl3ze1qut3Iik35518PRh2x52a1L1ff3L3detB1yQ+lWEOqNKw6PRG4VUzS0W IEcFMU0nuFKkMscm1kni3I/ENPMnsYn9V8xKraXgVceLUzhm/E5HX5xafkS23BfsXiHGNBH93cI6 OqUeNRYca2cxzPKpa0en1FPJz7WaShbW2SnVKm/h50imrk0sE3Vf5OR1ZJSyvraTdTsYBYauy6FQ F5YLWYt7NgzVExvIRNQAYZjsCPWwdUcVGiU6O73HaWgaOd3THBkQ79SChYUmLTMCLyTvyeCFqmGo n6BA1use3prU6oq2Yfy57X/K/PdsbE4zPUbsfcfDJjtWDeJSlbnEtO7IpinevOW9uAkVu5FXA9MV atoGZvfVJy4vreShO99T3NWNlDusUCro77pNuCsTavJZzt2EMaFo0pR6MqHydg6Oct23XcfWKC21 dvF5ikoLlJMvKQ3orWLcUPOD/DKLOFqWrljTHN111V2YCb27MYkvBgHaSIFpuWUrRwbperapf4/f XTiTIe7gtK1ZTONXC9VuaFWjcuxxoiMkueULHSvq62ATeqeCvWE79qQyO7JcMBzdutPA74nqNcPM h9taMJrouaIxoFKO+ekUzQ/DGJUpmh9ISG9USuGxMkXiQsramOK5jck0mV+YTPTMvmRCv6HfTqqr Qy+36gskE6oEwOyltLoNNA2diS695KAIx7PZmFDXlqK+1/VxrBcaEzqzo6il1Mu3WmdMqM+G0rdw Amo5kTuHq2ij5Mh5fDf51h5mTtR0w3pyuYb1iNcD27OGj5IBk4dga3tQi8/rOuOMPz5OpPfue2ev cWkei9o3/byh5P+VGJCJDQplbmRzdHJlYW0NCmVuZG9iag0KODQgMCBvYmoNCjw8L1R5cGUvUGFn ZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBSL0YyIDcgMCBSPj4vUHJv Y1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNjEy IDc5Ml0gL0NvbnRlbnRzIDg1IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kv Q1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNjA+Pg0KZW5kb2JqDQo4NSAwIG9i ag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxODgxPj4NCnN0cmVhbQ0KeJyNWVtv00oQ fq/U/7CPIBXHXl/iVAgpaeFQRI8qGg4PFQ+Ls0msOt7Idlr678/s2k523c56hQQUfTM7nvnmymRe NfmaZQ35+HEybxqWbfmKPEyWYv97snzZ88kd2+Qla3JRfvpEFtdXZLE8P5t8CUhAyXJ9fhYQH34F JEzINPC9MCXL3fmZTzbyt3/Ozx7e3ZQNr0revP9Nlt/Ozz6DvNTRC85CL6GRLvzw7gOCDXzfS6mJ va7YGtMdhMkrPMGwcfQKeyXKphIFuWPZI2/IfSnEPi83ZMFqcNMiL1fwE6IvooEXuj0d0dSLHaHp dKj126F4QdBxkHiBm+KYhkPF1PdnGDqmXuDo2HjqJSSZpW8jyefbKzJBaLgQTSN2NiZq9AvAGDpm DODAEhdYmpxgixz7Nt+LDCSmkPqBl8QG9PPffV7xGpWIZx41Jb6x8sAqLNihP/OSqZM1IfAiNaGU XmDgMPUiR71RPDQBPtzH0NPIVXE0izzTFw9AB45SLpx6U2rgUSZHkTczob/tpHexV3EePu9NoKI8 mdxJst9e3VwTf/KdQVV5x8sPP+/fv8HuNoVA32iyTYE0UE0N7K8tLwkje1E1JK9JJsp1vjlUkGGN QNmXpp4fm3q27ImDnvv5fzdo2kw9OjWlsFreRd/A/phjYDAndVU8Szx/gF1Wh7ohrGmq/M+h4Wg2 R1AuDcEL0mxxmqmwJPQEr5/zJtuSRj5XK9EfAt6rUDcDUaEsGDrmqycO5bDmO15ijS0MA+VoXQ5N yjZ/DeyO1zXkT03WldiBnUALRQ+cEO23xlq9LzirSvWN+4qv87+g7SDbomj/scjLRw+1iUYqRrFz /6CJO/l17HLLK0527IX84aQUNvZSaIFQcQ1xjGQ0hMo/wKLspVBjUlfFUGT8AbZlb5u/4Fw0+Xzl U10S4gCT17OoHrHCGlJJeV3mgvAnKBj5GiJZvNijEmipcv99Pr+SBUaxAJh0LDSErVbQ6Wq0cVFF UF2ZZ29yBtZqYjxzoFhHHAPbJa6RjaTiGc+f4PNK0bS5Y6uGbdEytI4ULdMCjE8RTDqRo+IogFZo QjU63f68X8rEsHpwqo1uq7zOWLXiK2yKphBLaspgsQwoxHKAtfbJYKxPwtgWwxgfxp221AvgV4SW oW6fMGQsAe0N1uHoqtKuHgYWHF8+orakvkx8Q2A+0rC6wmLIWD1IXTwIpe1Nba+ZoSNv1tqMwWQL hG+VP1+QvCEZKyXPaq56jJokVNc5tmS8VcA7Qao5UYpheQy1U+axjh9r+n2gdBk0RuBvf4BVXytL XZHD/sLsZd2Q7A0jYj3Suw2x8fnLgI/MXwb2q9CnJCxvo5R6sZvDIHhydHejk4H8V5B9u3XX/db9 nBeFJNGeV2tR7dpRQzEOpq7tkE/onhtDPXQyShoPn3rEdVcAVfZPz9YHGPiOzx6NBAufVaGUjTSH YbAWhypDK618a6plU9cxyUrwuhzITL7Q4fWlq0y6io++v0g+DSVf3W06+huPNyc+87953UjnFyJj 8GHtyaNG23Pb8gxt1oIUOhSkKEr0kk7RUtGlv4H/BTt2IT15n/GSVbnAUhsYAQOdIWu1PHKxnFJX 7uvIG7muPfeG12A42jOmcmI1hOU3XsAMdmAFTG+3MJL1XOpHMwZpUmZbUdlqrpwxwrC/gx2qCsaf wn7CM0Re5BIAox88CrPSVlIICn+951m+xi8YahA09KAmtoOggYXh2PCadAVaxGBanrk9FSUwR7hB VSzDNHkb+YpDsQOHQrm39dpmaMjal3XsndrKyFU3havLmf06ZYhbDU9cDIfe5egwHbngUDrROhn4 qezAhgQMFapEHfaQNltoYfadzZDF9zu1mBvYAvaigmwqVh4KoFbz0pdD0rA/BVdzDj6bSI9QjRj5 TvYQVjbmqpQJSDUovP1Obb/gGRpHlm0D2y3pcpYgK/6UZ9h4FMWhN5C1p5STSW1KGdB5g9+8Z0MT Cs5qFC89LffDHgz7b+dOqApiz2uykwtQO45eKj/c3D1FPYaVK/lzcgyBR2wzp3zN1/JmJbKD2hXr w2bD5RlIDr2hacGlvaoZCi0P06lrihlI9bVtecAM6SZdpweCJJbDhxu23bio3FhOFxoCvUo8Q2tS 3pHzMCtfyCNkl/y7MrdrYhwdPWTnjg3FKJ8UpXXkjbGgjJge0aPcTh7koc2iG27nGU3EHiU5U5+C lJD2ptKGyr436qJo1eiGHB2LEaBrCTp0xDFSuTWm7cfI9LIXKl1R72H9aq08M2JLevL4iTnEjHOz rcRhsz0tGD/mpDuMakP+yENy0u0eUuuA7XzQskEXQa8HMMoOtKPXoG4IdFLbxl+HDi7jF0RU9puz LjyyturQNpDHMNqmkXa/1IXxTVR2BheL+nDJ8b6Dfvmc+peXkyQ6XsG66wQja2gvObT0rmijz7d3 OF2pdWqaOv0/jzyhGUXg+uuV/GOkCrQk0GTRKtClto7Fq0AqD0w69NUX/g86dx0rDQplbmRzdHJl YW0NCmVuZG9iag0KODYgMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2Vz PDwvRm9udDw8L0YxIDUgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFn ZUldID4+L01lZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDg3IDAgUi9Hcm91cDw8L1R5 cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVu dHMgNjE+Pg0KZW5kb2JqDQo4NyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAy MDkxPj4NCnN0cmVhbQ0KeJydWV1v28gOfQ+Q/zCPKZDK+pYNLBawE+9dF01rxOreu+gWgWKPbaGy xivJSfvvl5yR7Bk7lLQXBVrXOeRQnEPyUBmMiypdJ8uK/fLLYFxVyXLLV+zrIBb7b4P4554P5skm zZMqFfmvv7LJ/R2bxNdXg98c5rgsXl9fOcyGPw7zQhY5tuUNWby7vrLZBv/6z/XV15tZXvEi59W7 byz+cH01BXv00RiOPCt0fd346817AuvYtjV0Tex9kawp344XXuAZhQ38C+ydyKtCZGyeLL/zii1y IfZpvmGTpIQ0TdJ8Bf8j/PmuY3n9jvbdoRX0hA6jc68fDtlPAh04oeX0cxy43rlj17ZHFDpwLadn YoPIClk4Gr6NZNOHOzYgaDgRVSV2bUzU6OdAMG5XMICDSPrAhuEJNkmpZ7Mt30BSDl3bscLAgE5/ 7NOCl6RFMLJc0+JDkh+Sgrpszx5ZYdQrGg94MTShrntLgb2h5ff06wfnIcCD2xQ68vs6VrTXkV+B DpyknGdbZurIIALft0augf3WTvo+8UrOw+O9CZSUZ4M5kv3hbnbP7MHHBLrKDc/ff1m8e4Pddd8L weOxiOItZ0mWiVeolHIp9pyJNbv//W7+ErJktQJmlby02KxiyyRnz1RivREk1nDMWQm9rtoW4rDZ kt2yjih0tU4Mh1NwF7h5BiebvGraBnZ+T3Ztx3LPwHSHByKfYfeFqMRSZLdMFGyH9ZWxpcjX6eZQ yF5jUYmzPcuN+h0M3ST0iP532Sl15GzNSrGTV1vBfe8Lvk5/1NedluqiBNsmL5zlIq9/fsvSiqW7 fZbS3QVDcsPTQUtRAGP2Qk60hj8sKct0k+94XrEdr7ZihYfmojoSL81lXDDdX0XxncpV4NtYOMaB bYHZPXKqcqUjoSAKrgKEgCA4yAwn2/HQGgam/Q9I2DKtyGHqRh628F7RuUP7wj9cTomZhISV5lVC mZJ9b2RFppvJoWrJXTDSJrI6CY6tinSJZC7Zw5dFzJ45O6CASUoMY5fygsHAXX7H63xWokZS67An b9RBxWIc1trhnK4Oh6GHQI/g2K/JnISo03wTXksxtoCov+yp+g8DbEKGYWvUblfUkoSB777tT0dG MMwxaB0bb2UJy5th5Z4v0zVW7Fa8InXVBTT3UbJnqTkBuaxFaVth4AA8nrNX6rWs1SuZWAdIawem baOAz3xgmYk8+8n2vFiLYqciA76R6jIAHhue2+MHfp3iF0VVste02rLF+I9Zx+3qluSIiVwcMQb2 d1FCX6ugVJ4PFaeIXxe2YUk3gaHMJ4W94JvXo0r8kW9UiUNeZ005w0DqA58c0i7OR8OA5Ioa6Aa2 WY9IekUoaEn3F+nw+6Qjss/SQSek3jQNk3khljjpGu3ks46nqAlgOGl9iqBXE/H98Kwx7OvI4OOK 4xiGGoNSa8JUoxmbuJrVpE6RAs9w31p5vqt1qP9uec5fYDwkzbEF//sA8wSjKviSpy8YVSF2WDmw tWFr2EIh3bIkX0lp0HoWro9efVbtGfzN5kcB0j6+DfuV4Eqb8B9pSb0QqHckw7BjSTKwtd5phmSV PGf8Vn614i/psv1xPdyBG0+vaZaxDaQXZCYI+ZyBNCh+1oKKemyYXH5g+iFTpNSKgT1OyQrPjDF4 9tfNZBH/9e62Fv0dTwC7z9FbKb3AyMqk1HomTevCN4wVnZ4W8fgx7ngC3ayjLRvYjrZsYHGZytI1 r9JGbAPB6xs5yuzWzOAG1XiDVDyM//eEz/j0OF3MP39aTJ/i2cPUYnhQDF1Bpa2W9U1R1UM2JXmv jsKVozkqyUqBlSiK1UmOy8DJVMEWi4+ve+l4B2FgYSU5sbUklShIiajfIV4Y4SZ19lgFT1aUEved yOrp3HdhvTehdZKA9rJJtaY60GofjRTn62vjOUV4GHFYp4a1ohKVaN+X/NUtepSI5zkydbpZZyXX m6th1HCfMoHrHJkWpPdwaDkmtEeLUNn2tF71dgFR6YNWjZzWHZD8dz3Jaa9HE1VhOVppX05EqNlc vGZ8teFyUb6YjHgViG3f8YxTSl7AGeTLLRffWBkG1Lu7evM2sO0Pa+uVoniO/QqeCuoGauY02c9q oZ3gPgTtmN578FutmYbVbWv47sjWs1hRgSoy1hF8nP0hO3N7vRiu6eKSrcnAdtVWFIBAMyxopriQ DgNaP1VrTiKN6eczrR5V48f50/xxOh8/Tp/upx/Hf1LV48H0AFFk+KQbuxwCBlYOWg6rLJOjFgKR E6w1ftzXjyLx30w61RV0+/aDcDm/rPMNKLRDWolDySBNtALGeJT2TXtcCq7ChpA6LySNnCTnazlr OOsifWtUuKqa5Xk/jad3Mbl0q1equt3nT0rlmHKKX6ipE/Nai1933R67fbpmxeH2V9c63mKzdfui q6NJnateXOvQhILCvLdNKCkm1BvuXgHUt6FBFWPxxS6UHK6PeBXNdnVBYQE/LVqzjNLmGLGAxfQW Np+MA9VO5UiKHC9CQa+7mCluHLnC1e/EThrmSOPWoIanwm0pPBD8IAcN9BvTYPL5y6d7RWGy6lz8 vZXup6PH151Qt+hQwzr0/9lHnMg2U/LeH91k1IsRX74p0m1ki5ZG8l7kJ/HOsW/W9beNz+bK8fM4 RwR89urv1deoCvBfoB0QTX2FwByfwXD2W5pVSED8HCMEV1SSTwFITRBCetjtOfHDt/p7reNWfJml OXnptULXfXRPgH7s9Xzjqt6eAOdV1sE0zWcX0zSokniktLEl7TU8+dJJqiAqCPmK7B+1/tQdDQpl bmRzdHJlYW0NCmVuZG9iag0KODggMCBvYmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVz b3VyY2VzPDwvRm9udDw8L0YxIDUgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdl Qy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDg5IDAgUi9Hcm91 cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVj dFBhcmVudHMgNjI+Pg0KZW5kb2JqDQo4OSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xl bmd0aCAxODkwPj4NCnN0cmVhbQ0KeJytWW1v2zYQ/h4g/4EfUyCVRVKSJaAo4Ldu7pLUs9VtQFAE ik0nwmwpk5Sk/fc7UpJN2ibFdGuBJiqeOx6fe+Hx2BsUVbpOlhX68KE3qKpk+chW6LYX50/fevGP J9abJQ9pllRpnn38iIbjERrG52e9TxhhguL1+RlGLvzFiAaoj12Hhijenp+56IH/88v52e3FNKtY kbHq3TcUfz4/m4A819EKRtQJiCcL316812Cx6zohUbHjIlnrdGMaHOGRDut7R9hRnlVFvkGzZPk3 q9Aiy/OnNHtAw6QEmoZptoIvjT6PYIfaLe2R0PEtoWH/UOvn580PDdrHgYPtFPuEHiomrhvp0D5x sCWxft8JUBCFp5Focj1CPU0YDvOqyremSJTCD4MxpMsYwIElNrAw2MOGqW5vruMpSJ1C4mIn8BXo 5PtTWrBSK+FHDlElPifZc1LonE3dyAn6VtZQiItQhRJyqQPT0PEs9Xr+oQmwcVeH7nu2iuuwl5G3 EA5MG3LUdVTqMNZBPc+JiIL9Zg56G3tFzMP2TgJFyKPejAf79Wg6Rm7vKoGqcsGy918X705Ed51C oG+XQn8+soy9sAIlaPzraPbioYJtGJQllJbw65KlL5BB6yLfouqRoce8rC5RuhYfZZVUDOVrc8IG ZL+arr4GvGR6KhYWYFA1f3BDatPuhl++3owv0QoshIWrPSJDw0WMkmyFPqUbOCVQnNxvmKN1FQQB UVcz74FKRWe63nMF5TzLXzds9cC2YAp6TatHYC1jr72C3UNZR2X6kB1TaVyMBBJhnGZWgIMu4Wel PXP6hJ85iugmXbMq3TJdWYDQ9nxVRFtCaJ8XHQWbr48dUOXovvYLMIDqMDJuFUuRyG3Veaw52xW8 UbMfuYrHuE3aXiB0XKJKdHCHAyhPByIdrlGwwF2SNdSJkKkzaR/luuoFJxMUOkXXzRix+gC41Ba9 KHAiVapJISOF/VCNw5/KNeoSYXLfdGzLNQx31TA4Un1osajfVmTXwQ5xdHtpQkcRWQi6r6E7SDNR wJp0bvsy3V6I57h9VZVxL8SqHvNDRjWtYysyXh/VosO1wxLwkS0Wjjn3AFt3tb3JC0SIudpYLUF8 SEhbbJ/yymSHjXzeCCnYwZL3geaGxUo5DVwRG1bYEPPuxgrrudQhtliIz8gS6gWOJW1eEDpYhd6w 73CJMUSq77m8w7HSX+eAGyg5UHTc8hR8Vw5YYaEnoyq0KQrzye+6gAK+KbXT3yaAFRbaIfcAu4DD //lJnKuiDmtb4UiEi80ybRgq2P0fbTi4PMiOibpbxIN5bG65rOwSAeGF5E0LNHVJEdPuAUOF8cip NfTXrtAJfVViMPpNEDVny7xYNe2OoWugYcgvS6qJOmwEvqGH2+n0TR8C/hR32ltncIT37q6mf0y0 NxeocqHdFmo3AtOHbjTob+YsipR+u60bZfQvRYIG8xnPWgNRJAh4NiqSullRc8Qc2nTij84rFK57 J5kYT+LJKJ5+uTFnjbq0kW7qnaTbQCH0TkSV66L7eA00noyaVNjmL22n+BaOfMyHXIpq0ynQEmNj dk0MHzDRt7HfdO6KqJab0OUlW8HGUAry50pse5rBLa6C5hmuSJ9iq6gRdfaU3eIW3EGMjc2CGBoG P0uMItpBjIJtc9R821RE5rMr83jLypgm7VXNUsjqijH0BlC4rZZo+kAV++ZEUMQtEsHKtNrffOih 8zfap7OWbSLcKWvpGDzaYRvPyNj/WEwUXTYc2thZc8jHQW9IyqY3UcS6DrUTa3T0JorEfHL1fxRk RacNh8oWjRxi76c4lMU6OTxeA/qCm958MkS8nxZDqmbSY1uQ32p3S4xit2lmQC3mHySSyjt/rdBO P/h1AK5LioCwOugaduCwz7NXkTQa7tkYDmmu2I275jayxKzIl6w0t44yvtyNdjp3S+CYghySpY2b 9a0mO8QjO3XxY1qiJ7GDkg+EV4yPhvlAOC9aI5Oy+b9ktSoApxuqeTQCvbJ2Y64RHO6Au3n/u/d+ dJHUP5rlxe8F++eZlVX9kTe4ZZ6t02Jbf4DxDbIZaYuveq4tlIp3N/68KT7rJwOjfe6edT5X5MPG xgzQPp21dHQcHrKaVc5KlOUVYt/TUle0aNDnl2VZTnus109MMjTNhKH39eMtqvgU1LxPHHk7aS66 Yi/pkqHXdLNBD+CWgk8ld4PhRv9wEWsf1OoLvKxWf9cXd08Zyp8T9q8465RtVnyAb9xAuI+4+2Ze HZiHirKI+QJfz9RlvINisG9XocWLAwTf7lVI7EA8ORiNhktxq/F68Ncdt/puPlnMvtwsJnfx9HpS r1PmzwV4o4215n2jTYen+uU+1QZhvZa/z7RkU+b82ScvVhDFjTeF7Q6aSg8AoDLZFCxZyS4X83Xj Sl6gxNLuLa46ejfTeYiEYs4qazJ6iFLM00XGXyJdOW56ZhncxJt50CkLdLzC1AeyLGAeYcrIXbh3 BQ/1OoJHRy4OBLmSvK6aE0L5SStDj86efwGzs4m9DQplbmRzdHJlYW0NCmVuZG9iag0KOTAgMCBv YmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBS Pj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDkxIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3Bh cmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNjM+Pg0KZW5kb2JqDQo5 MSAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyMTg0Pj4NCnN0cmVhbQ0KeJyl Wm1P3EYQ/o7Ef9iPRCI+e/0uVZXu4NISEULBfVMUIYczwephI59Dm3/f2ZeDHd/t7tAmUnK5PDOe nXnmZcfM5sPY3tW3I/vhh9l8HOvb+2bFPs2q/vHzrPr+2Mwu669tV49t3/34I1ucnrBFdXgwexex iLPq7vAgYiH8jlicsTwKg7hg1cPhQci+ij9+Ojz4dHTWjc3QNeObz6x6f3iwBHmhYytYxkHGE1P4 09FbCzYKw6DgGHs61Hc23VGc7eCZDZsmO9iTvhuHfs0u69u/mpFdd33/2HZf2aLegJsWbbeCf1n0 JTwKYtqjE14EKRFa5FOt77+tv1vQaZQFEU1xyuOpYh6GpQ2d8iAiOjbNg4xlZbEfyZYfTtjMQsNF P479g4uJBv0iMIb7jAEcWEKBFdkLbNHazhYGCULaFPIwCrIUQZf/PLZDs7FKpGXAscT7uvtWD7Zg x2EZZDnJmhh4UWAo58c2cFwECVFvkk5NgIOHNnSeUBUr2pvIT0CHxkq5OAyw6yJugyZJUHKE/ewm PcVeyXk43l6gpDybXQqyfzg5O2Xh7LyGqnLUdG9/vX6zh90qhUDfcwr9ft90zVMzsJqd/nxy+WQr ajkXRQ2JZjZsEQZhirHWYgnx4BPs0DxaCxGH6jLFW4kPwUsm2HbDhua2aZ+gLNwN/QMb7xt5cCth ojzIsY5NM4DDbPgsDEqMP2btnXxOBSFy1raMI0vbji2uq2NWdyspvxnrsWG9UtZAR/nOWmvax0Ay SE2kU0bYFra4zIJwInBzXc2vKttR4xJyCeGP2QbaG5hnLXMJ9BEkYvVIFE21q/M7PZgafQQ5auzZ FxVpqwN4nIvSinTcnJ/9tgxYdW99ri6BSGrd3jVj+2Dzgq5XSMSqvohEJcQHs2KLHVMmZJHhsRY7 LioYfpTb3bHRjMG9H+Z/3JzOT225zqGvcCx0c3m1vJxfLW9Ol+fzP5Wj1w1MRUz4T1hcrze9yNl+ WEHOQkqM9lgoo3j2ol8ePHBPgUjArTrkeyune2pEUuAednHtK4ch95Ss+34zyrpiy80Q6mSOFe2U ENdR0zKceFEEw5k/UZaK+CJJmT++qsCzTBRqJGgt6nkskhRh99RFle7OA+YFsTBqmiAB4Gu1PKnO Pl5ozuqM36nO8uTSGJEctmhB6S0nFjkrKIJaEy6NxHUAYd0ugTjE6csJISM9LjEFAnZ2B63KeiuK Aj6RsN+gYFCcYC/m7smEplhNJggLk/Nj30HBuesHGbp6tYLvNmwn73r438HtQLj6PSvu+lWzOWar Zt0AO59JId00mpRp1Pz+nCUvSep8VsJfnuXIZpgyE7gWIzi9JUJzEw4zhW8WH3+9OHX3RCg70OCQ mK8nwtwUTkTsl6pcFDeElXkHIZsmntOFMCBiF75NyiPVfuRHGR75qX8ThdBL1bdbpI6n/DzvBAI+ x/p79bWYz8TfQCqgkfpKADthmlJmqwkwv4lqatqon/uuXY+CieJzJbTVX9ZNYD1qVoi2jhS53RIa 6TG9H3iGfiTr6XIIu2pu123X7GYd6nbk7EjKBIdW88LdqZGUr9sBFpoWEtHdbpryepC3jSHqioEU uc+Wh/85PkjWEx+EHRqVF/9tGpGXIqSPHkloBvsiSQyPKa0qlzU+7vCYiuz7t0Sc04SKu5vO10qm qXV9kAcxpz1G+SU2+HKmS1Ot/nJ7BubvkGN5KxOSVOaFiRXX8zdvyyPbFT2CG0uZE/UXZZBPsH+3 4706xgDU/ns2NF/E49pO189N+7XDxVUQUkKetjVWMhMX642EiJv7sfjg9i03OotoJO7eiuCePhcl ifQ+J/Q5PTMhLJ4vJW91Ixdfg7+M65O14OQpXK1JJkh3xGLnGr9QzTFtRKEkF5LweURdG5CIVb0a 9hC2F1Ondojkjior7l2HulUjPao6vExjuko4HQMEeJbfCQs19fW0hJQ513yRb80Xg2licbLVJhba 8Nt2Fv3mBIlcCye6L/II77kDI+yH+vZe9HqInIrS8wsRm4egrsJwaH3gjoc4aREqFtKkA28dFFMo qq5GNCykYELFqsKBsOp10mz5BLxzL0FJj+DQfEIqVt3DadgyFfMEws5vxQsY95sCknJ9caBhddpT sHqDQsPKvk+DJllAdFsCg3uEoRfNPyNzMTVNQvFqgaRf5UCUoBwYRrb95b6dI0FIY/fcidAi46+W v8xOPl4wdg3t9duj7Fyyerp3m0iPNcwlhDmeYH3HSjIgdLZzLOsbkaQsd/C2diNuOsUE61ytpyl4 raCdVoaRi30YxWxdyhDes/hCWKfZukYhAR+PyJbriZ5kuX5Lig2xYoFZE+zVuW3zpevp5IgOXulC idXLdba56PazU9QCsq/UlpDkKvWeBcdYXGPd9xSSZxUzxbLtFcQ04D5eGlCXyXoEMeHe6oasVit7 V4zVm6PJE7yUMOC2H1ThUD6LPZrdbNELsr1SNoLFPIjIwdJ0JMRK3TVQqJ5X5x6KmdY7GSb2gK9g mAH3McyAes3WdxNTxrOHNqEVVIH+m26+Z92mgUbcii3hu4oQcLVgoTpCvW6g+EHXEdMN8pbkiRzB BSpyUfGqyBlwX+QMKDlyhowvcqbhojzMGbQMf8YbYlfNQ//UuGceNdoiu/b9cld2Q1rOd57YEZwg Yyfa8StiZ8I9sTOhtjdmes9gQkUHAGcQRgiKLXqCMKGeAQI5ZHniqv/qJ7JIutWrURJUccyEmhx7 PXNMTQTmUGxUzBF74Fcwx4D7mGNAnYVKD6om3jcRUK3ecoxg9ZZjphUejhnQK9u8o39GysSeq3D/ Tz4YCil8IBxL8SF51YRown18MKAkPiQZnQ9TqxO4017MrpYLeaWVm9jtG15i/6Y6QvVvih9U/ya7 YRu5ZP/kJdds/wJG/5MkDQplbmRzdHJlYW0NCmVuZG9iag0KOTIgMCBvYmoNCjw8L1R5cGUvUGFn ZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBSPj4vUHJvY1NldFsvUERG L1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0Nv bnRlbnRzIDkzIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNl UkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNjQ+Pg0KZW5kb2JqDQo5MyAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyMDExPj4NCnN0cmVhbQ0KeJydWm1v2zYQ/h4g/4Ef0yKV JerVQFHAjt3BRZJ5iYutSItAcehYmC0Zspwm/35HkbJ5ckgxy4CiQZ87Hu/lueNpvUFZZYt0XpHP n3uDqkrnS/ZI7nqzYvOrN3vdsN40fcrytMqK/MsXMhxdkOHs9KT31SMeJbPF6YlHXPjPI35EYs91 /ITM1qcnLnnif/xxenJ3NskrVuas+vCLzL6dnoxBnutoBPu+E9FAFb47+6TBeq7rJBRjR2W60On2 /OgIT3TYMDjCXhR5VRYrMk3n/7KK3OZFscnyJzJMt+CmYZY/wm8afQH1HN/u6IAmTmgJTeK21m+7 1asGHXqR49kpDqnfVkxdt69Dh9TxLB0bxk5Eon7yNpKMry5IT5OGw6KqirUpE5X088AY2mUM4MAS G1gSHWDDTHc31wkQUqeQup4ThQg6ftlkJdtqJcK+Q7HEtzTfpaUu2L7bd6LYyhof8iLBUErPdWA/ cQJLvUHYNgEu7urQcWCrWKS9iryDdGDalPNdB7vO83XQIHD6FGF/mZPext465+F6bwLrlCe9KU/2 q4vJiLi9yxRY5Yzln77ffng7uyPQti8gXnaO7uwY8gYIFQlcj/bkpaU/iDLFUkajPRujQ7dltKc1 W/YBJDItiznbbkmx0FkdQcJRLKQl+JhygkfYbr9QCLob6k848gvt8ovgQxod9M2W2ZZs5F3hr49s mz3lwICLoiTbKq3Yiv9LuqsKLV/FDo2xVl0TlWWHsPMiX2RPu7KmV5Ju5flGRveUTJlMnyOSPj6W tZ35I1lzqlqtXkmjGbRNpmaGQRoP+hwdJ3ix0xIyGhz2lRD+vWQ5e2YlScloMCLXt9zvJZuz7Jn7 vSzWpFoysiy21TnJFvUvOjt8oAWsvfEE6MyLymxVrDTGLCfD21ntwGUKjtSmcuLypESyG1aus6pi j7pEBqJLWjL63kOP9Zdskb3oBPohb1ZI4FzbJUSjQuAnCAdkH4M75+w3YTB3vRLFHUYXRpDJoVS0 hTmNB6suGyCO+hehrirIgzaKzQ1UXbeDi/vb2eBmpq06CEOMZRwygwNX2YJV2XpvgNF8GDz34vLi W1Lfozb4avDPPc/R+9H4cvDDIZMFeIRcDyBddXYlCW/vSPF2U+RbVjMKN6jJUKNhAT3IH5VHAWpK SG8gq3NgrBUDd+99XVtZqY4wHgTt+uABMRadk/8bySYqqlKIpNZXXp2MKvp++Of365GIpK7oo8Tx sFRzVe2AHTqtc/TjC+UzCcLC/Y0u9JIDtuL9pJVJ5rkUietn2KRmEBXLk5OXyeXk63g2uRrrvEyD OiaqqEMG+cFKSEjIrCyH0HYWjKvU29dsBc9LMksfVkzXKbzQg5EIyxlPCBIl8yfGEvbAKS7FEh2Z IIcWJNIxtCAspEJqDieCN07+nVVLWUzmPoykDZUj6gyhReWQoxo2Ojt+o4jMJd54UJWUNHk/vRlP BzdjwZbm9w+S1zpFpC7C8o60ZfBHyieHFqdqJ1xx2zBpp1bJxKAABCtZ+oGBToYJdO9T7RjShycS Uq+wstGkIDpqQIfOa1NgNPbrtAssCozC7JK0sOMVXLojV+TYiuQ6Ck1MZlZWSe+pUGMGCsf5wbuZ sCloVVTLW2LMQ1izQfyN5TcjrgYZ8T1XgLGHaRjyuSaKKi2fICDNnCDHkSLfd2L5L2wr8CazfL78 aY4SDMQ9VXPFua7HH2Ygjv3r+/jmx3mdkF3p7MMDfX9aFxV7Ie8MSERLOpTyFzLCHozUCfUha0Ms 9C6mEhsVJN8MV8e8YXQLf9k3KtADx9w1kZx+eVpvDxBWITEdFfgxpw0k1REwOaZbGeW7lDMGwkoW 1UnAuydpSeDhVkcfoe+05FQeNcYlogchW8KVzIBk9Y/FuHaZiuVviEPaGJ6+Ng3cD93j+DXFPC9K cQ5flb9jfEdKLbk1iEMgcSSpXR7A1BJiqHGr41tsu3yqFGm97aJd2y4kcluT4FU6X2aCZi22U7Ic qIa/ju4RWG2neOVgszqu4drkofh4Y4eVXGuFDQI+gSOs+GDTGz9DwmnJx62Z2eYICvTm2mLFLISw gznfq5mHUSvlckK3w8pCssKKV7AVNnB9vmu0w8Lw3LeExvU+EmGv2UtFTPkXBuAPO/11YtM4QYld VkT8yCWg8mMOL1YEJLnbyMWVeUOL5Cr9txyxwUFoYmGdoDVsXMcSKwxix6eto4w+5GslS+WyjlUR vfGykFXwDDpJsTM3NhVfKS6aQGuD+NYrha8zQt7hv9YN60G1w33qDY3e40udd3pPEdE7T3zqRtgO PyvQOv0H5Obyh2X6K7I3bF08y6ndTEX4Im/86Bzn8U/pyHO8dDsiYuEJERG+FpLAj+Y3kwrtSgyP 9vmOQhXpip0NVMZOgcoNxEOx4wsJeJV1xU6R1X0jko90ZJE5RrIzvSVhLLj6id6SMg7Z7RPMldwK WP2M7MgbiyjUeePxxZdd3qjQLjNk3qgiXYypYq8H5ica0qtdr/lOmLRMMNMChbei95aENhdh4MAC vIuq6791+pKtd+sOvoYhLjryr5mwQ/5Z3sYPIsx8o2YZZgVqG2ZFpDPMClY0RrXdSRp+EP9TUseg h499Fw2jS3bTMDrJ6Gf/0EF/nn2EV3deVGxLig2fndNV84Hc+flBl1NRxCd6VdHRW+g/oSRXTw0K ZW5kc3RyZWFtDQplbmRvYmoNCjk0IDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jl c291cmNlczw8L0ZvbnQ8PC9GMSA1IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9JbWFn ZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9Db250ZW50cyA5NSAwIFIvR3Jv dXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1 Y3RQYXJlbnRzIDY1Pj4NCmVuZG9iag0KOTUgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9M ZW5ndGggMjA1MT4+DQpzdHJlYW0NCnicnVptb9s2EP4eIP+BH9sioyXqHRgGOI07pEi6LHGxFW0R KA6dCLMlT5Kz9N/vKMo2T8lR3FIgaNrnjry3547nTKZ1WyzzRct+/nkybdt88Sjv2dfJvNp8n8x/ bOTkKn8oyrwtqvKXX9jp2Xt2Oj8+mnzwmS/YfHl85DMP/vgsiFniezxI2Xx9fOSxB/Xt1+Ojr2/O y1bWpWzffmfzj8dHM5BXOnaCWcBjEZrCX9/8RGB9z+OpwNizOl9Suv0gfoFnFDYKX2DfV2VbVyt2 lS/+ki27KatqU5QP7DRvwE2nRXkPPxH6QuHzwO3oUKQ8coSmyVDrx+3qB4GO/Jj7boojEQwVC8/L KHQkuO/o2CjhMYuz9HUkm12+ZxMiDU+rtq3Wtkw00s+Hy4ixywAObuICS+MD7LSgbPN4iJCUQuH5 PI4QdPa8KWrZkBJRxgWW+JiX27ymgh14GY8Tp9sEkBcphgpxQoGDlIeOesNoeAUw3KPQSeiqWKe9 ifwK6SDJlAs8jl3nhxQ0DHkmEPa7Peld7tvlPJj3KrBLeTa5Usl++f78jHmTixxY5Y0sf/p88/b1 7I5B276AINNDTp2dQN4AoSKB6fXVnr0o/oshdgKLWW/tu9w68ga39sl7940AiVzV1UI2DauWzMGE vmSQBqsJYswEzV0iPuibPxYN2/TXgr/ey6Z4KIGtllXN1qpAV6sfbFGVy+JhW8O/n189hSy/v4dS bzhJI+AYfA6ZWb5qK27QQKjUdsN2hnrigPzjUZbySdZkvxSChwLL5CRYN2IEfqjzdlu01bZRsaVC GiSKN5EgyZhQyukACxGq5UIWTypCdbVm7aNkj1XTnrBi2f1AMk7Gk4F1OohWF0aZhw4vq5YVJTu9 mbO8vGePecNIJwlgrTDCKjayXhdtK+8pmSxSKY9kSHYGY4Bvsf5aLotnO50jgRO6ZXrcG4AfIIUg yhJsLuU/TMI09UO5w+rBxJgUdn6j0soH6wUWaWBQU3FtWnVwpYOsT24rdkcGPAB2h56IdF1OP32e XjyFtzfz6fWcypQo4AM5zuZ0ZmkrYyjKqIeviqVsi/XgtpA9nS3dpS+nf97a+zPSCAVFwuOEiwH8 bHYx/cLZ+RKcTRYExDd7cQpZPQIaMALbCw1Boco2VdmMeBDm9b3EkkDGaqYPMRZ4Wjl5V80vGKKC /62hcIHZT4DeVxLSaB+VzknWa4XicJQS2wdX6nnvhP3fDNX6gST2+nf5OVIepsjt6W+fP51ZE7Sf VZHYzgp750UipHoIdTjAdk6ASAwyn0oZaGy+22HaZ35q+uzPW+2324vzD7P5+eWMcl8Wdhc1pTmb lodbQg5B1hQlhE3F8EOxgqcum+d3K0m1+jCLVRmZOq13DzMjdc+tLcv3Uu4JLDESt37oQyKk+kSo Ho6wELfcnkUIvnPdP0X72Ke/ndSQ9Ei2B+BZbyCisx2XntXbKVW9ozQs4AENJYA0WOYaPasg9O3V 9exqej277ei463uNhG+Uh0MBTxesorRWDIKSfBxkMGAOzQCO/HsrG9p7IgIWR1JqILb6OvGwr3dD MtNpXkvWDVBs3w7uJOjUZPySVa1HRUa5DSndnM9QBbPZCg7dsbW1+6MDRmpOT/BIgh721WIIQSEP rZaGRh+lW0n/RkRoS27vmAXDVTWSyzRfdR4ksKdbihp3FRQ6TA3aWGGk2/69AiOMTlidNfZhG6mg B/PuEYKwHYW1ef0A6bEbJfpxrSqpQ/tkcTlTj1sIWlnZX3tELeQC/F6Rjcm3tqeW9oipQvPnCTWu HEZU26UCtfsL3Ei8H1mQyO3vn2fXX066ArU4oL8/Eh0bW1LI64EIqV6/tBB21P5+2B54gB7ldQtD cMuQ7Sd8AMYtxMoqSG50rA3S+IB+lZzR63pH1fa34lApCYcwpQP4SGQViURYws7gCOrUVNT6ci/h 3lTUI+vgNfP1YT0sFofDBouMXYcaPiMXVa3PUZ9SOD8wgsjDuWonepGpARIJOc7VSIbsCXqKRFjr Si9w2EoGwoh1t5UUY1tJJHLTMeFlvngsSum4m+yXL0iP1ZDQaTep1OJ7jdhh4umHRPcxmxtWrwHd sFAx3gCrP1qbzJ4gP8kHoyZ2lyNEEnT54oQFBowDjJ0u1AdM5D7M52ngpnxHcU7Y1Fd7Nids6AVd R3HCdg8EN2jSLYndsKnHfQz9JJ9bZku//rMTJ/1dYoskRYldj3x+jPDM+KJyEYyA1o/Efq3zrpSv Z7+D4A3Q6nZjLC6t+nTDQeqctodRmPBADK5vdYzaZf2XE3x4PkCFmnLjbjHAc2gp1bbtzT+HrlW3 eufxYT7m5d4rr1zZ+kmIKaBH0BHvmbZZnad2Rv/HeYbcuPMM8D6lLr7QcgLkUix3LdfVUz9L2GdL dDUSmvEkG1rx4oucFwPVDkxpW0FGYcbT0OleOiZevAe+s+9xTejYQ0L3JVPCmkn9JszEj8bZwKoY q4XHXbVVGxt4edH+DAK/Cxw6yiUQejWD5Ox15+6uvu5Mb3WvrpG6c7hKF2NfLYbcYmxC3WJsSlhv 3cfYxI/F2MQe6lg3B3M3uM6fi/V2PUKE/8E2HRBkmgMRItOsAVE7JceAGFDHgBgSTgEx8KMBMbB9 Z7LvA7ByW3n1NGwK9DR8Z/1Nr358e+UgF25Vy0BT1E6tOsrmSdYoB4e++O3NO3Yvy6qVDas2asrN V7tfZODf3to/rDEVvXi1/AvF36HSDQplbmRzdHJlYW0NCmVuZG9iag0KOTYgMCBvYmoNCjw8L1R5 cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBSL0YyIDcgMCBS Pj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDk3IDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3Bh cmVuY3kvQ1MvRGV2aWNlUkdCPj4vVGFicy9TL1N0cnVjdFBhcmVudHMgNjY+Pg0KZW5kb2JqDQo5 NyAwIG9iag0KPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxOTg4Pj4NCnN0cmVhbQ0KeJyV Wdtu2zgQfQ+Qf+BjCmRliroaLQrk1m2KzSJYu7sPTR8YmY6FyqJXl3izX79DirJJuaS0KFzkcmZI zpw5nGFmV1WTr2nWoA8fZldNQ7MNW6FvsyXffZ8t33Zs9khf8pI2OS8/fkTXtzfoenl+NvvkI5+g 5fr8zEcY/vkoiFHiYy9I0XJ7fobRi/jv1/Ozbxf3ZcOqkjXvvqPll/OzO7AXPnrDeeDFJNSNv138 YsH6GHspMbG3FV3bfPtBfIJHNmwUnmBveNlUvECPNPvBGrQoOd/l5Qu6pjWE6TovV/CdxV9IfC+Y tnRIUi+aCE2TodcvbfFmQUd+7PnTHEckGDomGM9t6Ih4/sTARokXo3ie/hyJ7h5u0MxCw2veNHzr YqJGPx82Q8Y2AzjYyRRYGh9h17ntbNgLDaTNIcG+F0cG9O6fXV6x2moRzT1iWnyhZUsrW7IDPPfi ZNJuAuBFakIJubSBg9QLJ/oNo+EW4ODYhk7CqY472uvIb0AHZqVcgD0zdH5kg4ahNycG9rub9FP2 KzkPx/spUFIezR4F2R9u7m8Rnv1GQVUuWPnL18W7n7M7Bm+HAgKmR55t7QR4A4JqGDwI5hRWnVA6 aZhYdRIChgdYtxL6c8hzNM07wamXOrAnsfPHYtfJT6QJ1ZKjZyt11BVjGGR8uwPheS6YzSghJ0bW BVLs4cjE7vNmg7YqRyjj5Tp/aSuQwLqBdTNEV6vKtnYYxt7AXV1fombD0PViiXKrwHSBCTRdhtX5 HlZtZIC0bfRb89ByY/ziuUs82tBa7tVekXIxEh8XWyyvlvc3iJYraU1HQqubliOh1bH2NCRCXg1s DucqczhEka9Zk2+Z59ZP60InLCVTKhwTrcJ9a33Hok8JTfhNwWjVNyTWI8egzsQ0dO46mFRbUaJR 6K8NK9krqyT/rJ2WDwpl2vURd8uCYWKVEEgOHmD5Goj2hhi0c28oLw/Vwbo7+BLlDXr4Cj+wC0N3 1hgyHimnFdvyVyiCdcW3vUcP3cNSRl08M1bCmrW1gHHgkWTgugG/uY3nYRR4AwPrxRljb25Cobo/ 5QX05A6qdIeFjvhgtaQgf0JWQFD609Gi5oewqWhYSwYuTygZw6d7dbjDD8gDrSgq+YoJVVvlNQhR yTIRKtpAzZY/UEHfWNWJX8YryOyOO0uiW8lPjys9u68y4CFcfoZFbcP6kaS5jrWWBCFeOMACTQVF hUAe8yXTMIw5asuC1bU89rgKR1gjAxSGsFKFUaNOlW1JJDAkgGgaHqxlCPkLHdgTtQknaGSYkqM3 n4xppAE/BnGxY1m+zjM5TLi3b3hwbj+aJJZhpGV4KYqpBgbDNlANm3Lfa4Yt7B9mhw3fi9u6rVlf lLX4fn046k5OrrUtoYJwA8fOQ8ZTchSERo7sN5nqVA2DLkvoljZUjd3uK8Ewdu49mZYgMdIGyt99 CYJTQ3eWbVCdsZJWOb9EK3d1GB7EMVQOEK2YygyULC+h04O073jVINn/uWo2EONz73Nx9ee9BQyz SQgRNeC2xxT18GJgP/O6ATFtqvy5BRnhFXIsRkDSgZaTFlPTrIFdVi1I9mE1K02C1BdTpWm7gSii jJZCBifGEIJzsC8ZwIFnnf5B+Ry2Ya2V/gi6G/eCMTkij+pjJB3Ca1sO5izgt+FkLBM6diwTOnaQ 9hq+yBo5iWx3hdAZsVfrw1EEzYjhzh2VSCsPiL1bGwy0zW/Peh07uDLdo+mkVdQTjoGtWYPanUip uEVFWq39T/eKMmkl9YxiYO+7i7rmbZUxRVulLO5wB1rVwHWjmt++hWtkP9G7g/2rFk953udF4eiJ wzj1fHOJNa/2tFoxm0hGARHvLYbNe/cJiFZwoEisgHIdP32fWt1a9E1u8TbgI62NgYUgiY5UHt3K ARJ6OJm2Rnd0PElBxmQB/w9Z0LGmQFufSrE8lG5oJYx68jPAYqCQ7+lwrGzDsh9j/TqZa3Wx3zAp 5FpxHFk+EAE5nMGkB4CSNz3IuVSiU/vgremHoQMJ1U10YP97pJh6ObVQiZjRNJ6iKYxSrxi6rXuR kByAsrnZw/grZ4dje0Oh5B1xIWkqSKV7OgTGPfvpJvaHd8kmHdoHw7yV3kZZIuZH/X2tJ4P7VUI3 62nj7kB1C2cDmk5ongk+ZhJ6Z/uEo+5HHd8d0D1h6nj7MDoX70Q61PxDmFsWbUucxGM+qSH30yMV lscil0+iwFt1dWVqg6rQoMJpsadvtWTzv6zi6Oni9vPN42t46WSNnxyTef/4GqOFmKdlhdC24e67 Rje26mzXRejQ/j1VjqNCQuRbhrtApiwVxIl4WNKhBc9o0cfu6Z0QqbZ85m25ckdFDIj9RKMC/3Tx Ajtu84a3Nbr64/HpnYcWbXbSg88+keHfignMs1A4mtcPGEcBxmEInxg+d/BJ4WcJfOB7LH4nvibw 8TG+jsXvPg4XOv2jdHfd6NsfGTJ06Ia+MjFN76h6W5G3kztQ4ZH7kEs1zKrL5/MYfTTjvXjtutRv NY3wksgxqtjfLRON+1j2xIisc/r26hb9vpBMeyn485ERaNuCv8F5B+cYqR+iXQvgv6/Ckbdg3awt czjXSKjI+FXSV5oGddSVEi8dbS3hIDlxrNeVUJ+2drSB81iWsOUMUif/A8XsmQENCmVuZHN0cmVh bQ0KZW5kb2JqDQo5OCAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8 PC9Gb250PDwvRjEgNSAwIFIvRjIgNyAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1h Z2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA2MTIgNzkyXSAvQ29udGVudHMgOTkgMCBSL0dy b3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VSR0I+Pi9UYWJzL1MvU3Ry dWN0UGFyZW50cyA2Nz4+DQplbmRvYmoNCjk5IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUv TGVuZ3RoIDIzNzQ+Pg0Kc3RyZWFtDQp4nJVaW2/buBJ+D5D/wMcWyMoSdbF9UBTIpT1Nse0Jau/u Q7YPtE3bOpVFQ5em+fc7Q0k2KXtoLQoUaPLNcDic+eaijm6LKl2LZcXevRvdVpVYbuWKPY/mav99 NH/dy9GT2KS5qFKVv3/P7h7u2d38+mr0MWABZ/P19VXAfPgTsDBh48D3wgmb766vfLbBv/57ffX8 5jGvZJHL6u13Nv98ffUB5FFHJzgNvYRHpvDzm98IbOD73oTb2IdCrCndQZic4BmFjaMT7L3Kq0Jl 7Eksf8iKzXKl9mm+YXeiBDfdpfkK/kXoi3jghcOOjvjEiwdCJ+O+1s919kqg4yDxgmGKYx72FXPf n1LomHvBQMfGYy9hyXRyHsk+fLlnIyIM71RVqZ0rEo3wC8AYfskYwIElQ2CT5Ai7S6m7+V5kISmF 3A+8JLagH37t00KWpEQ89bgt8VnktSioxw79qZeMB1kTQlxMbCjnNxQ4nHjRQL1R3DcBLu5T6HE0 VHET9ibyGcJBkiEX+p7tuiChoFHkTbmF/e4O+iH26piH650F6pBnoycM9i/3jw/MH/0ugFXeyPy3 P2Zvz0R3k0Kg75BCt1nGvqkamJXdrn5KSJ9S7mResb2mKiqmJsCfsa2pJLETz+9hyVidxhirFvbL H7M5W0i2LtSO7VVRsZe02rLZ7Z+P5CNPvbGthCoE0TTxpjb02y1JgkjEg9Q2fk74ETkv6rJioqqK dAHe9qjiMeZYPCxRstDAI6BjTSw+58On+yf2TbrpwJLaZ6/te5fs37s7jnwMZ0uj2zGxWXbBWgIM CRJBRbfglOK2+lvYgT7n/kQHczy4BvHEOIRAJtgFRDZ2K1klig10AGK1AsomOTuYAqPFtnCaMwGv W4GSrzLdbBeqn7JUjIdTjFtTV/vY7vwxBUjdTf6YUJGvtJFODwYmcch8JYsefPSR9zvDtmkzZd/5 /l3yvi950lMG8MI+7516eIPWsbffnlghsxQqablVdbaCn5YK8gIgeB9oJZY/SqZy9818Iws+phkS 61wsMjrj48Dj3JZznhCPjQ5oDobN7ZCC6/y7+AgnARZbS28TIAzfsqUT5AinWQnEQGyL7zD/gEvA JO1BVYCFe6W7XbYv5Dr9xcql2pPOiaAVg8pu6XZWwOBSBYSGLI74UVsQetS12gy24DOV1dg5Uo/J OVCWLULmOIc2q4ddq34e9MJkmOZ4cmLFbC+XqcjYLK1q3fteKNfkQScu54OajjiYHPXNXxRx+hiK E/rcRFPXbMuDhS0vXa/zzZADgiTWL2RiV7JcQjmBqaIL6q0oMMnVWtdI9qKKHxjem0LVeydrDrIh 9iMvsKE7cSETfSNblqIuoeps05LtJNiap+WOrRte6kq+u7m31KW7fQH5WpCTYgjh0xf6DxBBVqX7 DJkADoYBjR5X9BUiqH8HcSQh3Yjs1E9NZCSVQnMPrY0lfKHCWlgk07XKMvWCD5g2tN/cl5Vt4gOg YBLmSrf9E34mJkm7GyawhJwpFw5guSieWCwXkDzX5pwl8MWdcxa2e1vqdjAYQfG1RKhWsmU5C3uI GIqwIEyBsCwZp/eiQYQVhUZkPK6ZYFsF1WwryrPRXCkdLaXYSfb77dcbtpG5LKCveG2Szxkt/Fy0 sKXIsXhWhRQV8I15MJpSNo15CbFqmuI+CfcsYXvSQjbkoKP5KP+SQjOkcjC8YQ7ZdhZUwgOX+WNb M/RWZZlucrAa/JJWpczWTrtC3Op00nDRUtUFmPL41HU1HvukXiQ0M9RygY9D3ItYisgps5le7UO1 T6k78gjvOEh5GEII97DA2BQ65kiXwzQn/okVS5Wv001dUNMeJCtUmkHqo5B7gQ09RPSFcaV5Q+CG gySE77ksQfLUpFoXewXRBUUzU2LFFiIT+ZJuA+MQBhLrAPIW4KSpDX3ML6cgrpCO4dul4I02Vpf1 lfyZQkRi7V2nUJAgNzunLFQNP9DJKOi9E45U1ilw4S3Z7sXwGFNuC7gvgNP3QfV+L0VBT5dBjCxr iaD5bgK34HTrGZyoFrkCNxb0RlOP3z0Rh2845IzfE7hh/9ezvnulaYkAy+yVgsfceGyO8dEWfE19 TlfHBtWdi/IjhVdbUQGBqxoGwLLXhZHBDm1AbB/iNocbsf6Xe5axsFvZJgbZKzdfPSyhw9W2GGR5 qVPEPUpY8hc2fxbWmhfd/eagM9pSZWEXzbcXfHyoUiu1c/s6MPIR33EjV+QnJr1zsCQw0Gpw2Q73 7xnryLtxKM1Q7eLcUiVzVW+2LaGmRsxRYRXz2OvpcF/VN3Lltl08NXnZdh74A90TNY2Ke4qw1JEX beusiT1UON1LQD9U4yezxevFHROfmh0JVjFtLE4TJcxs8tCvuRellhoyepMEpwkLC4NKgcuklFoW tM866ID2g4iFvZvN9W2aLRMGsXPRhDPkwOs0/sOlSwv8nybwA3WV+sn1eqx7EHgb+N0qa2ZNitr8 EHsjUzNZMJvNjwk1ynJZQ8sq3CWdx9FB9Nmxvm43xyb8wmdjEzqTXx++4zO4dwimCFk7m93/ULvb ujnE7nZEMqGfHp+oz1Mc6n1PMbk6b0rxkNt16WRAYd6GHrAXVUZAVbIkl5bNE+OSqmtgtlIHafWi DjSFWb6QGbVs6kwytOQbzCNzmDuQRgXU7bYm9A96VmlZgaY6LbfnG2H8unLoP9y1zdR7obSZ0G5g IpuiKJlAw2+KtCzvvCRuorreBygO0hEey3jDRUEX6y6yDB10uDSRZUAV3GYrhQ6NlahEu7/CDQ24 lOSccQwaTD03+jkxNpwX9Y/MAw0sK+RS7Xb4qWJFblLaL3Km6H0NPUxeZa/QKF0oHoZU14Yahxrr O+wimw7CdQHccPWLqHsN1axGTbkLm1EKerJyiQetXILxSfS6mytT4Ibes+udvIntxlBwS5muZGE0 6+1Wd11X0HLcdFsf3e84nR0baXFhPZTLCpfEepZc4ANLBjd9ZfjUYMbf2jznYdExUuQvsYOzbsz9 lAB7sV/qDjrudnTg699mOLl2AOdh4fGNDUXd/605c7Gbli7lq06yYwNHNib4Xd08hzRItzAmEo53 Gs+P1A5Vxb0ANcEXvjmY0P6S5O+36AAmf1UwHmFcWYkLZQFYNpcSecS58x9iTus6Azm3+Vtn4j9p cQviDQplbmRzdHJlYW0NCmVuZG9iag0KMTAwIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIg MCBSL1Jlc291cmNlczw8L0ZvbnQ8PC9GMSA1IDAgUi9GMiA3IDAgUj4+L1Byb2NTZXRbL1BERi9U ZXh0L0ltYWdlQi9JbWFnZUMvSW1hZ2VJXSA+Pi9NZWRpYUJveFsgMCAwIDYxMiA3OTJdIC9Db250 ZW50cyAxMDEgMCBSL0dyb3VwPDwvVHlwZS9Hcm91cC9TL1RyYW5zcGFyZW5jeS9DUy9EZXZpY2VS R0I+Pi9UYWJzL1MvU3RydWN0UGFyZW50cyA2OD4+DQplbmRvYmoNCjEwMSAwIG9iag0KPDwvRmls dGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAyNDEwPj4NCnN0cmVhbQ0KeJyNWltv28oRfjfg/7CPDuBQ vIsqggC+JI2D49ao1fbByANNrSz2UFyVFzvur+/McintSB6SOECOJHwz3J3rN0PPrqomX6dZI758 mV01TZpt5Eo8zZZq92u2fN/J2UP6kpdpk6vy61dxfXsjrpfnZ7PvnvB8sVyfn3nChf88EcRi7rlO kIjl9vzMFS/4z1/Pz54u7spGVqVsPv0Sy5/nZ99AHnX0govAif3QFn66+MxgPdd1Ep9ib6t0zen2 gvgELzhsFJ5gb1TZVKoQD2n2p2zEY6nULi9fxHVag5mu83IF3xh9oe85wbRHh37iRBOhyfxY68+2 eGfQkRc73jTFkR8cK/Zdd8GhI9/xJho2mjuxiBfJx0jx7f5GzJgwvFZNo7ZDkWiFnweH8ccOAzg4 yRRYEh9g1zl3N9cJCZJT6LueE0cE+u33Lq9kzUpEC8enEj/Tsk0rztmBu3Di+aTTBBAXCYX6/iUH DhInnKg3jI6PABd3OfQ8nKq4C3sb+QThINmQC1yHms6bc9AwdBY+wf4aDvop59UxD9f7EKhDXswe MNjvb+5uhTv7I4WqciHLz/98/PRBdHcpBPr2KbSSdf5SCrUWdZttxFZmm7TM663IxwKKqGnkdqeq tMrZEmK8T6RG3E+wqm3wlM1GijpTO9l94U/ZXTX2rauqrN3KsnG4wu37TuhTGbbI+5AjA9gT13hj roFKEQdWbfMCx3e4x8/BA9DriMCDqhr2uF4EAhR/P2IGG6teJVqOk5j72PGIxKAx/Glx6lnuv/1x 8yDSGoMVKnq6WkHFq0VarkTdpI0s9Dfz60qVRyedffdPeMYidtw5ecgX172Ovx5LnjCU0AXXUMmL RmzSV4nRyRWeeQSFh8jwNcqHokOgu0o9F3I7HOuuFYuQHDuMh63xHBvzieu4EZVlgwhqp3+EvVuD D7ThR4qFLYQ+4hPXtB8i0Tue7bJz7ZEptzDNgmCbTaXal43AILvUJWbI0NHCIit9zG3buhHPUmSq XOfVFmL0+V3rE7WsXmUlgFzCv8QprP8Xzpw+5VJH+uCh5ol9H30QTTl3mnLW4i0vCtEi3WwUnKkR 7U6U8k08j5BP6GpUuSO+K7iOlXeD54pjJ4ioseA2YtXuijwDDWIlG5khG9vbcCertdI2fNvIUvsj R+4PxG7EM0C99w+DCKu4bDSzAsGPzApUd5k3eVrk/2ND0iQWkbpkM2sBMXkE/g8aIx1owv6JfjQU VIoMfaLWXPyDIFA2IsizVxdrJMHuS69OyfEwtmW5KhRCLV5MO1Ln59A/IH+oNwkJdilyXYsOkaJT 8aWtsF/oaM2zfYtAlvMCnBnzkXVL9yyggPtnPcsshRwaKhEe8EDXp2KZquCpOzWUaX4wR2JP5Fjn wzOSIyyE+xZpfVG8Wze/7DhSX3G6KjB4XS+xz12uIUvZvt+xCiLCEybNKgh2V8nXXLV1X4O48Oiv O+U5+hLhwoqkJTLGvGn1xAfmSCGtxEbVLFkyjyNK3vJmw8HnATqOwFnVUBWOVX8QmVyaeHPIKCL8 wvKNAGaMowex0AVQk0nnD8PYOTr+ulJboUrZtbZBryRW1kITSksFeVSJDLIWqj7ce1VgezLNmKUH PvZvogwfb2aDtSoK9Ya7lbf0vf7LYG0iOoaPHiXjjSLGvU9IsSyBh+p9jL3X6btPXh2vXBzB3A3V n4izw4IPZSI8At911tJpYNVJDPO+VA6yU6KsD91BC4YWD6hlsYKo6Ytw3vSFGM+UrrbQXusGDKC6 4OAioWPwRPOhBGrdo1wuDKxQNmXIUDWZ4jw8wp8NvSVqWD8AFQonYrvD4VYsmBh1NnYs6mzsDVfX EjjtMRhsyncwMxNPOolZqB4pZzeqHvYZAs42qmIj3vApImAiPi1REscPqD6ihoAHL3fBR7j5oGMC XEIG+9YALRWVddQgLd8FEO8W5jVHLDctDqkj6zOiLi1wyw3EmJNJPByPiAyrP0lO9ENZxNuDFVSN wT54T4gByz1duQbj5M07UtPOlpdQc+HX3+l2V8guhWuZQTkR91c3fVvj8idyQ8ejzxk+ES5cJqYE wY6kBMFeZZpC9xPUfic2zBeICq7XGto+6WimthDss35hADwGQg2GsCxTLRQn/n0ATm9EwSNlGyP7 syCy87PAlsrmnJsg76USw8SRYOtaZTkf9mbHRET6frWTWb7OwS5oFIxASDqd69SPgxcNrBQ5LEE/ NHdPWPphuiMuYl3J/7ZYOUaJUOBb4d4XnNoRCVAb7/eleHh4UN8GR37DOYki3P+lxUil8SckWgBR 4x5h04rto2agJHC1Q/LCngYLczjxNB3ppSbr/VOzkd/ZGVdovdC/N7LEOVFHBnEn5EDawq9Q13Ah wRrdbJmI1md23W3KtA0eK9M2FkutPJSeenwthcT40B4Vt5Azq2OCPgynYoTLGeJJn8U2bjPTEvTI 1EWwkGTP4CKdgbqv6HbNl7suVGwNOPxVshhyqzaev7Dqyq5Sjcqw8puF1PCOh8jK340sV+xayFiE iIxYhGCh3MgyBW7Rva5Zt6VenbGLFW2RSU/rzIDbumnd1YaONFcb+gMnjnyFyQYlu9o7Z0JOB4GH +Wdre3q8+tfdcLpOuZLZCdvQR/m3W+79nSlfUyxgHGAhoaoPzuGTtOoxfKohuoltih26sZi46+6B fYvpJUdqh0MLt3sGqN+VpD1N3ByFRNpTAdPf+0G164ij7/x8XA72S7GDVt20h8mFLXnS3unrFLHs dq36rUz/8nTwVLir66mOKlrMWk2/9EIKrgiMGmyxJxzcHwqY5myr227TpmVX3X1sWwJ8H9I9y4Y2 kJZlDryGZfBh7ALH5NSfvPoLJrwH9d1DTEFP5I7bFyILfQNGBZ8P7k68KMFNpC3GsXUvjnCitaFs LzAhZEEVO/eZ+dQGP2Iu4Fz1j7z+k50eFhFOBNx5TowdTnrP6iWHsF/qbfGe/25gyqvVFqO/wUxK C1Hh+RzxiL8O8xlbr9ppp/DvmaLAoRJs7dPxZiPr97qR2+Gi4M0P8dm9uejfWyLZgSw/vDbAmoN/ bICDvHlLNVjcbdX26yx25PXw77lsqeGT46bNAP+uB/BPn8PFhXZD91Fzc/ywas0HuE/3/435oX4v s+7T/k0yfnmWzZuUZfelW4lrhTh44AdsKka1fM0zyV4p9py5T47K3ilO8M9kOKgO4f8DGZkQfw0K ZW5kc3RyZWFtDQplbmRvYmoNCjEwMiAwIG9iag0KPDwvVHlwZS9QYWdlL1BhcmVudCAyIDAgUi9S ZXNvdXJjZXM8PC9Gb250PDwvRjEgNSAwIFIvRjIgNyAwIFIvRjUgNzggMCBSPj4vUHJvY1NldFsv UERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAwIDAgNjEyIDc5Ml0g L0NvbnRlbnRzIDEwMyAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNwYXJlbmN5L0NTL0Rl dmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDY5Pj4NCmVuZG9iag0KMTAzIDAgb2JqDQo8 PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDI0Nzc+Pg0Kc3RyZWFtDQp4nKVaW2/buBJ+D5D/ wMcukJUl6mJ5T1HASZqzKba7wTZnX4I+MBZtC5ElQZe4+fc7FCWZlDMUi4MCRS8zQ2ou33wzzGJd NemWbRry8eNi3TRss+cJeVo8FuX3xeNbyRcPbJfmrEmL/NMncn17Q64fLy8Wdx7xKHncXl54xIVf HvEjsvRcx4/J4+HywiU78dt/Ly+ePtznDa9y3vzynTx+ubz4DPrCxqC48p2IBqry04dfEVnPdZ2Y 6rK3Fdtitj0/OpMnmGwYnMneFHlTFRl5YJsX3pBveVGUab4j16wGN12neQJ/Q+wF1HN8u6MDGjuh pWi8nFr90mZviHToRY5nZzik/tQwdd0VJh1Sx7N0bLh0IhKt4vclyeevN2SBpOF10TTFwZSJSvp5 cBk6dxmQg5vYiMXRSew6xb7NdQJNEjNIXc+JQk30848yrXiNaoQrh+oaX1jesgoLtu+unGhpdRsf 8iLWRSm9woT92Aks7Qbh9Arw4S4mvQxsDcu0VyWfIB04mnK+6+iu82JMNAicFdVkv5uT3ua+Xc7D 570r2KU8WTyIZP96c39L3MUfDFDlA89//d+3X97P7gisjQXkBY7nYGcvIW8AUDWFvxBZ+JZgKlvy CqoMQ0kKSUZ1BRQCPfCtOxHG4deDa+uy9Vvd8AOp27IsKgzjKUTFDfFDzrztzXlbAlaoQNvjnpOk LbN0wxr4E2/4RuAQ2RYVuX94DQhLEijlmuxZTZ45z0kJf91U6TPAWJqj6Cw6hHaQGUN9BUOf/r67 CSldYsnqUQqh1XWuUOfLPqkJP7doVw3jM9Oo5Sjs8kWV3bRVxfMmeyN50RCWZaTZo6XsU8ihpW6g kCmK5p0fxwLerC7or6Iz+zLvagLHQIQP5qDQ6KT4To5gflkB9oW69kzv0GQh+dTEQ8FgcJ+qe803 rK155/W8PTzzihRbwl5ZmrHnDAfV7nM9pczUG/B6Jls8GxDos0WVTXPCyB/rPzHnAG+BNmllnkJb CCayaU3qA+TgFZxSp4cy43VD6iJrDcEL/JUoXJsjgyByzk9s9qwxu9mlJ4Xjnuf8FaLESM6POuCY yYNmhpUlZxUWpp49aBpXXYokvMyKNwCyhL+mG042LLeqjHDlGisDgBHKjCUi+cQ5+6Ju8DwGlIeS 1mz+XhyFWzDeEgAfDCYqaJi8pTMRbfYQqG2by7seU4Ap49cuFQBp2At8qHmI0RRYw0gph4w0bwo0 rMDboNdpqpt+RilZzjNzcDW9GW6oXy/HPqYnh3aWJTvUZI9FmyXkuRJTFeR0KpzNMrIRuYAyNuCC 1O5IGZoIwC/sJddAJ3Y7KPKhf3coyJtjUb3ADQ5pntYNdBf4H4i/Vmv1Xl7WjJAhzJHjaayu010O tdPsq6Ld7cnt7zcPBGzXDTSwDfaJFBqYiLNqCs2JVShKXZMVfKVnTXC2ufNpinOdNYhcZ2V3ryCK HU8XHfoqq2ZcGNCTUgbx6FgUWQOAwcT9g6xRv7nQ+ENdf66WVNn1tulgFhIg4TO1pOph+4qhllTZ YruFFGqOgiWKNCcMbTOh70yURfblfJs2KJWTDoRGN+p0QHbgmz2D1D6QE/tKCl5Pz17c0elmhy59 QT9Umx9d9zr6NNU82wnR2O3Cod1mLo9V4T6HuxodkkdwRkBIqw7kxYrr+g4k6n7sQWgi9cmhGkAv LhmIJnvXA8tYT/31ZeeHDiq+Yg5IXAW22jKB5plckbQRuNRjmACWwjwXaVZm6IImW+ToWmmAJyvT fVi1jwHyKQFwxFboMKSG7teWRp8EKwVOnuX+jRzEWiTL3q4EsIprdygLwA2Ogn8HliDcRAQWowu4 AGBNM77LR26N7n5gCteVzHdfujpCGybK6HyiNDIXzfY4e6LLFAqcVFPp8NV4+VDJbjF7BnFEvztk 4GAE45U9JGv6xQHNfOovBdjo4nPjHnBW4CCaDtr0JHprsgOyoLvApUMnKqJ8e3ASGdhF7MhnKKKY BUYLHaEEMxhJ9EKxDtFU0KlJjvqa7ACPt+tbIuaHGXfbHEODoIukKiv5jRkmNAVTFGVkbK7S91VN Vq0arGT7kcDqjL6wbERldKnSp++nKC1g37DlGOKg2rBNe2pBdgbnqrJD2p9obTf949NHAIRxpduQ bQkl6q7Yl1pdULpQPCf4A1Eohgoj466raxMn9Jn5WNXaXCapso//J2EKfSpWyqpNS8I0eEzzg9Fl vnhXGUQt6NJPsSBJ4bUj0NxYho6viw4cyHj9ODopzCV8j3OaDo6J3Z5ak32fgv08s5L90+oaQbwC ENG/EudVgkJaGg5pODUsWJXR12JDPvoCpV9TVoV2RVdMj5pRIGDoRtYTJalJq1wtEq43Xj6iJ80J qTtRNTO6ajZQ5i+7nCZrfE6gFo83YksyWvMCh8493mgKXxmUbFq0Nak4VC+vzHtiTdd4dd/qJcT3 lKCtoWr2MCNXaf1Chk2m3BIOFLbfY4k1IZSXvDK0lzeYq40RdhWPH8ZPZuI1+EUwTJGjw55Q7uPA PHDdVwBnOGBbFQey401HyMxH0ZWCr2UlcGd2ke4tqdjaaapdowB9aJsHBVE4q1NIbGgfSSYuJlZJ zVyC06UStQ3D0gNmOkgPTbitpXtz/LFBvq1pWuiPWMh1vSY7boDzIuHgosd3tsKHFqKyTTOxQDF+ p1jG9Xb/5Olu/wzuWScwQzRpzQ8QS/NIrurPTOSqqExKFCDkikNVuOo6Z4dQ4Nu6aCv4SDPMyB6o G3luxQtXjXIq6ROxJBuG2jfSsAryeI7LevGy+0hFF81d+dikinYbQp4nZ2Dy3gIIvkhXt93/9G5V zq3HliMWen8/9PgwstB5X4l12OArTjZ7DoFNUCfJh01VyWxdLHHGTfFMESqyZcUA/DYMW8AP91BU 0GDJR3NVdHiO6vfVCuiIDUcN/5xhBweuL4ZX1VpxrH9DH7ao46G3POsfgVX/ENk39r5poBZ34TRr eveqalNfvZNrfeNUtW7T1zSRz5zjCh9wgIsHp2/rf+4lnHV9BcfOfmRU7WLQKSdGVfJ0yn+MMxX2 rWceD+08LlY7vTn6Ex5X1H7C44rWA/KV/Y+ZqKIM8N70Pi6rwHSlSXdTRa2j22+oVV0suv02AzkG qGiSbrdcTIrkH/y5Wg4EqhG0m8jMUCTNi0jMVWc5FNnlUBCpzSLvykj54OTMp+91DtmIFVu2nUO+ 1KuXaIBQvXLJ+V/kqx0a1n7cUNXRJxr5syKqqPKVxz3v6C4zb0c9/1S/Z4vbgZ/VYu0p37oP6OrC 9wRcq/bOYvkvOCrIrw0KZW5kc3RyZWFtDQplbmRvYmoNCjEwNCAwIG9iag0KPDwvVHlwZS9QYWdl L1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNSAwIFIvRjUgNzggMCBSL0YyIDcg MCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94 WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDEwNSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJh bnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDcwPj4NCmVuZG9i ag0KMTA1IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDIxMzY+Pg0Kc3RyZWFt DQp4nI1ZW2/buBJ+D5D/wMcWcGWJutkHRYGkaQ9S7BbFJue8FH2gZdoWIos6opTE//7MUDfSCWlh d7t2OjMczuWbb5jlTd3kO5Y15PPn5U3TsOzAt+T38lFUf5aPp4ovf7F9XrImF+WXL+T27iu5fby+ Wn4PSEDJ4+76KiA+/BOQMCFp4Hvhijwer698ssc//n199fvDfdnwuuTNxz/k8cf11TfQRxuD4jr0 Ehrpyr8/fLLIBr7vragpe1eznc12ECZv5IlNNo7eyH4VZVOLgvxi2RNvyEMpRJWXe3LLJITpNi+3 8M1iL6KBF847OqIrL54pukrPrf5oi5NFOg4SL5hnOKbhuWHq+2ubdEy9YGZg49RLSLJevS9Jvv39 lSwtZXgrmkYcXZWolV8AztBLzoAceDJHbJVMYre57W6+FxmSNoPUD7wkNkS/vVZ5zaVVI1571NT4 wcqW1bZkh/7aS9JZ3oRQFytTlNKFTThcedFMu1F87gJc3LdJp9Fcw13Z65K/oRy4teRC3zNDF1gr OYq8NTVk/7iLfo6/qubheu8KqpIny19Y7H9/vb8j/vIvBqjygZef/vPw8f3qTsDa2EABfPZsZ6dQ NwCohsJ9Cc2VP3NSii23AWBKEQANPafbwSW3u86PNYx4PHCyY4UER9yQbWjxPVPOH9mJbDjJWIvw uzmRBszJvGkVKsA31qgfbXnDM/UjJySFGiRVHcLnEiLUkJpXRT4dwaTM9yV8x+hZ496Xs2H28QAW 4V9GYI60m4JLcbRXrfKKJpP6eDeP3Cvnas6kKBkYIjtRg1n0iDSC7MF52WYHwrZbABUJcVJhcp8V aKnO1QHuwWsqlIRlmai3rMw4ecmbgw3JoBuj2FS2ol6YIk4asirLDSu3rN4uSFsWeD+Vl/6uKsDO i/pUC6qNLUD9+9g4ujBEPxvO8WzBSQD1qKlnDWTfZLrsDdTwsYKUVrXI+vvU/CiekWrgPauaP+ei haR2jMN513itdQ4EjUjeNKjUVqTkL1bH1hEmydDeOAkOBeRcnWnYhxnE9kwWCxhvV/P/tVwqF7v+ uiFHUVsrN1pR78xSIwpes9KW1zjyEbdnOdqFMNWRYUoKevtw8997AJjnPEMgKknFa7jIkdz882v5 8w5T+Hoiw9XyAXadpyXQ8XF/GkZgQTBtNd+2cAaaKfIdb3IADrEbSwB6PlhGtpKM/NCjqWnaieV0 xgiKIzpZC2IrECZIpCNT/GYj2saOLivoPFPhn1w+4X3valEpzv0XTIGBiUsbBNPI81PTkPPa4awR Fgeryd79DtKjQ48aRgh/eMMhPdB02HBqKgF6wV9nh4X67CwFX8tXN5KkMm1fWgIY9qYejkGb+MpX behbysKUTZF/GrLDrV/yosBJvM1lBqCsDWN1UWtVpjGwuFmnq3Bgq4+SQB0AFBj817yIaeqDMweO UYZMHFhV8VL+y0rqU2wKw6qzOqJZ1RHFWnUE53dffo/PV+V+zhh653F4Z8PueZ2h9lOQu5s7rEL+ zOsBjPjWloF+qbAe/SYE8bwQhNHllA7+67L3febGdHY90rOxzLrpUGRahiVWInHb4DjZdyXJ3rCZ 5Xd6HtQoDj3T0mffvw2/XMxGlPje2nShUAjlLGhKz/v7sos999J10cfoso89rhqnLkZmOEDWyC6g khZAEeDHvBtfByEbmMn1RdyK8B0gHPiVwgBoxp6kbfIib044sJCX18e85Niz6pSOdDKybYFwZ6yB tLnOCfEVITTByCO4VGSi3IGFBkeGqihbA6Qh8kvDkBRFi7Vn3X8DhA1DxboDdLuy6SdyMKT9Ql15 OE066HZ3WVg0RyNDwD5+itfAd7r/9/Db/xBzhB+GuaG+QC6sTZTgrDROUfXQGRmKQn1TlaE+id4F gJkX/eijDXHiJPBSah7jvnZCNUlyAU0M6e+dUyNt7gOBlagSIHnW1opmwwJ1hMoB+MmY5BfrO4z9 N3WnzG44zJ5hG2Vll2Fsmw7HNvzAIIw1VmUrLzF3LJ7xFK0jjKl7YEA2Hf7SdYwIb9gCYMqBP4Ix 92Q0lC6suYYsRKBWpHU3ZUBto87rUq0kpv1bVgIAAw1UQuxyW1f224dhZA+7QwaDpChOix5aYCqe wBVZ8azpHgjcm2KIi+fUDoB/+OiAcNlngct3gRPhrWBtCXdWpfYEPBCz7jzL12r3TjwQhi+fT9Y1 s3sZMbSc9mk6I519Hxmydx2uDH00hG8ipFCHlZAy3xQnsilE9gRRHaRU0Jxu4VIy7IC16Kq55MDq 6qcFqL8glVl0p5SK1gxHKNMv8OfUWW4IpXE0HpWJY2WRBWyKMAaaNFxM8W797UGq1ZRnB1bm8kgk FEGxVTSY9+9DF16cKO4lw5vWa652XluyYb8CYq9rWIk6jPfIFB097lbJPa6gG17yHTQFFGqjQgiB JBiU4apOz0P/rfFu8s4gMN37iGZjJsfqH0v0w7d8x9rCNtMoDRH8dAXbr5L6RylddAKvy3fqKejZ nWZwsv6VXj/3wiu9LjpVH+uBTiUXepIphuXMIW6x2pMadhOQkD0QvLHTx9S6p4tuynkmvirNRCBd 9J26OuO0ujRrX2Fi2H8x0pfRHF/6BVkXnUKuxkcBU8pKqbrnB1173InHhyK1r5Wy4czNdYPV1M+K 1PZ8XPHlHWeIvnxkk2TTNurpWrb7PQfrW+xOkJ3cdx6WTjWGSvj+prCBvyoEUQBx4Oz5RAQgMnyy rpj974B0i84NM5m1YQbRNDTo/B1bV5u/Yuta/Xo9btYLFWnMBv7NzwcyMZcC07PhOwye8zU9jdWv vINwqpOaZxwa+fwhxcryohWil27hTZD/DzbgfY0NCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMDYgMCBv YmoNCjw8L1R5cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBS L0YyIDcgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01l ZGlhQm94WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDEwNyAwIFIvR3JvdXA8PC9UeXBlL0dyb3Vw L1MvVHJhbnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDcxPj4N CmVuZG9iag0KMTA3IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDIwNTc+Pg0K c3RyZWFtDQp4nJVZbW/iuhL+Xqn/wR+7V92QOO/SaiVK6T1dtT2ocO6LqlVlwIVog81JQnu4v/7O JAFsik1OV9pSeObxzHheQ69fVNkbm1Xk27dev6rYbMnn5KU3keufvcl2zXsjtsgEqzIpvn8nN7cD cjO5vOjdecSjZPJ2eeERF/55xI9I7LmOn5DJ6vLCJQv875+XFy9X96LiheDVl59k8uPyYgjyyLET TH0nooEq/HL11YD1XNdJqI69Ldibidvzo094YsKGwSfsQIqqkDkZsdkvXpGxkHKdiQW5YSW46SYT c/jLwBdQz/G7HR3QxAk7QpP4mPXHJt8a0KEXOV434pD6x8TUdVMTOqSO19GxYexEJEqT00gyfByQ niEMb2RVyZUtEpXw80AZek4ZwIEmXWBJdIDdZCbbXCfQkCZC6npOFGrQ4V/rrOClUSJMHapL/GBi wwrTZftu6kRxJ218iItEh1J6bQL7iRN05A3CYxXAcNeEjoOuxE3Yq8gXCAduDDnfdcIjNUzQIHBS qmF/2oO+i751zIN5J4F1yJPeCIP9cXB/S9zeA4OqcsXF1z/GX05Ed5NCwHc22WIIGqimGnay5OS2 f0uexmTFyxL9tmJbsoCKlktT9CWJ44Y6T1mRKX+TBSclFkLI0OmWVEBefmTVbGnP/4geiKZ8xjYl J/KN5Jn4RXhRyMIh/15yAXxZSZZsveaivEZ2OO4jy3M4mjBSbsXMfk6oVKR1Iac5X4Fo9cFrbk6W EsxgYq4o7pDJ7oP6pJkUb9liU5jDqz7JVypatWTAOp9DPpdkZ15WkbnkpThi6d3R4+ZJo8gJQo3y m+veRN+PJT+1XRr7WFd0ZUjBZzx7R4c99QncWG1sxUUF5fP9jFk0OjC1Fjnky9cgvfpNfvB3Xnz5 ml5dN+8gbf1iFwH4+kNuEJKbIiuNndTTz5m3LBCR9YvNuvnNkKh5OYVmi39h+63fQLNaJVgrBuoi pFXZZqSnhHW/BD+BzCav6oAj67rblxAM1bJ+Y3exuzicZ+WMFfNDAljPcpXIbwPOON5A0lFdwsod xoaueqIkaNh+Xi3lZgHmyTlrbKgz8c8Ny7NqCwmIYQwp8+cmqzhZSDlXfWNXCoLZD9uDcsyqXR4a Jy8PNNTlygp9zf/Kyqo0BZIfY+hrYk0qTzkcWsp8g8MCgXpSSfPoBeVf59inv7EXpU6sixjZ0+iY HZ1opA4DFzuMJmCahRtfw9B6oC6YKFdQdSrTuNLOw5rUqq7DbX8AR0F8r7DGQ1oJ4jnERwdigrBS Cgb3SMRmNeWFKYjDAFr10RnW7ued634wjGFD37PB8GJyeIQzfKDD2zGdjKH6cfKAATlqAtI4eVHs fRqJ1QLaxQK3Q7w0d6oi257Iybj/r/tdoy34VMqqaY9k2phXEinUZlzXqoU5VUGlIA2OEhVr6oIL XrA8r6vCljAIhV98XZFMGCfVNMRJVaN7lzn0mtwU6D64GAZQTcSsqeu4R9gVhxjdOqRtSdc7L9is TeiRtdCo8nmH7ux5IdYnlaBjd/YodQJdErpzMx0wsd0XxuxYi8MYBgtvqBMYr6EZ2fTDcJpa8Rnk claumhELHdZhbEOXxUoGaEGX4U4PCxusL1A8IFrqd+ewz8wqiBwooQJeQYPEqaptnCwvjWUYDwuT w2FTS5GMITshxzW8qUi2vU/DZiKrMmhz/+Pzul2Ia5KBDWLf5rHelWW2EBynxKLuk7e/DUbv0TUU QosFgZK4g9+f7u6fH/cT9252KGEKwzKL/kJSeKOAC0FNMuMu2HQpjb/lNQnEIexLmoB5taKwK2nQ GThjapxq0FJfycUNPgtBiwpj22kTSJVaLCAKjXfsRbBIHkkYHwpBQCRH2F05gOCsp5aCv2dyU5L9 QHsHlW780O8Pdm9d28ylVG/g2C0hd2d8vlHWkzWkhCxW4A22YBmEFa4ZjAj+sS9PO6jlLHyk4u+m IKjfm7Wp08IiGmBwqxIWZh/wZ3F1B9KQOFCxaVaPhXDLUEnm+b7rkC7znR/FDo11VhAxoaGMJUfo twyKyFshV4dux8zrGdqKe+tOWgooSY0r6w5nKlMmP/u+V+uvclrnAb/DPOCHyq158bmJRoMPpCgr ZuoZbbZpEsYh2qMpJpoGttoWdHpW4VPl9h77/3nFUvf6PByPfn8aD18n949DUxeD6Q66mEZA8Mc+ rGl44xOnds/WwMb1otmsdUWsWYNrm2pz/3n0OnoejvrPw9fb4UP/v8Zngwk2eU2edLFZFfDsjxE1 rNHk1j2aIjaTKe6UxybbTG1XPU2OaD92kzXBMyZr2DMm6wpZTca9Rg3s/u3fuWRVvJPBCv6cvQr0 nLmqFlZrcQdSrLV3IhUNfrE/5VDBjef+ViAo0uf8okDP+UWB2v2CO5ril3F/8Ppwfze0FLZ2TFEl u1urCNHlGRvUA2w2eLgoKDY89p/+6D+cNQPWMDhFFe5mgyoRnLFBY7d1o7BtQLVmpFhcXrT90gtD mJjbMRK2soJfXrz94/ICvyeqP6JJgzt89Ik8MnzPhMvE4VtOiL/EsSoZn+DZq5nsDR3z2abAKQvb ezaHJRwfX5U25uQEM8YwulBhtmqXfnJhEx0w9KS7735sXvJc0xDg+YHuqEn9NN/6LMg7QdZ+63ug e7li2ubwmYaeommWcZXGrot/kqSel1QSIWG4hKuzcgWnuJIY65PKhdc/066fAHMBO2O+dawHhKeC NY3wyYnV4v8D/L8bfg0KZW5kc3RyZWFtDQplbmRvYmoNCjEwOCAwIG9iag0KPDwvVHlwZS9QYWdl L1BhcmVudCAyIDAgUi9SZXNvdXJjZXM8PC9Gb250PDwvRjEgNSAwIFIvRjQgNzAgMCBSL0YyIDcg MCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94 WyAwIDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDEwOSAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJh bnNwYXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDcyPj4NCmVuZG9i ag0KMTA5IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDE3NjI+Pg0Kc3RyZWFt DQp4nJVZ227bOBB9D5B/IPqULlxZpKgbUBSwnbRNmgRB7e0u1sgDa9G2YFvyUpLb7tfvUFJiURZp FQUKJDpzNBqeuTHDkcjjJVvk6P374SjP2WLNIzQfztL983D2a8+HT2wVJyyP0+TDBzS+nqDx7PJi +BEjTNBseXmBkQ3/MHI85GPbcgI0211e2Ggl//t0eTG/uk1yLhKev31Gs7vLixuwlxwvhqFjeYQ2 jedX7zRYbNtWQFTstWBLHTd2vBM80mFdeoKdpEku0i16YosNz9E0SdN9nKzQmGUQpnGcRPCTho8S bDn9Xk1JYLk9oYHfZr0rtr80aBd7Fu5H7BKnTUxsO9ShXWLhnoF1fctDXhh0I9HNwwQNNTIcp3me 7kxKbMgPgzPknDOAA0/6wALvCBvHum+zLaogdYTExpbnKtCbn/tY8Exr4YYWUS3uWFIwoTtsxw4t z+/ljQO6CFQoIQMd2Aks2pOXum0X4MNtHdqnfYkr2TeRc5AD10rOsS01dATroJRaIVGwz2bR9/G3 1Dx8XiewlDwaPkmxP0xur5FdC7osQ0hA6fRkLaLI87EVBi9lDN4t+OXF8o/LC9Bn/QxKh0Q2np3Q 4+588cC/ZrmeX+HQMvpJOohePaXH/L4dPY4Q1M4sjrgoMzYz0TodtHW+KLRG3+jwnkFlvuLJuz+n bzsYqzLkNgrWbM0FR3GGkhSVLi+aLuvS0ndKx9welY8E0K5a2EUhBE9ybcmuU0ixsXRYEGTg6305 CZKrFRpUfxCTfyKy6vc9ROZpREa8lsiIbRaZbxDZkWx+9ZUv4fiSBTdqK+hgq9NJYTO6FJ6EzYfa DA65YVjmJ9QQux26+hl1SqQxP21N7GxyGjtsjh7uSvba2wbf/OoxFTvQ+YGjfoHEXclPQB7QoxRi s3tOrzR1/ca0MP/6cUIwDttlefiRtodQTIhFiWreTs6O2RWDvttmY8GihIsBmloD9OYL/4V+pCLK 0DIVqMigbCQI/MpQDrUDxsAFy7XdCBNozEDvgd7cV/X+W0D330EpQPf8wLfZmwEaT55ASwNJjOQX D9ADE4s1wmHo62oADULLV7mNTcml5IiUoaWBRwC/TndZmgy03xBCr3ZVaxmZRyZyDmYzC7EkQndx suOx/PGEafiRtONOsS99b3C+t+2x8+HsgVECTVt15vbp4KFpDsew5Zl2qHo5CpgPXi1HRZ5C5V/G q6Kz8nc4TqDw2q5CIz2n5z2vpzrFgfLA5TGA2Pg+57vvUncwfesP3XVk4Jok5kO3PfXQXUL853NB ahpNLTRZ82wNmtVOuIFsdopVHxHUNaRp11MFBL6ftt4IMqBoFEVCigBGkOU2hq3imud80e9o69C2 vOlxstSzpSbVz69DrU+rKtQUsuvVSu5z8vQD3enXs5FiZDx+6jeEMp+Ovt2ad3EFf2YXV7BT/nit l1XVJRWDBwt26VVSbFPdt8KmApmmGGmjWQtCAUeG6wECVbON131uPfcp2JjnS+0yRuRu04u6XtwU bMYOup2z3sf6UVfTpErNk8i8kfWjDvAJNUgi/6mLdlW0Fby2vjmwaalQs8Cp93sCb+LPCbyJ/Xz7 pNd3NVYq+GsLfSn2eZYezFVTMdLruyqVCnhkoU+FyPUvCIIygWiPAYGE7gl/2dUhS2OtVy+iaVqZ so5i+wSvO4NqQlCgG2M8qRdI5fTi9l3LUaGQdUx700P7ErsYt4nX8V57VUHk/UM/RdbdwmkUflt3 sfFSbptgmZ26nMOwrEqhOJqucjrLU91aRGFyCR2E3XKsxjArwS8bq1H9/HU1Up6fvsftXo+kjhyn tR6RM+tR15r64vWRT15aL393QepaXInjl12jSW12MNCt6E7glEG1g9aiWT/ocxEUdkfSCbx2JM+s maRrZX111Dt+7GixSdIfWx6t5KpjDCDpWl2xT2RRVTjNnpFeG6bjkSPhbM2STbnKTdYizvKYJehb usr1hRhyC6q2QnIj4gWCrTraMbExt27FTl9Xq9sdBSz3Qb5NtdekVWlVTMbG0qpAq0lMS16W1n7c ZWlVoIIVuiu1qrS2gnLHRGzs+Y7byKmR2GzSAbqGqSlCn5kQcbLK5Tr7xDcbhqbskG7ZAP0t/3hz D63sPv4ZM/QPnPsKhvQUFq7c/DI4uNeXfWXZf8VmUC68M5YCWVJeC+RrHgt0YNuCfd/qDhWGINtX +bi8eMxF/L0or0r1Q1Eog9q0bPp8LBiVx9CEZI0tT7lRFE4/DdNW8s/WcYaidFGUtxM/WIb2gu+Z 4BEqMhlBYh56G4xnh14F+xdkz5nM6UVdDb0K9gBNxoLVer9lObeiVNsGa+k2bU/qzf8TrhiTDQpl bmRzdHJlYW0NCmVuZG9iag0KMTEwIDAgb2JqDQo8PC9UeXBlL1BhZ2UvUGFyZW50IDIgMCBSL1Jl c291cmNlczw8L0ZvbnQ8PC9GMSA1IDAgUi9GNSA3OCAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dC9J bWFnZUIvSW1hZ2VDL0ltYWdlSV0gPj4vTWVkaWFCb3hbIDAgMCA2MTIgNzkyXSAvQ29udGVudHMg MTExIDAgUi9Hcm91cDw8L1R5cGUvR3JvdXAvUy9UcmFuc3BhcmVuY3kvQ1MvRGV2aWNlUkdCPj4v VGFicy9TL1N0cnVjdFBhcmVudHMgNzM+Pg0KZW5kb2JqDQoxMTEgMCBvYmoNCjw8L0ZpbHRlci9G bGF0ZURlY29kZS9MZW5ndGggNjE0Pj4NCnN0cmVhbQ0KeJyNlV1v2jAUhu+R+A/nkkrU8UccnKmq xOdUtG5IodskxIUHgUWDOEoctfz7GdpSHDCNkJAsPef49cnr114318lKLjTc3XldreXib7yEmTdV 2dyb7rLYm8h1kkqdqPT+HnqDPvSmzYY3IkAoTFfNBgFsfgRYAB2CERMw3TYbGNb7v6/Nxqz1kOo4 T2N9M4fpuNkYmvp9j/fCkKGA+qfFs9atgyUYI0FtdpDLlas3YcEZDy6W+2dsX6U6VxuYyMW/WEOU KpUl6Rp6sjBj6iXp0qwc/XxKEKu3tU8F4jVR0al2HZebnYPmJECkXmNOWbUxxTh00ZwiUnOwvIMC CEJxmYThYx88hw17Smu1vebEE/sRI4Z+JsZwRkkdTAQfWC9xnQ0j3yJdDSkmKOAWOnzJkjwunBU8 RNSuGMu0lLnrYzMcoqBTSw0zvhA2SmnbBTOB/Jp9fV6VYA6OXXTHr9v41fan5MzYIXZajmHEK8dz ob6PQmqx8+umr6P34HlzvIvgwfLgTfZmf+w/DAB736RJlVac3j5FN5fdHZhuxwvUzbLYZM8LdFFF gDfi1WQmhCNK7QZV3RcCnRATSsIu+5HFubmBzswjgiGfXN/qyIYYBRU22hU63kJUZpnKTd4mujxc eOctNdsx93ZngyafDfo1q/hJqr1pMXFUHMQVX+CXyX31XMDvCUQT2rbX7GP9Mym0dCbzPvKtndrX A5SdBOj7Dh1nzdvLZ1VFZQqR2sg8Kaq2OYaOeQVM6Fhl12WRk9l/VxqK83k9/SlTXYJABLdhFC9V Ls1L7pLAhNhnk9X47KP+B+/W3fUNCmVuZHN0cmVhbQ0KZW5kb2JqDQoxMTIgMCBvYmoNCjw8L1R5 cGUvUGFnZS9QYXJlbnQgMiAwIFIvUmVzb3VyY2VzPDwvRm9udDw8L0YxIDUgMCBSL0YyIDcgMCBS Pj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldID4+L01lZGlhQm94WyAw IDAgNjEyIDc5Ml0gL0NvbnRlbnRzIDExMyAwIFIvR3JvdXA8PC9UeXBlL0dyb3VwL1MvVHJhbnNw YXJlbmN5L0NTL0RldmljZVJHQj4+L1RhYnMvUy9TdHJ1Y3RQYXJlbnRzIDc0Pj4NCmVuZG9iag0K MTEzIDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDk5OT4+DQpzdHJlYW0NCnic pVfvb9s2EP1uwP8DP7pDS/G3pCEIEjtu0WAtgsbFMBj5wMp0rCaWDFnalv9+J9uZRUdkmA0BDAR4 93i8e7x7ii6rOl/qrEZnZ9FlXetsZRZoHs3KzV00e9qY6Ebf54Wu87I4P0fjqwkaz4aD6CNFlKHZ cjigiMAfRVyhmBLMEzRbDwcE3bc/n4aD+ehzUZuqMPW7OzS7Hg6mEN9yPAemHCsmusHz0QcHlhKC E2Zjryq9dHFTrl7gkQsrxQvspCzqqnxENzp7MDW6Lcpykxf3aKy3UKZxXizgPwefYBTzsKMFS7AM hCbxKet18/jkQEuqMA0jloyfEjNCUhdaMkwDCytjrJBKk34kmn6ZoMghw3FZ1+Xap8SO/Cgkw15L BnCQSQgsUUfYOHfdjWBhIV2EjFCspAWd/r3JK7N1RsgUMzviWheNrlzN5iTFKg7KhoMuEhvK2HsX mCdYBPIKeZoCXJy40LEIJd7LvoucgxyMU3KcYLt0jLugQuCUWdg7v+hD8t1pHq7XC9xJHkU3rdi/ TD5fIXIQ9G4MoQpGJ+hPxRSnCYxZ6Cprp21lhoPlLz3htP89KDi/O47no8umXpWVLxPWQxWDDmFA d+jmo62PhFubgp1uCqifOOE7I2Sszj2Uwr98DjvEStFbcdlzz8NysUguFwt4olvjva/qI1OybVt4 RnH0m4bNMjLFh++373oY92NUWoO/QM7J9HwbGTyheWdCT6bfvk5nr1Bzx0h/Sc3UEfnV1H+V1QP6 ZrZGV9kKTUxrEN6j2RaW6arR6HuR/2mqbV47J91+cFi0/gRopw1jk/9slzhcgyTC6QZg6DE70H8E YZ3yrWBT+f2Ohfcyy7TTwula54+/op9N8SO/yHa+CptFg7PCtUZgviXSJvEfF4e2VSqovwxCgrf6 F3md62Lnon5v/LbNivLzC3ZEhmjXCvBTwyo5UpfrTQNiRbdZborMvEm0TGAS23z+k2lyRL5FtFag /wjS6WCAaC2800gfShyC3WUh0k6fnwV+EEmYxkGIQto8/hOT0PaLOLRdQnaq/qlph/kfunTViLG2 U1aMn12otyncCvBT807Znqezi5xKMAN2yP8f5BadP1fG/tubsAL9R7TfNDz8TVj4V95EEHaXBW+/ l7j9Jp50eX8Bj6Et9qP+getDnf2Pg3OKWWwTep1I4jIfHJxbGEXqpFDsSPGxaj+i9YPxWlJK+uzV 3hVbdN6MaJ9J3qcku/3Ot1mJbp+2tVl7PR/tc8pU0vZ1WIz+rLgzK/6i/14i4Ta0FpU/nX5bnGBy wrKEzl1kba1wVq69lH3mmAEleBJ/Yv8A4AfhPA0KZW5kc3RyZWFtDQplbmRvYmoNCjExNCAwIG9i ag0KPDwvVGl0bGUoTmV0d29yayBXb3JraW5nIEdyb3VwKS9BdXRob3IoWWFvR3VhbmcpL0NyZWF0 b3Io/v8ATQBpAGMAcgBvAHMAbwBmAHQArgAgAE8AZgBmAGkAYwBlACAAVwBvAHIAZAAgADIAMAAw ADcpL0NyZWF0aW9uRGF0ZShEOjIwMDkwNzIxMTYwMTUxKSAvTW9kRGF0ZShEOjIwMDkwNzIxMTYw MTUxKSAvUHJvZHVjZXIo/v8ATQBpAGMAcgBvAHMAbwBmAHQArgAgAE8AZgBmAGkAYwBlACAAVwBv AHIAZAAgADIAMAAwADcpPj4NCmVuZG9iag0KMTIwIDAgb2JqDQo8PC9UeXBlL09ialN0bS9OIDQz OC9GaXJzdCA0MTMxL0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggNTg5Nz4+DQpzdHJlYW0NCnic tVzdziS3cb0PkHfoN9gmWfwDDF84N0kkWAtJd4EvbGdhJEEkQ1kD0dvnHE5VT8/0FIeryBe7zW+6 uljkqSoWiz8htG3fQgxbKnjErUY88hb2jmfdgvCJfw2v077FmPB322LBVwlfBcHfZUs54O+0ScD7 lDfJfF82aeCRZMsRdKluuTY841YC6pB9K5V1hK2ST+pbJR+JW9vxPrWtoRwkb62jfilbRx1BZOuV dPh2p7CCH/eC/1hrCPiZbEKWm/yhg0lmw4RcGluAV5lVoI6Q2baKv8YHbEGmVIV8BlO8YntzBrMC zpnSjD/QtFDAuTTywb+KzggFH9SGLwr+aJSngK6xQjLt+/gUBbagolf3HVzRpLhTntJRqIXMtshe B3sUCtlnQACYAl7HSBGqoNDJp25xwFATCo2YgbOwbxo4C+Wp4JwBeWjgnIl1JZZhp3QoDDHBuVIe 9FGsiXzAuXbyAecG1NECFPBF6ODcKQ/qi52dhL5OO9FEj6Sdvd4z1GRHc9BraWDVBYVGPnVLEBqF hAIF3/ctoYQClCtRnt63JDvkxb8kxKqDs4BHBDApA8+4UwPZgh2cSyQfcKZyoUe3VKFtEY1MlV0b wLnhiwgYUoMyxQDOrZMPOHeobcQHqbOVATq8Ux40SfZCPhVaHsiH6g5NiXHfhFwjzEgi5cFriexI dI1AevzSUGBnQ1+BCZoDRRGhPDANmAv5gHMuYRiZZLQ7AnspmXiCc6E8sEWpNECwkEoY8Yc0iMB+ hLmhObS7Tnmgnegn8oHl7Tv5JBSE6rCjAGQi/si0yAik81BGmFymUFAiFKDdEQaYE3qC9pMT5UGv 5UTwocFZhHzAWaggsMGcUSEUDQXKAwnQLGocOJdCPuBcgVWESeQKu4nANVfKAxvMLZEPODeqHurL Pebhc3KnCqOPyk55YABlxxeUElpMPg0FiBkBVaE2QalRoDxQphJpQLDBkiL5JBQKtRueCBCiAM5C eQBMkU5TAOecyQecIdBGFjAUNAc2WArlQSNLDeRT6dHIB5wb9CvC6kortBtw7pQHH5SOro0Ar/RO Pm2rO50rNLjuNDuoTqVTpp+q9DQRHVGpcbA/FDLNbt8qDAwFuM9EeWCDNdHowbRC7WijKNCLoGcr sKSNokB5YD8VnbjRd1S0EAVwLjRESFnxGe0YBcoDXYSu0bLBudH3wFpqh01QgtoLbb3Aa9MigWvb hXwqCjRxaF7jqAA3gALETNDORgtI6KNGZBL0A66FfOD1E80cKtiEVgukGweGhC5ulX4F5tlaJEN8 3mof41DrIEyQsnXgCb+yob/pYAIKUNgEhnC9+BzW0oc8sLg+5IER9SEP/nXqBfWjs8KEajq8DN3S 1oUeAtrZqfMJVtlheyiAc4bZJaDYM8BPULgObds4wHT6VTgzjFrDq4FzzfwcnCv9JcDrDUqb0Gu9 AeEEq4RqgJhjHajpAjHG7YHvOOztUNvEoWwP9Hkc2HYOnIkD3j5crXAYpw8Yo8JOZaDthj2NAVtY Ykvpo3ehZBygdqFoHEh3oTJwKNzz+I2cM3+jn8d4u9PpskT4OS7ulTpC7DB84S3HuH3oDUfEvY3f +LZRK+jc904YOCgCmE7fjeGa/jYVDtw7f+NQHxiMJA5YgWNpqhzox4iAzkYJdSaOj4F6PcbyQDkS wwvEFfyNb4UhC0fWQM+bKuvIkSOEsFQ4MrA2DiGpkXMZv/FtoeY0SlCJNEc/jKc7xxKUWuRb1tHG b7ewAzIzAAIcHE8YaAEa/Ebt3tGziZEJhg7U0RlIMVxJsFWUQJM45ka64tRHdFY5PEG+SJNIHPQj 25UYssCR81sGN7nxCwZuhaPEznoLeowYox85FO2st0JK2UdAx0FkpwStcMCjBB3/C4dtdCnGo52c eyOXzlCQXBg3wAGADtaLElpzCwAZtMgI6RjwSGCAxdGaMqIkpBuBYOMYyhCRpiiR/IitMMyEyvM3 chZoOv0zSqxjBJOZ4x2jv8RARhh3QTHHwMsSLEIYuEItMAoyiEp1jMZhBHugS+Rc0YvCoBJwk46c GzROGA8DsjFss0R+DM7QxZCZYRE6EXS0S3QY6IQh6d45rMcRR6ZtRF/CUVWEsSUDDHoOlIRxAMNM jgNsH5STgQTtV2h1I4QWaoOMoJjyCm0Vn4GOljzCBhlRKwbhbQRHGL0g1S2AZRhCC0UMURhRsAQ9 E9qvVPIrI4yGLQhtVRgWCe1SGBcJrVYa+dFqEVOQbkwKKB/tTTr50RrzzhiFtpr3MoIURuHkR9vK DNplxNiMPYU2mEeYRAvNHOyFFpppvyNUzfS3QmvMQyNoeXloBO1yxBwyoni+EVpUzuw/2hvcFena CNlJ1xnkkx9tMA9boB0hBgHdmB1U8usj9Cc/WmNmVCW0RoSWpCPnRvloZXCEpOtjNtAZXnGSsDPQ CiwxQqKVlR1tyLStwqjxNpngVCHTtgo9NVGky0EsRCsrjB4ybatwVMyB/OiRM62s0LdkTp8Qg6A2 WlmhN8tjnsG/cxhzEIZUtMbCYX5E/YWxZKYNloL2Z1pUQRDBeI+lwoCPXzS2Y8xkGmM/WllhLDam cYUtz5wcll4ZEHJiwZA/097qznppgzWw3jRmNiOCTCwBvUwrq4yNacOcMkGCNOY76E/GjnCxDFlp b5U+N6cx02FASiur1IFMK6tsQ6aVIaopDEU5NaIstLI62suxsVZgkcd0i5EEJw0odYaqlL5B8jzm Tg36nWlbiG7ozflFH2MCZykMnQN7twf6KvZk72OKzFnNCDsCpxEM3qmrkUMYpwssJXpCTiA4LZQx pxghf+JvHJ2FcWvgiMYxGIMB/STjbxrcNuYKVHdYSmKp0mb4W6Ff4+wHjKmn5FIZazPiD5xKZ4ai mOIRaU5GODvIDPoxA2O/cGIRSMfJQqQNwpg4D4G8v/nNh4+jI/bt2w/fffj44at/2/Y/bB8+/mVL /O23v/3Hf3hFExZolA/0+oEIWnYj+v6bf/qXE68LXVG67/76xx/uBB++2qISff/zXz99+OZ3//rt h2/+9J9wV+P1K07N45ReVPf1f/zwX0MsqA1+GZkRPL9USJm1ONYb65tkI9niVpGiV0V+3Q/V64ck HqfyorqjH6DCNyHLLxGyzvohJWUt+qxOFU9NbG4TuydHOxG15ybKfqtfZji4WtSnTVQtkrjWtO41 TVz0wn6iSpe2KXwyge/46so7zBonipus4RZ3t3EubiGeqC7AZQUuT4ATF7iQpo1T5PIacjF4jcs+ cicvkS/IZUUuT5DLPnJ51risyOVF5KLbOB+5k1fJF+SKIlcmyGUfualbyYpcWUQueY0rPnInf1Iu yBVFrkyQKz5yU4dSFLmyiJw7LBYXuXhyKOWCXFXk6gS54iIXpw6lKHJ1EbnsNa66yMWTQ6kX5Koi VyfIVRe5OHUoVZGri8gVt3E+cieHUi/INUWuTZCrPnJTh1IVubaInBulNB+5k0NpF+SaItcmyDUf ualDaYpcW0TOjU+aj9zJobQLcl2R6xPkmo/c1KE0Ra4vIudGKN1FLp0cSr8g1xW5PkGuu8ilqUPp ilxfQy65EUp3kUsnh9KfkeMqBQXgkpffOH+CMnUoN5nG4tlS47wIhStrngByonpGjlm/mwA+cvev rrxnDkVlGot9S43zIhSuBHoClBPVBbmgyAUfuftXV94zh6IyjcXJpcZ5EUoMPnLtRHVBLihyYYJc 8JGbORSVaSymLjXOi1BicJGT/UR1QS4qcnGCXHCRk5lDUZnG4u9S47wIJUYXOYknqgtyUZGLE+Si i5zMHIrKNBarlxrnRSgx+sidHEq8IJcUuUlCJPrpHJk6FM3nxLSInBehRD+PIieHki7IaSIlThIp 96+uvKcORTMocTGDkrwIJfoZFDk5lEsKJWoKJU5SKNFPocjUoWgOJS7mUJIXoUQ/h5JPDuWSQ4ma Q4mTHEr0cyh56lA0hxIXcyjiRSjRz6Hkk0O55FCi5lDiJIcS/RxKnjoUzaHExRyKuBGKn0PJJ4dy yaFEzaHESQ4l+jmUPHUomkOJizkUcSMUP4eSTw7lkkOJmkOJkxxK9HMoeepQNIcSF3Mo4kYofg4l nxzKJYcSNYcSJzmU6OdQ8tShaA4lLuZQxI1Q/BxKOTmUSw4lag4lTnIo0c+hlKlD0RxKXMyhiBuh +DmUcnIolxxK1BxKnORQop9DKVOHojmUuJhDETdC8XMo5eRQLjmUqDmUOMmhRD+HUqYORXMocTGH Im6E4udQysmhXHIoUXMocZJDiX4OpUwdiuZQ4mIORdwIxc+hlJNDueRQouZQ4iSHEv0cSpk6FM2h xMUcirgRip9DqSeHcsmhRM2hxEkOJfo5lDp1KJpDiYs5lOxGKH4OpZ4cyiWHwj2LFCBNcijRz6HU qUPRHEpazKFkL0JJfg6lyonqGbmkOZQ0yaEkP4dSZw5FZRqbNZca50Uoyc+h1HKiuiCnOZQ0yaEk P4dSZw5FZRqbSz3e9x0J+Oq28q65xtvs2RaubXXXVkJt0dDW12wpylZtbIHD1gIsbW4ZZkvGWt7S UnyWDbPEkeVYLB1hM3eb5Np80KZONsuwgNxiVwvzLCKy4MHGWRuSzHubozOfYOZjmmagvNeYI3jI j3tB0i3BdEJVo+yvtv1EZKDeFaYoqCeNvbB+trSDdTgRmckc+qIpr3TL4Lxg/dS04jVNV3pf1B9P RPtz024Zo7F32W3a8dWFdZo17SbR2AS91LTqNu15P8tR/8mHxXxpWtX626RprkLkadNUIeIias1r WnJRO3mwdEFNHURKE9SSi1qdNS0pamkRte42zUWtnYguqCVFLU1QSy5qfdo0RS2toVZ2r2nionba 9ZLkApsobDKBTVzYwtSRiOIma7iV4DbOxe206yXJBThR4GQCnLjAhakrEUVOPOQ+jgMEHm953QXR 6wINOV6xyi8qPLpAx72UPQzmYpZZF2TFN6sO3QY5pw4fwvq6K5LbFc9x0J1Ve1HhvSs0Dir7LxJz asdZNU3Di3TOND3XUVwoj/0kT10hXldcckZ3VuFFhUdXaM4onXNGXyBmnHWFRlYq2zjX4tfhQnns EHnqCjeOqq4Sn/Z6pEuGKVVV4nMW6AvEnI7JmmFS2cYxHbeOSxLpXkd53RVu3FVdJT7t3rhXeO8K VeI6cZcTMdusKzTXpbKNU0duHc2Hsr/uCjdOa64Sn7Za3Cs8ukLD/9QmbtMXM02HxaYa19RtNs9t PjXSjdhadQU5WWq7OESd26Q2w8LVpTQdHpvqUp842+7GLMkZHt3I7pKyubPKLyo8ukBTNqlPhq6J mNPhsSu+OnVMfeJsXxjMS8LLRF0neTYjsumDxdoWmFoQZ/GODfo24pm7N19nhm5abopgvTEO3nmt uQv5z+GmDFxqFJ6Ge0M/zkNIXOLK83g87rVJWeLKw1BMKI4zREzhjGMxnJmPY9eYES1Vm/tKbWVf YlaWOqS865DzMZLqZXZuNYY3VINVXCGy+mSpPo/qob45K6uwzFiFl0Ry3/vyux///edznc+Exu3r YYZyToK4NX99I20LpEPI9LruGJ+FFIcwPAp5zpS8EfK8HWcuZF4hKitECtzNk7zTlDdU8Q3VuX99 VvHUuXNWeYWorBBZL7j2mc69sGKfPis598KUlSyxyiusygpRXaqvrbDqK0TW665rkXOvr3gpn1U8 9/qUlbxjFc69PmVVVojqCpF1lWfLj2Y6tfj4jtVDV7lU6dxXK85qTmQNbEsW6FE9NNBl9dDAeYWy UmFeIdIGdtfvnRvoUp0b6LOK5wqXfJpL9VDhnFVaYSXvWD3I7trgg+wrnuENq7TCSt6xepB9JRRy iR4G1DmrtMRKVljld6ziyavNWdUlVm2FVV8hsl53zfnsIF2qB41Z8h9zVrJClFeI7CD6Pjf68I7s 3MIJs3Bq4htmsibZ0YCpewjvqG7M4hKz9Joq31dsn2L5K6VN/W/BfA6nVMSVuDyzzatsq8/2aZKg wlttS/1Q1jr1QGjqBMM7qgfX9YZZek2V76uzF4SeKeWxKx9OFLiV37oy5hXajw9IPlffnwUtHmV7 FPThRoZ3gvZlQQ8QlyJFn+zRT8yZpSVmssYsb2WrNjC8Ycn7vjbePsOLknh5RshrleCrLd7lXvHh PtVLueeDx13wJRHCW0nV+7MHNl7/UteE5g0yvMtzi2FJkPhW3od0UAjTkSO8o3oAaxP2sX0yn8hu 7ZVuoGe8z4+F5k9//jxE071MQXelBN34olu4LCk87jO7PW/LSXIbBcdNZrdn1GfSp+gz67Pos+lT +eimMwn6vdYn6v5F9xhpTmzcTHZ7ar0qp2jKWXQLiuieLNGDRKKpaNF9HKJbRUT3bImeyRHdDCG6 30J0L5fosRbRFLbovgLRvQuie71ET4iIprhFl/9F94CJHrIQTX2Lrl+Lrl+LrpWLnlcQTY2LLu6K Lu6KLiSLHiuQonx05VN05VN0lVWK8inKR1PsosuCokuQUlUOTb2LrpmJrpmJrs+J7lETTc2LLiiJ LiiJLl6J7iQWTd2LrslIs++1HbrhVzS1L7pwIbpwIbpIIrp3VrryUb0U1cuseplVL7PqZVZ9zKqP WfUx33Zbjvu+xlP1MQf9XvVSQ5lxe9ftqfWpHma1m6x7AnW8Hrdz3Z76nepfVr3LqndZl0iy6l9W /cvJvtP6VO+y6l1Wvcuqd1n1LuvWkKz6l1X/supdVr3LWdO26iPGWtd3n3/6258/f//Tp0/f/vjj 5w8f//jTpx/Gn1vQ2G94jiOYO97//tP/fv7q08/3ja6//9t//89wbNpd48rEUeK1h+pSjiuF5LiB Jx/X1ZTjbpd6XITSjltD+v2Kjf1+IUW4X98Q75cdpPvVAHI/SJ/vx87LcUg71ONI87hFzA7d34/L 7vfDpeF0FPN0cPF+zE/uh+Ly/QhZuR+4qvfjSe1+mKcfR194I60t44fjWEWKxyEE3tKrbRuXzeqv +dgOzpuUbfN0vW81bveNuf3Ycym3u9NGMRzbFXmjqfnWdGyHEzm2j/EaVnOK5diaxMtrzbW1Y2sK L9csZpDH1oQcjqX5HI+l6ZyOhVze/ar+gFddmumWca/bKN4udhvFNm52G8U+rnYb2rSPu91GMYzL 3UbxdrvbKKZxvdsoyrjfbRTzuOBtFMu44W0Ub1e8jWIbd7yNYh+XvA2Nvd3yNoq3a95G8XbP2yim cdHbKN5uejts8TI0/2EbPx7js+2NrqrdeumEAnO/rcv2TiudQqRXXNlNU3YrlF3OZBcp2X1GdveQ XQFk1/XYrTl2w41dNGOXwtjdLHaPil1nYleP2A0gdluHXZphF1zYPRN2J4RdzWDXKNhtBnbzgF0A YIf17cy8nW+3Y+Z2JNxOZtspajvMbAeP7fyvndW1I7N2vNVOmdqJUDuYaYco7SyjnTu04392VM9O zNnpNjtkZgfC7FyWnaGyo0x27MhO/9hJHTswY4db7IyJnQexYxl2hMJOMtipA9v8f9+oT6XTDd62 G9t2RdsWZttKbPt+bf+tbZa1Tau2w9Q2etqmTNsbafsYT5v69H22/QIqhwY9usPttN3L9hEYnbk8 baya830jkO0zULpjV4z5R6Uzh6pByn1Xhb7vti9B6z2CZe/5HER7z/B3fk6D9hv4TuSuL1+H7/by OYbXZh8xvFb7GMPrx78skNePf91oXpn+/0J6ZfJlcb1+9GXBvX30MsLXl2thvhEvxfpK/OsG/Mr0 y6L+20eLob8Rv4v/9WN1hdk2WoyP304GLKqxoP4E7pfPCLxn+yVPE0Jb4D0v0w7vmd48n6cp3rO8 eZ6xe5zb6I/HBOdLn+nXfFKY/wOVCJodDQplbmRzdHJlYW0NCmVuZG9iag0KNTU0IDAgb2JqDQpb IDYwMCAwIDYwMCAwIDAgMCAwIDAgNjAwIDYwMCA2MDAgMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYw MCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgMCAwIDAgMCA2MDAgNjAw IDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAg NjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgMCA2MDAgMCA2 MDAgMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAg NjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwIDYwMCA2MDAgNjAwXSANCmVu ZG9iag0KNTU1IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDQyMjA4L0xlbmd0 aDEgODY1Mjg+Pg0Kc3RyZWFtDQp4nOycCXhURdrv36pzek06vaTTSzpJd6c7a2cjIRCgQzpkYYlh DZCwJiCCDggYZFxZdNwCCOK44ozMuCIinYDQCcgy4igqLsiAo864TNyNjA44jpA+3/+cNAgzPvPM 99z73Oe796ZO3l+tp6rOW1VvVYUoMSJKBEQqqp40eqReN3ozsUFPErkaR1bX1CZuMUwm+qyIiF8y cvy4Scn37j5D9MUNRGUTR06aPEKt2n+KWPobqOT4uEmFxcbArEQiFkGtzVOq6xuLO+qzUNcyIvMv 5y5qWWJ44hEHUb4WZb6du3yZ56mEeVaiituJNGsvWzJ/UbtlUDFRwVki1dvzW1qXUIB0aN+D+kzz F1572YIJ4+4jGol3VvAF81oufb1t9WDUFUT+oAVI0D/D/4w42iP/gkXLrlllKs1G39Gmc8bCxXNb XrP2vEb0AuKOzYtarllimhqXi/L3o7znypZF8247Woe+/Qn919csWdy6LJpJ8veTnL/kqnlL9m5e 7yYaeAz57STrTkX0jyO+ibONwdNanVYuR49kTGiR/YMjPkuVND9sEM9oA4jqlPKyg6/e0vsAXk6U NNJR8cz5nHNutpwSP45GkaDEOZmoUO6J8DDaVVLEI2wDWteqHlSVoMrUPl9oocu4RaXiGkHHuYqL 4geUKx2ga6qUHsA11Fd5KEQeYYX4aXSF3BM+P0RMkiS8PUfcKH8pieIRmi+Xhh8T9iVETz/hxCN8 JvLyUe6jvjgLINwF/wj8TyAfQ7ohWyHPQ45DDiHfAv8tyKcIJ/aVZ2X/Wj+dgJghUyErIb+GNEIe hqyC/CzWhlx/UyzNASmALIDsiPnyO52Q9ZBJEBMkAzIeMhfyB3xLeewbgue+P+ZvgOTH2lgRa0Pu 142QyZDnIDsh+yF7IEmQhZC7Yu+tir37OmQjZDpkGKQMMg9yD6Tnp/Tb7/pdv+t3/a7f9bt+1+/6 Xb/rd/2u3/W7ftfv+l2/63f9rt/1u/8rnEACk51KEBhnjByqr+IO0PdaibSklqKkI53US3qFcRQH xlM8aADPUgIZQKNCEyWAZjJKZ8iiMJFMoJXMYBL4A9nIAtopEXSQVfoHOckGJit0kR1MAb+nVHKA aeQE3Qo95JL+Tl6F6ZQC+ihV+o78CjMUZlIamEVu6TRlK8whL5gLnqIApYN55APzFRaQX/obFVIG WKRwAGWCxZQlfUsllAsOpABYCn5DgygPHEz5YJnCIVQg/ZWGKhxGhWCQBoDl4EkaTsVgBZWAIfBr qqSB4AgqBasUVtMgqYdqaDBYS2XgSBoCjgK/otE0FBxDw8A68Eu6hIJgvcKxNBwcRxXSFzRe4QQK gROpEpwEfk4NNAKcrHAK1Uif0VQaCTYqbKJR4DQaLX1K0xXOoDHgTIWzqE76hGbTJWAz1YMtNFb6 mObQOHCuwktpPDiPJkjddJnC+TQRXKDwcmqQ/kJX0GTwZwoX0hTpI1pEU8ErFS6mRnAJ+CEtpSbw KpoOtoIf0DKaAV5NM8HlCn9Os6T36RpqBq+lFvA6mgNeT3OlP9MNdCl4I80DV4B/opV0GbiK5oOr Fd5EC6T36GaFv6ArwFvoZ+Ct4Lt0Gy0Eb6dF4B3gO9RGV4JrFK6lxeA6WiL9ke6kpeB6ugrcQK3g XeDbtJGWgXcr/CVdLZ2ge2g5eK/C++ga8H66VjpODyh8kG4ANyl8iG6U/kC/ohXgrxU+TCulY7SZ VoO/Ufhbugl8hG6W3qJHFT5GvwAfV/gE3SIdpSfpVnAL3QY+RbdLb9JWugN8WuE2agOfAd+g7bQG DNNasF1hB90pvU47aD24U+GztEF6jXYp3E13gRHaCHaCR6iL7gb30D3gXrpPepWeo/vBffQAuF/h AXpQeoUOKvwdbQKfp4fAQ/Qr6WV6gX4N/p4eBl8ED9NLtBk8rPBl+g34Cv1WeoleVXiEHgVfo8fA 18EX6Q16HHxT4VF6Qvo9vUVPgscU/oG2gMdpq/QCnVD4Nj0N/lHhO7RNOkTv0jPgewr/RNul5+nP 1AG+TzvAD2gn+CE9K/2OPlL4F9oFdiv8mHZLB+kTioCfKvyMOqUD9DntAb9Q+CXtBb8C91MPPQd+ TfvAkwr/SvulffQNHQC/pYPg3+h30nN0SuFpeh78jg6Bfwf30vf0AvgPegn8QeEZOiztobMKe+ll MEqvSF0kKbzQpusVm67//9KmZ/fb9H6b3m/T/xds+v39Nr3fpv+Psun/L53Tq/+bNr2u36b/W5u+ tN+m95/T/61N7/ofZdNJ+UtbWVJif437C8QQYm0kYrUSrLMJKWpY11zYsumwAbOxsjbTNmGF/Lez sMDZsJ4hJb3lXLr0l4ueudLcs5v/5a99zzumph//SJhz+e9+/6kAuiiqlGBcvIGMJrMl0Zpkszuc ya6U1DQ53efPyMzKzskN5OUXFBYNKC4ZWDpocNmQocOC5cPRuxFUXVM7ctToMXWX1I8dN37CxEkN k6dMbWyaNn3GzP+tv+Ki2J8u/7fd/zFthyobQhXDy4PDhg4pG1w6sKR4QFFhQX5eIDcnOyszw+9L 93rcaakprmSnw25LsiZazCZjgiE+Tq/TatQqUeCM8mp8tc2ecGZzWMz0jRqVL8d9LUhouSChOexB Uu3FZcKeZqWY5+KSIZS87J9KhvpKhs6XZCZPkIL5eZ4anyd8pNrnibBpExoRXlfta/KEe5RwvRLe oIQNCHu9eMFT41hQ7QmzZk9NuHb5graa5mpU1x6nr/JVzdPn51G7Pg7BOITCdt+SdmYfzpQAt9cM beekNaBT4WRfdU3Y6auWexAWMmpaLg2Pn9BYU+3yepvy88Ksaq5vTph8I8LGgFKEqpRmwuqqsEZp xnO5/DW0xtOed6BtbcREc5oD8Zf6Lm2Z0RgWWprkNswBtFsdtl/X7fgxisotVY23XZjrEtpqHJd7 5Ghb222e8OYJjRfmemU2NaEOvMszapvbatH0WiixbpIHrfFbmhrD7BY06ZG/RP6qvu+b56uRU5qv 8IR1vhG+BW1XNGNoktvCNPFab0dycqgTW21yjaetodHnDVe4fE0t1SntVmqbeO0OZ8jjvDgnP6/d ZO5TbHuCMRaIN1wYmHc+TwkpxeVQ3cTzmmVyj3yjMSHCnrke9KTRh28qkzGvjNrmlqEYXBPDW+FL MSKXh3VVzW2moXK6/H5YlWHyedpOE2aAr+eri1NaYinqDNNpkoPyPDk/1ZB/LhwOBMK5ufIU0VRh TNHH4Uq8ND9veYRf7lti8sCD+mg8dNvSNLQQ6vd65QFeEwnRHETCqyY09sU9NMfVQaHCQFOYN8s5 B87lJE2Wc1adyzn/erMPM3mnsqyTwtrM8z9Gky2xZsHQMLP9m+x5ffl1k3x1E6Y1emrammO6rWu4 KNaXX3Y+LxYKJ1Y1Ci4eC3GXoORiUs44X1iONMaHxQz8qJVJfWlEo8WsVFKYpzZsah7Vxya91/sf vhSR/iq/pXg/vhbrZnho4OL4sIviF3Uvvk1Ah8VMXtcwra1Nf1FeLSxQW1utz1Pb1tzWEpFWzfF5 TL62TiFTyGxbUtN8bkQjUtcaV7h2bRM+YgEbitnKaUS7j90+oT3Ebp80rbHTBAN9e0NjB2e8qnlE U7sfeY2dHthcJZWfT5VjHjlGdQwzvYNrlSxXZ4holZIrKglKfG6EkZKmPZfGaG6E96WZlDS4/C4c qg8IBzoml4Qi8IYq3o4Ef/Eq2Y8zKH6HrqSislA4QEsg2yGvQ0SaDa6MpQjkBisgcup6JX+zsIfC kAOQNyByShdSupDShZQupFQIEWLCbmFXh9+NpnfucPqLT1YmCztIgnDhLmENLmpuYVbMnx3z18PP hb8h5q8T1nQMcxsrdYgzOglKEI5ve6hj5LjiTiUwOKgENp1L2bQDKe5Kp/AQevUQevUQevUQenUS ZKh1E9I3IX0T0jcp6ZuIKVV5c2JVxQIPdRhtsRQEKvVCkzAFdz+30BjzpwpTOord+yubhcmoervC zUIDuF7hbIXjFK5Uclcq4cVKeLESrlDCFbGwzMIL6FZolClMFCbhvuoWJghjFH+8UIN7rVsYh7js jxVGK369MFLxL0G6A34dylngjxFqlfhoxKvhj0Jc9kcKtR3V7qLKJYjPRh5He3J6NfpQjT5VQ0ly ynrIZsj7SspscCXkdYiglGRCNZ4qPJVCJd4IoY4QckIkCCE8FXiGC8ORU46y5WBICCrfGESpIFoK QldB1BzE8AQxPEHSCEHQI5RSESQEGQ9phqhQTx7ey0O/8tBCnpCPu75b8PK1ZIXvifluvobS4Kfx NR1p7lClju+k8ZBmyBLIKr6zQ2UxVlpRTi5bCBkHmQ1ZCXkYsh2ipYq+nFAcr+AVwjg+ThAxu3N2 BIPFil8yqM9PSe3z45OLjZVXCTlQUw49DBHQ5Rx0OQefei7mhnBMnSzaD3kd8j5EVngWlJEFZWTh A7PwfpZSSq2UOwmRIAImURbqv7iMSnnbDSm8oBY5NRsp2Yhl451slM1G6vsgU96Q88dD1kP2x/LS lcmcrkzOdNSVjt4WghVKyAi6hfQOrjNGoF821Fg5GHofB0EmXwdtroPe1skzhMuLuBA5FbES6yHb ISqhE08Oniw82XjS8XjxePBgBIU0jN4GPOvx3IlnHZ61eNZgNKzbA/sDfHbp4tKVpetLHy7dXrq/ VLOHt+Bp5s0hPdls2AktZm1ypYmLNIMM7AeF2xRepTCk0B5KnmHonmF4aYbhgRmGe2YYGmcYxs4w 1M4wFM4wRNickD1geDdg2BAwTAkYBgUMpQFDScCQEzBUmlkTm0oG2qdwhMJihekKU9nUDgPp9rLp 5NVixrOsnd7V7o+9EZF1uG/2RrTwbuqLTe/zhsmJu9xF3vnuvL6UzD7P731ORA00mT1NGhYI5WkO a2ZrQpohmgJNviZbk6Xxadwaq9aiNWkTtPFavVarVWtFLdeS1hqRPggF5FuUVW2SPbUoU1TCJi5T vnDh6MCZltMYCicKdbxu0ghWFz4wl+rmeMLfTfJFmB57qso3goUtdVTXMMIRHhyoi2ikieGyQF1Y N356YztjdzYhFua3Y8tqaIwwSU66xSUfXzuJsbxb1rliflOT/E5ju8jWrWsi2/IKR4VluHlIbfVP oDnGwI/OEbgwgp6khu+tm9QYfiq1KVwsB6TUpjpoTj7tdvIyPqimupMPlr2mxk79Kl5WM1FO16+q bvqxHHmQXt1JXtlTypFHLkeefyqXxgfL5TJkr69cmlIu7aJy7eXemup2r/dcmXKlTPnFZeZfXGa+ UmZ+rIzQV8Z7QRnNB+RVyng1H/xLmbT/oEzGT5a5QJvzRgT+jWOdNIYdb6+6Tr4qNPtq5kGaw2uW L3CEV83xeDqpih2P3SIym+fMXSD7LfMi7LhvXnW4ylftaR9z3b/mh6+Ts8f4qtvpupqGxvbrQvOq O8aExtT4Wqqbdoxsyd12UXN3nGuuPbflJyprkSvLldsaue0nsrfJ2SPltrbJbW2T2xoZGqm0pcx6 TEstjWjC2VTxd/A4PSZws8vbNMJmWjJcmc3DvI4Vri6R2JMUh6N6PK59BoiclV+ZXylnYZXJWQny jTCW5VgxzOvqYk/GskxINvtGkKPm8mr8tLbGAv/hT2tr67JZrbNaZV/5aV12NUQeJmql1mWEL6iM V/Y3N6yxbJvXQNYqNlpobW1aRsqYtl5Ncm3LZPxY+fnQ1aiZtV44Caj1n508MwLUJ6iu9WqGUnLB q2PTppUhE9WQ3MlYLUTip5CN5IKfJszBjk3S+zH5SP6vtOX8aK8k8RMo3BCTPteA5x6FDay+z6dL 6RgtorvoPqSVsNdoC4XIiPRjJDBijRSku+nn9AeaLH2DVC89Qicpj4bQAilKZlpJUXYjPcK4rCkq o7doHm3gQSEgfgnjmMuKhK3sJspHLQ10L9npddSYK+kR38FTeRBvNdArwmxtnlQkfcsOiIelOfRb FuTHxWfoVeph6SJFb5bWSJukhyiBTgmpvc9LA6RFeGsyNdPVdAN6sIp+TUdYEy/n+6U70KdG9GEl 7aZXWAATqhknuoko/Qu6nzppH71Ob9PHjDEjy2ar2FvsmIp6D0UPSaOlOdJiqqGxNJ5WITeVZbBK Pk2YJmwTTvT+JfqBlIa6G2g5XUPX03raQFvpBP2R3mUC1/MGPlnYRi4qp2k0B9q8G33aQofpfaZl A9lQFmK3sqf5clHoPYQdXqQkaHCUov27aBN0+hhtp0P0Br2JOr+BTgXmxOBPZjPYjewWdif7JXuM Pc2eYV9yFX9bEITV4u/FL6PHJb30oLQF7boohTw46+ZhDC7BeB6hL/B9uSyPVbCjPMDzBCbG90aj JdJIaaX0gnSCfJSFsuU419ZQPU1Fr6+lm2kP/R7vHqHX6BP6O7QkMD2zQBce5mMT2SR2NXqxjZ1k vdyG8SvjC3kHPyYEhCPiVPGZ3p3RpGhH9GRUkrZKYel56VVlfAehnSqMwExagiUmj9izaOcF6qbP 6TTaUDM3+jqK1eF770f977OzmE5avoI/zSWcfjcIh0WneH90bHRR9P7oDmmgVI+5JeDQ5aSBeIZi Nk2mJtR9E7T5CD2FkdmB2XOcvmYOlsaK2Gg2hTWyZraALWZL2FJ2PbsBWt3CdrI97Dh7l32Nq6Oa J0FPAT6X38Tv5jv5IX6cdwskTMIdZqlwvXC3sFN4Q/hMNIl5YpFYLzaL14rXqXAkU9u0r561n13U O6f3wd7nowXR6ujPomuiB6PHox9JcdJ+6WMcRYvQxyaajz7eiO+/le6khzE/nkIfP6RP6UuM+bfQ hcB0LBk9divjVoV+16PnU3FkugzPAnYF9L+KbWUdbC87wA6yw+wVdpS9x07i8pzEC/AMwyqYzC/D NzzIt/Iw/yOe0/wfuJbnCcVCCW4Vzfia24Tb8T33Ce8JH4tcTBIHiJPEleKLKkF1qepe1SbVIdVL qi/UJvX0mI340YLIv6t9lR8UhwsLaTNuB4LwBT/Kg+xGfoY9wVPZQbSWivvWeF7Fh+FstAezfBFZ NZvUXrWXW8mkaZbr4A/wfGGqmCnE0zKsN+LT+K28mR5ne+kMH4WZtlw4wjfz2cImcaM4nJ3A/eKg SNzAvqNKqmTDMXZv0VKMUL6wXXxNrlGlFc6qFnGDdJv4qYoLR2EHyxkXXmbTWA8bz23Q1jB+J/kQ N7Ee+KOxAv+Imd+JY2eZ+IGwlo/h7yJtId3NDuIb99BCvof9FuNShvV4FRvPHhIG0Aq2FNoYQlfw X1I6X8LTMZ8n09/YTSwJK/cMxsbPLyNRMPC5dIw3YdTfYBZewFZgni6iNayN8lgvO0Cv8rtoEJsn 7Dvr7M3m7GwPaxdGUTs7Ix4WD+PwfQaaTMXM1eLA/SHm9Ca08nvyCpmYNWWk4rjHYT01Y62b+Wl2 A19Il7P7hc/ZY7ySxtE8oZXXsnujp8VKoQQa64I1qVIP0ZIqqEoVB2LEP6XhmI3zidQLxPdVN8lh 4S3hlNQkeaOzVQnR9+g6aGcUrNsarKVR9A6zsVlsgijxOlGSptBWvl18T7KzeOalNyWssOizLMj8 koctleLYBMzwWfL/t0RcI94iXi3egL3pDKzmrbSRHqTfYTd5FPtWFvR4CbQ5A7bncuwRRVRMpfi6 4fK/PNBo5I2nKbCnzbCSl9GVtBSW91f0NLVjh6qDPmbhvcvoCqS3Yoe6nlZg/d9Ga2ED7qXH6U3+ FH8Yd9zb+Qt8Ob+c3qF3hBeFEJtCx8Q7xJU0CXfgCSwRLQ/GKLnx3lrpLbSWQy5Y/4FYpZj30pfS cenJ3tdR3+Po+0b1CPpSXUXZNI59JyYzFewbdCjOV8n/hKGh2na1JsLid3JGKlEOCKRXqxDYJQg8 WaeR03YxcmrHXe8IjDWdCtb3BseavgvWm3pxqQ/2BmUZUFRi9pozvGbvfJHOeoQDZ0MqOkMe8QDW 05fSR/wjlQo7kZvGhYzH4z6O41qNnkwscVkyqt8dSjRQcpztGdNwph+e+gyuURqm2ctHY3eIsrHk CJi+m9nT3W3q7qaKih5TDzNbhuBnQBHMoqBW+9Izs4TM0oGDSoptSVZBodqHVCTx3ZncbrbYeQYv 9PkK5mUFyofnyhA39k7zJCd7+OOOuPSCAp/+rLY8kBcsz80PyvcjPX9COCgeJS163dyeoIrwW0N6 ptfJ/5cb/QldF3+U4vi+ULzHvN/8uvl980mzytzFbMT5vh1arP0If/TZIu1i3Mv28gewm3/Dxvd9 x6keUy++5lQPdBc0BaFPfIY39hU/BtBWrdrjdHrUbL4SdCR7VOLRaHKm253JPunzifGZ0bOwJp9i Lx0fysqJzzVxlT0hUW+xqdUqk92WmDQ8UVWv0yVuTvATmTD0zpSXuzAHHMx5izyaM+t7TwVNPSZo FgMJpQ6RlSurdiYbaLEM7tOpBhuN1WJX9Jqelckz+czgU1nxCRan5spZs67UOC0J8RlPhti3rYyz ib44h1kf/3I08uhj0cjheL3ZGZfOxkRxH8yPnuUrY73N0XFdspM7k0W5xzqL2m4zqdTorV6PTqO/ RkwXTsmpj3bh3Bfr73dyf7vRYaW7F/XWyrlGrQz64EGW0oE8q29G2G0WG1/5k739pjUqRbelxzvR 28Ns1KOPsVEvo7eYD9Fd6C19xDXCX9DbfDYwdLM1xeQLpZxO/t6vqnLelrjKKrhdbv8lfiHX32y4 NHGR/1X73yynXH/1a/Ny0wXK1lsTtFavJS83y6hXiRmUn+/P8FszMvx+nz/D509xWVNSXK5kV0qy P9FiTUy06LRav8VstVjM+Rl+X4qKspMTLWadKkHrJ4suX6SMiCCELGaNZbpWSxp/vctjeY4SWEKE PRgyakOueotHg7LiP7IZRVh5KG5c9uJsnu0seHGvI8L8seFWRrs3mOw09SQ7TD0ze+SQA+qUvYru iiHyyoJW7UNkEW8rCCTcaDp0W0KBI6D9l4CIACllS0qUkZDD8mjMpKUzmblvRZoz+iaRWqM6N4Oy zo3U4IzM2DDxMkeixcHMiXqTw5wcPbnF5DTbkrZsSUqyOM1bol87zQ5jXKKwnrndycnu6IdNaqfZ aNM2fWY3WJypn3+e6rQY7J9N0yYZzU75n5lZIHqMv8kKSEclIcfv6Ch9QH/FIXaXyP7GD9JRo8at 4Zq97H7S0yKW2rc4u3u7qbBHmU5eFusiDi3m6AlXptMnsILet4t9Tn28/EuULq4RE/lK2NDkUDwd wExVcac4d6tsJLtNn1BhvVxRkrdUTDz7BF95zTXo0xHpI1xQviEDpcCadGjjxLfjnAmLOlkaKba1 HvMab2VcbMIm+8vGTxgs45txZUPHyoL2P5GmCl+oFmFRLwoN1elszKkTymiIrpaN1k3X/Uy3nF2j u0N7h+5e9oDuMbZFt4t2sRfZYd1x9gn7XPcd+15nj9OxuAh76VkhbjhN10VYBzo1XftcocCEE+YI 29O+F1o5NbMX1iqml6UzZ7LzihkUM7gf9M4wu8xOPX8kzppgdqr8PzRmOI3xSaon7QlOYxwW8cf4 7s9U8tm3kG3bYeF6X5f0LQnSqY58bU6lDuFs6RRlSX8nGyRJ+vuulARdgjaBd0nfk0n6tiM1IV9+ I1f6NuTLUaUkuBPSLYu0aSkWKmBZKkO6L8FbbskrV1lUKkNyOazvq7sG+MsTnEW/6WJqGI+8W/rU a/oOGq7ACuhRJusQ85A++1F1bWgaLzBlOpx2p82Z5LQ6VeoUV6orzeV2ieqszOzMnMzcTFEdF6+P 18Vr4zXxKrWQmW72h8iTmBxiAXVGiPLFwhDzGb0h5nICmfF5ISrggHIxVq7CuXCB1VQWc6zsQodb fCjJnJborLCmme0VZhm2tDRLRXpEOhMKIZBlTTEDLhPgNAL2hAqfjCyrzYAQIFhRTkizxFXk6wGb HEq1Or1yJV+F7AgYrXa3/Ja7gutN5uF2GewnfgMkd7uJJZmUtZqViZ/SUpOyIdht+NEMREpWpi+d JyVZEbfbSootpcJnq+c9OObmgtQaox2hupsK0qpNtoaqXGf2kJHrNlcFHNlDRq3dzN99I/rNr28Y VurdWD6l9Q1mksPpG4NTVv78SLnP6Yt+cKDz56+Vpzv9zHtAXm3dOKx8Jn6PnaO9w6J1RaTvQ0az mrQ6V8g13jLeJeqMXXwLxbNNIZ0pPt5o2qfTcjlFhRQLU6k426eN/aGDxuKydvETOIXO300qnTbe ya17+Grs9Hb+WkhP881mNh+nE9NzfAmuqL9hr/XNIPkUEjT19piUzbuip0cxk2TqLbcMKXQw0+lT hy6KDCiimcoom71969mrrOcSr1l1bqMazDcwT1pyclrvQpnME/3aqjM69Vqn+P2ZGXZYRIcl0S4W TZGtnUErnz62QhMnsJYCzNOu5lUNjbtdcQGVaCUY/enP6uOt5ekqWJGK3j5b7OrEmvpzKM/lHzjK eF3CrVm3Zt+a83j24zl74nfm6gwWva00vixXzPHlpgWsWWnZvnhrnDxTDF9Yemw/WHptYrb2nCbf 2x1TpOo51g3DGscMMGrTd+p0+vjkCPvHTqXtPTi/YdEjXfuhuTyj0sAX46BsR2oaysfxRbhO3HVu VZq+OyUvSkA2fT0V0G83DngxNVKfGrE6U9x+i8OW4clM8jpClOgzh5jdbQ0xix+Ira7Vq/v0DUdL 2dJA02Bv7FAIK+wfPJyXDsR0VWvUsd0nZr/Uag1pevkt8v5z9hijb5c2uJ+5/sqnnGpdvMlsv7yz 5VcfZU5fHn27q8ErD9LVN3zy9eIF47IXPr5ipkOjt5uKHp31TtvQltZl0fd+I8/V56WPRCiKMPA7 FpZhM4bVKikuLjUP9Y/2j8moKruK1Cu9t5bdI95dem/ZY6WPl3UmdtlfSXzFesT+buKf7F8l/mCX Cs3ye89a0zFw5ghGMAWBHK0xLpBtFgrREQepfCnkTPNkZ+Y5MfQ7PB5LXoSt25FZXoIzwbpnLeVq X/mgCDOE9EnlQkrKECF5aGEXhiCFr94d5xxSolIbvupiq/oGAmaRySayu3us6RPovt4kn1Hl0ejt RrQHdlI2l8qUlzf8PqOZMrDUn5FoFVUZA30hlqhKCjF/aWaIWUVLiEgZl9Vw8MpmLi2jsqXM1ncE yDx/PCspHoRxyewbkRK7ElNG6dwa6RskIXHZdacjCz8rMNpNJuumbRtfaNk1My3Z6Ry19O4Hb5i6 Mc9kjjM7pl774MOvzuFbBz47575PZxSZLCaHsXX3kroNk+S1xNqmz9oQHGjV2U3Z5ZP3/6LhXuxN x+X1hFNeKuFWGDJgP/fwNK8q1Z1ig1o/2ZWaus9mTLJEWHPIkpCwL8nj9c7nAk6bAve6PVD8bkEQ Vd40QxrCHZSAzQf7VWqKvAxsZESaLUmI8JtDRqZKmJ+a6iZjGsNSSOviV5KXTQ/FYQ0xZ7ooJsVj tzqK4fCfH46l9bgsLA3iptAbxBndFJTPbqavcYbD3UG+PvQGzUNUOKThIIbVgoVz+ljwnG8cULSU eUtZifnceeJcIGaISsxmHxOE3rfYW9tr5WNVrcLoSzJ/lRedyma3CFlnX5V1Fz19zhqx2fz9Xi/m +SF5nkNzefTnUHqcS5eSrstxDnWo8nMuyZmdc2XO/TmHne86vnRonfIktsmTOBEBl8entZo8fps7 mblTvfQcFJUh2xFoozukSy0XRT1lZvwXZ18C30Z1rX/vaCSN9lmk0YykGe0jS6PVWrzEtsYxSSAB YraQBeOwhSbNq+NC2VoKBULIAkkbaIFAEpZAgEIgC5gESEpp2R6PtEBpoX2E/kNYXgNpX5pHWiz/ 7x3JdmKWX9/LcmfulRyse8/5zvedc8ZwQ/D/aRZvp9XXSSM5uJNYCpLE4h3onRfHY0PwT0/RYiZO WkdNeHzPEMVFe3RwuK9uvljU5A4i1D5YJ7Ztuh3r1isIAaMlYETxW7CgwW+SNChS3nHLRS6sqn2D kBmFCqx+JlhuNFKHk1GQh9dMv6lz/VuHtl/+nVM1RaAZ7mdb1+554Nrrrw85kBSZjiGE/EntomDw P3e89Hk53hLmWZG9+eUHb3l0Ci3wRAbjEIJPFu2uD6FIFOThw5o9G3HHShFZlcOysnPkCE6ca84y OYnqIWdQZ5FzKVMcbfA2tL+hxjWiX6Ol2NDIm5oVowf66hjlGEJfeQ1JkpSbdFMKqVAprp2bwc3j FnFXcjdxS2O7uB2xd2zvsP/l4GzQSJlDJkV0xULx8EWhC8JXhq9suiS3JL8tsiv1O/ufrQfs7FwK kR6aYUOcO+iReckr0oIjAmIOe9ymWGE+R2TTKIokzWrK6DU5HbEC8pFNOzKdBoPFPwT/U+ODnW5j otPiEN43dYIUnQql8iky9SzxGmgGMRgDduKBpyKdeSR2xMIu2Ap/NEbp+k7BsWO4DxF3FPMOHsRn vb+eH/A21AiGqXg6FCY52sW4WJfBZHfYHIQpTaY0GOIiQ/DnmgcoVsTl4rEmCi2qxowGw64gfsUG 446EBpLmhG4W2DDoDp3JYVwb1AOOzpbqoUeF46aiWwoKO9hWGrYTjQCPG9GncdOBi0/ddNGNe597 8N+erfRU8xvf+sGZrQLPONhk5y9ru0XlvoElGzZedN7cDoK75Dvv3f/TozeufPS3629auOGiiEtk vVZ37YkPw7958q4tq67/+RktyCvfGKkZfoe80gOufcJiwIHbhKArRZhMBuI5i93huNgD3B4P8CAy YffaPHZgoCFxsc3KuGgrSdttO5EnQmLzdq9F5P9yDH3ef4pOfKo68CDc8erehJ0JaUFdJQoT4jYs h+sbUUY3cBTQDT8afgBjicFQe4zinaxgIhcrultsuPGfL/kYgbayCIU/RJrhQ10zxEEBLtNOYB+M vAI+BZ/aSR8pedTM2epFhNHmJAW/0y2sEG6Fd1J32tYmNqh3ZR6C9yV2ELutO+071desr6jclXBT mCi4M4jZbA1E5aGRP23NR7M7R/6ExMbn2xmqqSmG11JNkZ0jfwHxkU+2JiJhTINYtUmjop3JpEnq 5Iy5TpMjOgT/oNHJJE8rnYb3fZ1VfiZP8EPwoGYrhjrp99OdFrF5guxAJnoY53wwFB3QDRXbqW6a +UzBH2Q8JCWzIQ0E3AiHsmakGfJGFEaDDEIkvwcNGSqngQISGONiAgfWLysJ0Af7BsFgDy5fqyMf bUNqAH2Qj7YhkYCvWh5pBKOAZkYB3UF8BwV9zW2vegT0dg9e8+A1D147ThrMGYvfCANbRqFQzxC1 6GEbSQFk29wx9wZu4bf3bdy479uLzkm1v/XTn73ZnnTc871L79lw2eUbvD+/9tqfP3rNNY8SK4sP zr/tnXdu63+wVG477fwVr7++4vze9o8Xr7tr0flr19bMA/ff/53vbt6McJFDuOhFdhEHRdirZcwU mTKrIPtwbGfMpGCQjKbR4BTQ4HDKzSV7BA3NfDGdSHswE3PNK3zAHo3+d+pw1rgbwAJGSfxVQ/jQ eXT+n4BmtE8Z9FUm947CC4U3CuS5lCMGFKc9YWuypJD6Q3cOBS04SFcs2Wk1YjzTrDkEaNZwJ+9Q diLMchAPaNZYp8tX9r1v7kw/S2wGpXHoog8PI6J1BJnGB6BuDfurBxtpl7Zx4EokspEo6XE47U7C xCA6w9FumjQZ4ykLspEmG7KRhBLxxDBScTBLYrFJJdGiEw1ROozWd4CMKTeGXceAF+hTMWANwjEM Q/e6kzZO1aufq86Wj4l5oFxKKOPH21Ix7O7edu7Z983fvfG7z5R62pS15/zwprltPoGxexPFt2Cz u3z3wm/fe++CSZcUw8SvL7n0wl8sunP4lmWPfrD1st6f5qoRWmC8Ng4WP0z9/tW1229evk3TVHTO eq7EcD5wIM1X0CyurbyN2gpM7C7II0wgIb/DZhPFwHjypOMUuq4icAoFHpdC4b4uoTI+GM7vbZl0 Kv47vHosy0LA1pGUAejfhQBma8we517n7+l9zo/pQ86jtNmLSMrD2/Iu6BqCPs2Cvj/Xf9O/4Mkh yGsOW8n5WxcP+XdEYGp8l6AKERAcxhELkbmD6Laeuzzu2zOEx6CSODPeOrO3BQ2nnQOp2gcekRFC pmO+1X+v5SOs7LFz+FmKt0d+iJQhAzrBNNj3NKBH9mwLyCV2aGSPZmHlkkNDQxXNtqEr17gK+lUo 9eB3edHNTuoZjWDpnCNKG75FhSTYWWkbgk7NWqk0d0JyWtcJ0pDBqFnEQtr5x6551k6clWTI9Akn iFZTLC3aQo+1dVUQL56qOXhrV7kS65oWAxWIhMiGrd1p8xDMaTbeE8vwsUxvGqafgR+CE8GLOCWN BTYiuEgPDh/uG8YkDnFe+rAe2ZGHYCmCdm6/HnR0ikt3gD7dTU6v9sRLRiGlJtUmNaEqqtHEuVk3 46bdpCmnFONVS3cTEOJ8P3DlPf3A0Wxrgj1GtKZRXU3Qq4r9wJ119kN7ydkEJ5tOaKr7izoKfqPR frQ5ptw4oUqxEcaRn3gYN1tsHsuYjyVNmHrShPcwOnaaogbTqO8Y5okp9vt3//LhmxZMq6qB/JRt t/90BkMzQsf8db1LM4FTae9Ni9efvmKR2+3ghBNuuO3fzmfibpi1keTti7//xHnfWRUTY9Unrq/t eL72P9NogQ4pnZNKwZ+2n7YE9kJw73VT7lk4vIdAdMJjgfvgdWeevMBIIkthACB3kz8BKZCFT2pq hUE76u9Kt2SmsSf5Tk5PzfSyvXy/rz/dm/k85VJBKpXOQoLIWOkh4n6Nd6x2bHAQ7zmgI8k4HDQj WRk2msQvORWlmFKUZEqKptIWg75kMhV18iFZiIzI6Us8P4vleY6VRJaJBPDSiUEQvDa4JmjYG4TB pD8YDPiliN/nS6dSst/n9vt9LMPIRAbprkwsGrVaKABl1ZUNZols1iJm0oqPU3wi4dsJZ4M07NLc KcWvuSxVwECXP+jf5z/kJxHZTD+ZJxQmo7A7YRdgkO0z1iqDbZ9G73UxEDAzmc+YEYZk0Hu35aYs FoYaqZ9BZAuHdevEt8N6DgirMRzT+/QyGLLXZUZdii3LCuqyq5Eio8byQX/tG8wdfuHYhf/VVP9q M6Je+G89QW2YIOZgwyLDcMILBkPUYPj+8O8H78Ekq/ZrPHbDSz7XM04Pwju79eUXsejbuPaj4Ptw We21UbFn+MTLcd5/Pj8m/pYRFwzfjSuHZyMbmoNsKAASoBku0J7dknpE/bX1V7a3rcbVqRXq3aF1 8Q3qY3HT92PXxC9Rv5dZbV3tXhlbHafOoi+ir7EuoZcwS9glnHl66JTwSbEZ6o1OY7NrUqg93B6v piapU1zTaMqSE0OBsD/uT/lzUVdKpa6kn4m9mDNMDZ0Uvyx0Y2hF/rbQptCOEJWmkFxXAZB4gjKq EEpUPuQ0RJuczaGElFT4hELJklxobuYpgqeicZc9aM/Zq/aZ9n77gN1sH4LXa8lMHCDnI1zMGmYP s5fZxxxiTIyvlGhCgh0Xzw4hei0Wp19ZtwmsPgYb1dA+XahjdozOS5efdD1j0kgRHi/MdcySY2nW bbVxihpPuTMZGLdGMzDNJjMgZlMyEIyzPFxLGRwc7EO/4szoIesg0wCUxkFzYYQ+uq4IIzFaqadV whAM4vMl6Lt/ten6q3o3nTe8Cs9/BZP9MztPuPXy2jb40GlXdM1Zv7L22zPrx73jqjv7c3ede+bK 8/GRE5VoYFHLzKVf8CcuatOu6MJ97iPvkSeTj4JW8J52RcYNc6AKZgKDkffws7wXuS/kF2aXuC/h lwjbvdaWQCU/nZ9emeedV17k/VZ5aeCOnLVYcIX8EQgMlJP3tjSHorLLAQysLbpdZeMttpWkHFdb DCShWpwKNT+sKL52v+IqBAu5QrVAFsS2ZcccwikHMZMaHsbbr+f267uvU6lGRdPbhlkVCrZgxuO2 M2Y8HjttLuLHAaQGGDfAlF8a+csOnvcGBL7Bo+dgGo08fTSD2BB0iQbam01oCej8p4H3mCVlDeVy iUUrht/jffRyjJcwzrr01vNmacrkRADS2xc/0st4WF49/bWF88498dzlzUs/XLaXDE7CR/Jx0Cf4 z+yeowYzp/ZPnb32mdp/ndvv4Rlv7py+qP/ER3589iM/gPgRCbAe+d5lyPckBHV2LXyLdbntJnY5 t9y9yrM6uDq0InxzYkVydcqOolwilAyEcWOw5Y7EjjDRQ3kljLc2XxL4fBKQvBSB52VjUs/tShST dQVlnpdkL6XKFgshU0RMcSGK4wq5CJcvm5ZlGEKnTQAxswu2QWpci487A6ZhyAn0AavEb0qSI18o hVJWj9PlcNldNhdpUuKJeFM8GSdNHOtmCVM4nrLGsjDkiWZh3KVmYYQNZhtJGlxSaSR+UXw+1j9w SQKfm3kcCXWvwPw1oXuGNE2HwBcWbcnOTErfXXrBdbUOvLIOFhY93SfGJsdWnVZ7veEUs1v7F52y 8NIf/W3uZOwVK35x7u2nds7pTZ+E/GE2Oo8cOo8yZDVff3DAdI3JwNicKstKtkggWI5GpYDBYsJc yyVX8VVLu8SqaRaBoqLb51U5TvKVstjAiYJaLkvZRAbnQYiUqihSJjgEF2sdPgIqtmhM8ZWBEpcB sPkIGxVRXAH4WWAkQAS6DQqwwF7LRsteyz7LIYvRUlaULMjQGSIzhCIiH4/HUNC0nM7l2M/YQ6yB FSvTB4TGyR0cxlnGwziS0X2DiJoONtBsuJ5mxH8Qeh1E0r7vzY6xmwai6VNVHX1hbB2XQCAzmoZn xvKOo6fEjKYHxt/TWIFnETfibf/iPHwigzqGGS7BK8MPQD1Hhk5BIMq1oB7HatvHo1XtPbzyWm1G v/7Kp3jE/8ehDeiULkWnVAJ/1c6db4Qui12lackS9svlSETyFzOufDBP5NVSScqgMFLBYYQVPSrD SKKSBkk6SSTVeFxKR6KKWALxmAKAiE7FIhIWqhTPxBWQptO9aUMa73c6FosCqNARBfhDfqLXv9G/ V+chRv/pTIiGgL6WXkMfoklaLB95GvvRWEhBm083zgMnenHSZbhj/Cwm7j449hT6vuIQYN/EGlTj CFq++Qzuqhenav7RM3DZZMPdeOOHrz7+EI7jCw7rVx8BOoNrUeRYiiJHB1S01lWhO0NEjq7SM2nD SfapsVm2Pvus2AO2B2LPmHbaLWTUG1XsiagSq8RMFdC2BrS1AalSzmHAKrqaYXMl29ycy0plKxVM 0BkOyl4BhadMJRWUaEPY36FUckplQblMcuG404Do30It5HZzRCpOWuQF2WxGhhD4uhKKiwpSBCV2 LhuYEFb0NidalyA6nmG2t388vLQ1uh70NNhxMNdXx7n6hH7huMjTbUXi7C/AiH8eycgnIIn+No18 siPGR/joaPxBAWiwDwcgBkeWLNEILN5G1Wo0HtVLJWhK4lg06mDGel2LzM3f3b/stVtmLv901aur zDjXJrCMF5p+8/1Ld51WgeD9k687u35U8FbZR7vh1trt5Urvmq3L71wBjSsGCm6XT34uKHqlsxZf dEvfZXf85kioCbagIxagl3PwZnSi30ZeNYC8qgc+r9nZe/jHctv43TmyLhVsDrWhEHwhnfnTEpTU sCSFwpIv3awvgRzMJYu5XHNRSndMxku0qxqsElW1p1qd3CN11HWEzaQ2ZERdRNj4ZENDqHH933E1 wSY11tQUj0nqpDJe6gGtsFUttbaWS9KkaEQGEFrEZiWdVkOKL66oal0zdEyaZEWCoijHSnKsRwsE Sxt6tvQQq3ve6yF6hohdmn8KK4fDjJwnNGINYZhJ7CUIF9FPDBAG4hliFzgBPyoB9F4J5LmY/CE3 Vjv0bAT22A6sFHROiEemQREnmspXzr5+8k1fNfHf0BFATwnmcDLA5a7yGhpyKBA95eTQBA319F74 SyWiBlSPlZDCX1qZKDeuH35Dh+vaH3W3L2FhcVRHECKzRPaJwaN4pdQ/+h4xuISo1OTjJYcO5CfD 7aP3X/CjryOb+wAJkI+RzQXB21omR2aNUXvIEXKHPLlATu4yFu15d95TDVTlU409ds2teWYEZkoz ZQ9+jg1Zjr2itwggSwrq80AFBAJBIIl1LmRDyF/nQgKL5wlPhfF4WEYSgorIKqJAEArlUiwWCotQ ZiYNaTG06j1hjAPhU0eHXdWTGf/CUX7VaX2pZyB8DPE3RYkfT+gb2KeT/Fv16lLX+GaNbyZG30cQ +m5B+6aAv2k/+KHhGu4q93JilWE1t8L9OU9ZCJvb5jHcSdxtftj8If2B+wPeRNIL6CfpJ91kM6WE omUksEJiMPCuIEhBs4u12chQkGARmgpeDKWag6kCzU5X9wF4Lfrv+ZpcC5wyRZnxC2b8wrVmaBYT dz8N32qEO0ThMMbuP7UhsRt9pQdxd18OYetXSacIzRMmD+9GI2N0IdR1mcycwZuBtAlhME+wmTo5 xK6nphoCCm1pHTMbbWkGXIXBemnCzhq27F/f/9RiHNjgKT+bfvpJLfNqT2GDJRbUN3fYd8e+sy+A Fd18/zZtWpN8y2nEgbFthmAOQsQ70C5PJi7U+oSMUPF1x4rlYktlWnhe98Xhxd2Xh3/QvUJb0X2H tq57S/eu7leLnAtUilOKZ5dIV0StTC11l2cVXqj+UtvTTfkj/sLCyMLCraUtmYcqH0WOZo5WrM2T ASiMWrN6nDU7QQAGiiFk0CFJTOX1hE0osyZD5DMwk1lTyGTyBSlVAHVbdwIjNBaPM3cbIjx1c09G 8bxXcSlBJa8YFDWC442UjIS7S1qFrE6OFAAL5HDEHQ5HQLgQIUMwr6SiSiqZFAuRSAj5C3IYgWht UbqqVYqiFc1CgSHiqu3hsGBpHoKznwpNnlwAk5XmnXAziBBXaV6ttzC/sKRgAAWt0Fsw7CscQpy4 u2UXnA1CoAorGnNCOIT9DtDwEHa9nuk74ZnjIkSX5B0dIn3YNyyg6aAPNzJg0PWJOvYeFKq+gzos D3foAoXuqP9uhPVlWRV3YolAkzuQNQda0CA2o8GbQYO7qVpPDc5ZZry63vwoHJunyX0zYh+b4ekb /EbQNjvpjo56i8/TIDKyb5sYK2EltxVd0bcwB8OELlG/DrLDowANJyA2xP1b3tEZoSTgrHV64X/j ONeG8/HKOuKEc/D1f/BSpNZ88U3V2PyFeOXeG7Yvg6/UVnwZaIb/SRjHEPyC1A8v7T6kN18sfD2l M0DkHbORd4TBYq0ViaQyFkmYgiNs8SOR9G5DE5WxJiIUmx/LHJcFWnyITcscK0Y2XXlMI/qBPsSO 66n/cQ78JWaM9goFrq9TIY3C/VtEVu8Bmo8/7Esv6bvwwSigwlNxoKqdOwFUIRDQ59mDPk8rkdDa /ywdkImpYHrrHrAXvAF/H/iNdAQcgUckaxwkpISstE4LnB3YLD8tvwnehG9Kn8CPJMdsGdp1z+M2 YJkdRDI7yblcLCfZgzq1oUGkN0JEkkokElekYE4nN7bmYqW5uVyRcjajPqeKJEUZScnm99T/MQG6 hKBACEm3IHjckj/bVPd4tVcl1GRCVZsSUnZoZKUWkCAIBSRJhoQb4lFuBUCWZDdaQt4qaTY5rgSD shyQFIjn0wMBf2sLYfAofiKbS1SUXM5ms5OcYqeURGurJMtSS0VOaOB1GEz0JwYSWxK7E8aElkiW EhpbdiVWJ/Ym9iUOobUh4n3NIwVhPyRWw9fxTwsnAwGSIEhpiLhS47mQgXST8kzude497jOO5MS2 5xua9RTsxHr3MtOWq//pG0TTPlUdFOgDPr03Bq9iATVc93F8qWJ40Cd1z0eWg9O2y65+YRmVFVTj 1fQLqvD11Grw/8bPBvW4/l3E6QdhFH65E2fURSH82madKLF+fu1Zep0eeF7B47QyHv8DdsG2/9A5 Vb1/51XZj1yXxY06E5nAcJp483g6ZfgEe2UWWfGPkBWn4YDGUwS0BMQA8SIBbdDk90PeT9oY3cic SdbpZJDHxtW6MSHSnUw3NalpKW4l9beYiwazmTQgyu/W514V+YobOXNMxvNIuCiFw7IkxfwEZKFc 74SHfsCpSjwuK7EYCkxXPel3K8jzA+hWs0Kb1QopKSBDJM40PwBpLV52pWem+9MD6dXp99KmtC9L GGTWj9/Osf3cALeaO8SRLg5yYqb922OibhBnOuh6lgpTjQN1stbRIGt6X5WesBqNAi5IIcSHbiaA BtqvV8Pn6Kn9/zWx+zIp1+E7HP1aAC/CiVBOEouHb6tj9at6w5aO1X8kFq/D6FTnJNNI7xedE/L3 Hxp+Nc4DCfAtxAO/hVS4A4jwC23kZdevRII9wB8QjtJH2cP8YdH0Iv8H+g/s7/i3hY/pj1mzj/ax Hp4XyBfZf7iOcIa7LbfZ7yceMj5kud/+iukVirqeWGW8mbrWvpxb7rmVWGekWkwtVNHSYW+ni2yR bxeoFKHac3ScjfM5YRJhfsa1m97KbuW2eh7ndws7RepR12P0JvZe7j7P/fwW4WGROps7je8TNtC3 cWv5u4Q7RGoKN8UzhZ8unCzOdc2lT2eppNDuqnAtnjbhVNd0egpL2UxWym/yU0lXgkt4kC4WIUlx LgcJzF5EUpm41eCM41R+COTBRmAEl7vjZnGbr+eqRvs9bhrDBWQ9Zaw/yjCo/8K5d/xMQx+yiR28 NcBU2aGRI9vQlR4a+XwbK1R53JLsdPurvMBLVQEPFhSst7lE/NIn+GocGvnd2NzG4vnz+GppXDl8 RUTZg7+ufj2sORFp9oQcbBcnowHiVg5OrDoaVwJfaU/V3rgKuMPBwXBd0IkGewTffXVnN7ZjgJ+a QZwYMDRAJsiaSwRu58Z5bZb81k2fLX+19iosv7r80+VnffrsE/+E5k3PfkpM3Vx7fyOcA53QBWdv rP35odfg1NrLf/yk9jacgm1rG0KSeQhJoiADDmkC6SP9ZhkEOT8bjPvL/in+p1Vrik0MjXyq0d/z 3eAjElSKWuu7LUhM5LNfrcYKY/Q0rWuxKJDjrCtWjRGxmIAkWTLuQgTYl8sgikiL2SPjhYLR9DTO TmN10Qd0D49paO9jSBWjwebCOnhO46m2f12u4Y5jnID+mjTbqAPrrcfxRm0mGoaPT8yvIcbx0aPv Tmue0ds+q3YU2vvum/HwdbW34L7apcd79L8vP+26eKuPO/OMK7ouWF/3aUb36Sxohy9r/cvUG/Mr Sj9T7yhtbnogdX+WYhcVFhYJa8Kg+hNu1Z1RwPR8T6mnclLbjPa+2Nz4rERf/oziWaWzW+a1ndN+ oXph4eLS/JbH8veVNrY8m3+yuLX0eMvT7b9Wf52P5O0tyNqfbLfmqRi+Pby1QBWxsc5R7QkqmUm2 lZuqqfZMe9tJsWnqzbGVievVG7I35JdX1sXWJdaqa7K35e+obAIPqG+oH7f9I3+kdKTyj/ZApaWt nSwV84a0EoGIgEQj7iiSGwuQjyLgn7XVtsA8BJdrnCHubVWApTme9CYNUYtzQRoMwb6t8GAIhweh nIvjNGwonU9vTBvTl5fjijgJefjQWDsW8nL6yPB+nNar5nBWD+nPUaJtHtmz1UKX1Dn7xQ8EtK5T A+fVL4wjwmiPuV5x0DuttKnRDtFVzV4os1W1CQ1ZjBAVGQ0lPFTwExslPFRk9L4KfmKjhIcKfmKj hAfVjRweTvDSObDPaG603YzVmfTOgnoRqvEMlUKUsf9iL+aO8WDiu0vOqMw+qyPcPi1gZ71Wz/TW SurWKYUTL+p0WxjBu+vBz5BzIwev7X13zL3DZzIhb471ci6bEBIrdoYxCm43vSwJp3+EHb62ufbX 2t9rDxIXHuv2hF4BeQ55fQa0wHueBuGRF7RTQ+Eu1e0VuuaVFxS+VzCY1fbC9MJc3+zCpaFL01eU by5vSj1ceF15K/hG6D3lrcxnCuNSLIUpwanhK9JLgyvSPw7eG3wk/VLo5fAB1SHvGvkcWIDrKxHi eAE7aRwhgqGUGjZFMuloMAsqDTWaAXIui50+i/09m6WQ0FVSKZzPCe4krgIZYqPmAOiDyHQxHgAK VJB57bgmsDqA+Ahs0vCP/emNbIzsjRyKkBHMh12MRsMcfYgmaLF1+uLj68N9g/v79vfpT9116M8f 6XxD7xtAQDwqQo+tFv+rsNMKZjzONnLKW4P20M6Rw/hHXW9X7WU+iOLT1lKogGLNaGdgI6WMH5f4 Zslo5o9Th/HiGGCd9WWd+MXdby+9a+61N2t4tuSuRwZqf//gO9tOe+jK2quEtTb9eNh68eq5G8pd d/1NF4Te58pn9i5uPfN2xD+fRozEjdDrBPCuluosnuyfWewrXs7fyC/zLfevartjsvWk0NRuApvE Q92bJ7/lPeD9u9fsxx+SEyq4tXyOqiU7J/kEl9ENYIuzOR81ZEu4qszYRKWjo8TEe2wryezKRCke 7jGQKOyE9eJyS7xfHpAJ2TfVHdcKSlTRugeS1yRXJzcktySNSXHK3Tth8Jh+4/0HEVGsP4larziP lpyHGf0xiXrbcb3R3Ft/TBl3aUL9kcgJ1eR6G51M4FJlo0V4tGG20YHX6BROKGN954a1dSbHeqHx vhtW3p89ef6CR7rPnnPgl+9ej7e1/squ9eufmjolf/tvzjnnjUcfJ7sC+HR+J+MC842rz2s+vRhk AlJixblrXl2exy99hGvP5/xs/eLJF8seX/TEE5fe8BzWBauRX3fo0fwWLeWy2Mu4YBYJBCu4pElQ xjKukXEiX0EqXoyySHgQyI3EITjwJE0zMvon0K0WogO5wPzA6wHSFagGZgb6A0uQN20JvBegAh/H saDD2b/DjaccqnrwnVDE+lJJ60smPFrIGr8h1ryj50j17MU7tc161/GjePuOT5HW/oStGl5eW65f o+hzn4Hs8Qfoc+dhZBcI4B9DP/L51iAdwA8k+hHTi1zu3286EPgkeJT4u+nv/s+D/wxZbARpgn5b cKl/ncnECnXl7qE9hKcoejyCKLH1dJwTZGAmCTKZPJBSjLVeJ0laHA6rRWLqObdpSrGRa8sjZIoq yaSgsFaFZQgJ8dhIWIZwAJ0N4QIzQT9+BLVZ9MkUNdPSbxmwXGNZbTFaxMIxuqdPT6tiq+0bT7CO CZ7/U7lBfxpUh5XWRmYV7fhYUXFUw+p9bpXyBB1jGP7Lg0seu2qa7HPa5bpqWffcdWcsv1jXtvUF smt48hOHzn/xCuI5vaSoq9fJK58/ef0F+spo/oVuRB4VztECZmAW8uBkYbo6X/oJvVc6KhxVrZvB Zomwu+v1J7rooWm3R7J7+EgKLyGAX6IQQKGV+cpehVSUpKooKVWKqMCmF56EATPETwsPmJGuTRJm s4GQbAQMi/jFkySpKEiSKEhhweshIJTRB0S+LKiIwHgFt9crePmUEhGVsFuxGxRbJBy2220EgBT+ KUpKXugVHhcOCaSAS8Y2L6HkPP2e3R6DB823jXihdye8HvDE3m1pvRftQtw6fKDvcJ/eUd6n+8po FgP/zuVGcxlf0YI2scVMz2V840LjmJFGbbQF60dY7zqKwuJXrRKbvleb0+11OxxuL2wTOIeT894D bzTBH20U3GgiwNb6VSO7LB673WOpj1/whk+OnWP0QVqNvB+dbRPx1zo/0wSPQPBeo4lEwq7J5zYp ITthiRGeZD10YuDo0H+Qgf7so3bGgG/APxAYkG7ib/TuMe5xf8Rb5tPzmfnsfI58nYA0T3s1XvOS AuH3ymJQkpuS3gpR4QveqcRUvts7B87jZ3tv8m72vky8xL+DPpZefGToXhrSZTdNc27J4faEE3hV joViS2IEiNGx3tie2N6YMbamKRZLNEnhJmA36W+xuCxBC+Gy7La8Z/nMMoIcdY3RYjEZJbuRDPnw W9xSvwSlsihJPlEKiQJAHzg0VPuHVvKQhpDbSJKyx+1GMaQJmZggugVBJCBhgLLgRfdewkBAg+zh 0Tt4QvEOEZdpsqAACA0exUBSCSXsw39Cof/P3pfHOVFl/95blbWyVVUqlVSSTqoqSye9pTudNN2k 6RQ04ILYyICA0i4sKqgDqIzj8qT56U9wXFARFZeRN26jICAN0oCK4yDi4Az6E8dlHEF/uIwjij5G fQOdfvfeStKhEd/M++99PnDJrVtLkk7dc8/9nnPP95Q77jDFHXYKvgjrAEAzXDeQ0E3v1tJ7JBiW oKTVZCUt05KRelKoEYlmJC1enZHimisRTpyfWJRYlngksSfxdcKS2EZdg0CgF8Fvr4jeJmop9EJv FTV/1iV+TQgSUzdSWjyLENs1G4yy5wX0dQKg0VcbYL3mCQvwJQEKcdYIgbHLuMy4x2gwvoDOJsEY 4t2fpQdhHkQi+pXEHvCz/bX9CzBM9n0qsf0L/L6DegR79wF01sd+Bcr6rbgShx38/cTTR9IXGEt5 DHBjMGQTfR4Y6s7/qSDO4w/oY2bc+jgCZjUImG2meii/1y/6ixBs3Hp/OQCNGvhyA2Xx9g0celZk SxANu/S7u6cpERy3OcT/43Y3u91DjtHv3PTV3266PkxUZyuewXbM++/Ff7v8FV2X4gNhOn/0d4aO 8lqqSqeOvkl/WKFFJ6CR1oNX8almbQWfhcOV1ki2U7N3iV0NI1vPsp8vdjec1Xqh/efizxsubP11 w52tT6p9fJ/Sl+nr3MXvUnZldnW+C77MfJ0/2Pk9+AZ+w6o+9LFpyHdyfGeEVSOskmlOQyWT6eR5 PqRkBEXJpCMsz4ZgWoAwTSGczcZdccYd5+NKXI77R8U745l4Np5riqfjch/1Sy2IcDpj8VtyVA31 dQZm4p2d+dbWfCTS0FDdiaE5nx9pZOMQGu12Y1WVXRSrID7MuYwpYx7J1flGo9E/Jh2PoKObqi+q Qt+EzzNdaMzNq6KrpNHbYJyEtHn0eVMaf9iHVK2Eajx7SuMP+PiSt1nCXY5PkmMS2ikf7C4CQwIW D1ZWWACxyRhi8aISixeVWLyoxKp8KM86HSKq7ELJFJxW1ORk7Z4f2NuL3sP3oS16G9mid/LY94Pe TPbR+/F2w7Ef4UL/iCInn9M88I3mdnrznIsL5jmjB1esJ499S5obHVJ86GQnrlifS9A/H23TaLsZ bTknsulg2UglYQNDQ46HHGhBB4auQQ09QK2Ey3RvyLe4vrnweOGpm8n+YRya0gx/VVhKZPwTLNHn wdFw1Hm49Sk+JlNT+vvLMcovFkbpbadoQorxs/JqVDd8tELmZyKZvwTJfBo+hBfYPuv1hnGWhM+0 rFvKP6dCa8SaliJSek5kTtp0Dn+eeH7VOYrBosxS71EfVw3fKz9EKJNijXgUKWIoOa+yRdNUj3dx lINdFLW2CR3pZRtgQx/1smZLNzQ0patq06BkxGaLRqzkxtmFRHxNOUi+JkpinqprI9XV0UhVTURV IatygJas6Yi7KV4bjdfWyPEav8LzJKYFgfBIfEIapvuo7ZuQVo9zLGppLiUO+C5+GQ7+a67Eh+MP Etbs4e6DRfitL4iSCIb29pJFU6Ho/nGM2jsOOFqORY4nvpKIJViALFkJqcUYUou9wMf5igG4C8CP Gav/d1laXgb+Uvj9wrI03vsMVz+Dw2HzxLLcpCm2MLosN89TDWVRqYbvVUZOvA0AXUCygmZGre0a GvIXWi/0XCDOZxbY5oumPvpz6nMXbaHQyxWmva4ElaJbcRppehF9tesX7C3UUtqlIwCb9ezihK/H MdUg20nvZtZF0ZzBGHI6KB6ZTtDi0uSsS6tCLymYccUNeHUjIumYfx4wAH+Ai9tHyhB2wXlwETwE DVDyo17VXQ/IUsUqq318P54ay6m6MG+zkqY5lLM5br2nPD+5Br59lnKWYtFwBNEmGiceYfsGPu4t bjd7nXmKdoXbdU3QrSjZQd4np3igp7TwSheOvkM93f8mXmSl3u4/m7oJ391r6RfM3xO7a9zVR0dZ YQy3AaRGFPrpFYbPAAfGanHO5vwWgLQNWZzfornCYmNYCw9g1MoyjcwEhmYkfvZTlQE4+R9bAS7J EVcOonmdKJj9uhvWcPc/t+O/yPgFoWAjyNRe6KfuIX9DhyYP/RtYG29lojCPSQHFbz9a+vah320c jHgtSjGV310ZubPOOBJHnPyTWKU4RXP/HsMfCxHgAI6N5nOhzZBK6Rl4jglWMaw48ij5y7vDktS/ pyywFLgT2a9n0z0gAVrgDO2sp82PhZ9uoOPmWDhnuMp9tf8XgR7hP/13Cyv8q82rhMf8a1ObzM87 nxU2+reEdjsPN3kYKMEaSD/A3eOnrmv4VcODDU87Vze80vR20ydNloTaR63V/LGUEoupiprgq9ze ZIsCWpKQbrZb61r64H7tHLg0AZhmhbZZFeyQnV9H1yVzdntCeIhVqsz4hAPIsqKhOculwJSSV7qU 85VHlHXKdmWfYlH8rd5ljYoJn59nesS03bTPZDBJw2q2DaotWDu+/9Ni6JB+60sk8FT3QWzjEs5t 2R/TxrUNUT5FvYPFfTswI+M+M3AIZNFLGjjcy1saLMVgTATKigGcArp0GwihS9wDL+EzC7qR0GdL fLC06K1ICoBTvOhBB0XZo+PkXIn/NXXzG/c9vf+d4Uu7enpmPCtbWS/jnPnQhEc2zMej4JXcTadt vvjMq6+4fNvMax5YOe/a51zs0jEXtTE+nmNc/pqHZ/bvJZ6033BsV27iGZdMOR+vBNSjvp+CpDYI EjD6LDZY1mo2NkWMFdURFPG+W0p5JEn0qMGQmYY2OW7vtvXBmZviilVWEGaaqdXQQaTzzFZbleJC d54y+Wsik4Bd9giYVuUS5gn7BKQMkufdUdkduBMOlBZZ8jir2AEEkQ4iiHSgGCn7U+lyxq23FztD mzTXChttjdFTEmcnZiWeUh+PboZbbM+HnqveYdxt2Wv4wHLA+IWFEw1NMG0cYeuEXbbTQmfDycZu c7dtFrzIeJltIXUdc13omvAtoa3hF9RNMREhnEMbbGyib+CLZ0OiniemGy6YBjnUR8AjAOx/iwxx icIKLjOsuf+dPmgqfL/pg+WvVMSl//r9u+9+H78Mn/W/tbPwj5d3FA7tfJyk7ukgISW7HvnrXx9B r2IM3jg0MmvAoU0KY3PhZb7vtDrUeNXzQey96v3h/crfY19Um6OeanG0PD42vnqy3B07p3qua640 J3aLZBfxIt+VbmGa+2zPpbGLqr/zG01+ifX4k2ySj/l/xT7I3utb4X/c8zi6NhLnOZckBAjXRgp6 dY8oWMopSbOt12AK/sarRGzOnGXaqjC8M/xSmAr76wQljjt5VRzi0K8743Rcqt1R0c9otJHoaDTJ HNbz9qByoBgTPUi30Z2f2EuEw+8wbbLo/jRVuj/FShZNRAXZDGhO06+QADzCoDGtu2fby39+esbu iR6W885+dNfuwhFo2/072hHEo+TFsN8bOKXni/se3XvqBMHL1Y66FNKv7oZ2PBZuQHd7Nc46je73 R8+dVnNJDYXx1lo98C1FIJdqCfnwITaQ8gYCPq8aYkQ1Ye1m0DDoTSjofqPhIKuKEAJ2m2DGKfS9 Yavcg/MxQ+iviyk9LGT74G29tTU9Jb7gguL9wU7/dkJMQjPSAfT/MB4HJ3ayNTWOWy8WB0Gv08Jb sIoZHBdbQA2yGWWhGjsi4wizRixRqayjylNcJGsqu2bS3pIoV9LyDZSuYu7+6Io3r7nmzSs/uJfs z393xb3vvnvvincNnx25HOuWJ3dds//qX+67dhd8X5fkVR98sApLMkVi+VNIkiUggze0OYy40kOl qVHURGomtZPa6f6D9D7/vvRB4L99n4T/KTqkYE0wQ7WGTg+cEZ4eOCc8L3BZ+IbAbYGVwZWhzUbX QnFrcAe9g38t+FrIZHmF88symoG5KsVrNiiczT7Jn1sF4HyAkxt+onlVOQdzqwQ4T9gu7EGqyCBI Ss2aChEdf5BQNQ8eKOVbILS8Y5TMBlEwIZWwMSCEQ1TfwJdlVY+gJ1REcQi9S5dMYNaD7g31R38r fvLUeX8a6XayPrbxH4vfLeyDrl1/gswU6e3ly/f64cOPvtrR7JI4jk1PgYHXNiPN8b8W37p2ze0Y Ub6DrI9zkGRmwG4tptknGHuMN9oXN62yb7BvrH25dm8t47W4rPZdLKtaMw2gCSLzwfAcAGoDAiB9 UNP8EEluNKGCWHdSqQKAl6WGep/JamFUJIsa0wLqoOzfQ0RzheZIeTTPfM8bHoNHyi7cAl8vxt+O J5SfdvZTgvvbMUjsJwlUhrAWu4fE4DpragOoQ+vCoDaQDEPszFy8+IQ8E9QoJhAYzIRi8nhKOCwF iR7tn4fr3c/h+rk1d1y9pNnjEyzu+y75+dXwFqJoHf2nlNA6tQXL46K5D4kWkee9tPeyMYt03EaB /1G4wXADksxq0AxDWtMYYb5AfaC8FftSORA7ohyOmi5NXl4/MzWz+VrH9ckFzbcle5ofTt7VvDq5 qnlryElZsDaYQRSE1Wi0WFUKhGqbfDLrlVFfOkPLmxSZqVXA8rjZkqNM0AQTVTKUGYa1rrKut9Iu K3bEr7PusRqt/myD0hO5M7Iqsj5i2B7ZE9kfORQxRKRMzYXHCCvRFjiOEXUGBpD5A1il5ktM0rYh SqJCireBwMBh4B84vKHGgmz0HzaELACvyddZGvEmaW/GB+vF1OBSYFHQMXKB2XK8mWB2UpHBPFzD WrJYi1DZDN+cPiajx2J97ov65k8fT6g935x+dbW45O1njhx55u0lu2+//Q9/uP323dSuB4jG2DJp VN15CcIZOeO0mpFHt0C4aRMEhXH3vP7H5ff88Y9oLExGY+FyNBZa4RVa/Ur/EZkyQA+cZVpouhPe Q62Cj1HrYS/FPG56wrzRuMm80/yueZ/f7LdwXqK3XUJYoITpPkHw+lQumSKAp256Y11dqlFNsoyu 7x3QMZ0ssqisjl9tselF/NqaxvuRbKopm003qa0QkyYNyUQCdXcrMJhZxmKVpX0+iOaJRzXbcKDI Tdsb9zRSjX3w771tp1xYZonrRnR7f0nlE9c8d0KF/68yP9CpUoACHHgJZ3eCOBKY8xcjgdGAZP0B o9kUCxilMPSbg/qQxDmsBteItwDTwOFNsj0s6Ohnmr4oqWe3GsSo5aFbTG1wosViOHHC8nNn3DL9 PGR8hAtfE7fMjQunj0xdVsn6IiMb4aIjU04Zs6yr//vy+KXPvbZevrr/y3KWww498xV4AUmDaOQA jRDsIq1GldKSJk2UZkpXSTdJZreDnSogHGuyW6cajapdDEorPAjH0q9QffCe54Imh50BcBvEy2IU MkOcBoNR9nQJUJCqzlo0aCOy/aSX2vPfHRxiKoJK3pwnknUfx8Uo3gDqzusXwdPx7+73EWPu9H/g yEsj9957hbOOfluhqRCWwXppY+EGupX8sirwiFbL4iSTFEuf65oWROgueJWrB/TAHqqHXuFynmlZ ZnnEsjq4NWgMWgJ4aT+IRrPRZumDzzxnMKg2/QdrTpvJP0mSebdTXB7Cy63naxxF0XQobHfIVVVd BmiQQlvhJvgm8A0uBRISUmm5tf9A/rv+QcYmziaEJkD8y8u/uJJGa0y3ZKl91y8uOLB7hTpl6tQR kwr/IDfAeulN+Nf3HyUjf+ald9aHycC/7WI0yrejfl2ORnmW6tsCkkiMRUc+iTmxgp1stS7elr/Y /YSb2pGBNUJNrCFZk0lk26L52IhkPjNXmBuxXeSGEXeLm6oVupLvxd7LfBn7MnMkdiRjGR4bnpkb nZtdLayOmKLZSAToatxW1uFBPOg3gjAMh/GX2tl8mCR+QMg7PD0SDqsRNRgB9c1EWzQ2js00NjZn 1PpMlrORD3KmGKfTxqgcjq9GFpQeXO1bSaKr1YDgrovj46ckk9NjyWQ8ptbForFoVM5mhGw2ExHc vFsGEQGACHBno4IxAtVcMOjJBUzxXF1zrr6+ro6y5XgOWHKQYgRsQlvnRWDkgVh0cnYrXAVi6Ihj fqYnQ8mZxswFGTqDtVHVMDea+9HsM9/aY6VYq2xtRA08D5msUss2+DDo0ZdPBskROO045vgeLPr7 SusjhLRUjID1ti0xNOh+Z/fA3t5QOw5P3NsbHKZvpbS+9daT7YZBWgTEvAiSHdpIkhL+1Prjib2G Q69Fquy4y48hSLgH9vf6oxmBxFxyOL/N/g1oS5LYEq/WIIKOIAQtWGI4oXBm4LtKriW6Al01oXjV D70xKSOXcwFgl3c5IHcQ15S9kUrZG3mcM/z5CmPxFTi7lowVB1YcFxb64CMXkqCaQ/hornAf/EXh VxWm4z9hHVYfuF34qjCt7Ky8Eo2obWhECWhE+UC3lpnhudJzoweBD/tUjBkRSpyKESLv86zgONUH EDAEUOZYtovdztKsJFVqQ5LQ9sRa8IQa8K5j9d+3WP+VTIcKpY7+Vg/OOYMw2ViqRmt3DXO1Ottc w13trhEuzdXpGmPl4/YW+8bAhjpDNWyB1OTgDPOM4FXmq4LGFnM6OMY8JjjZbGy0DBtBxue+4XD4 2I7hw0d0qMM8LnwoJPNwAv8Gv58/xBsAz/IaT/NjnTzvcqqeWJgABaCyKqWODalqOKTGWhr1g81s M9U8NtXc3JhSW8Zq+ODsfZ2wc2y+s1PLq/UpUyjeUJ+oCpqguWaYlgNjTTUK7VesVto8rKUlFvMw DqfsFbVwtlHsESnxaLwqJFfH8X68J07Fj3aAlJzvwI4s0LG9Y08H3SGdUvOMr8Jnghq17eVNmTZa pBGW/O98G/h/4H92H080Ko0aE9bCBEwMBRVFVCEnkj6JsRuMtljSUB2GRpPEeMMwYawJQ5/dH4ag lBGRpKPr7kZwIzBIc2YGvgIG9DIPvI++630EXt4qYU+o56gz47/A30FyI6At/ks2oK2efLrb7SEe NWLFDgKUCKeniD12vwKpDB2kn1962cgZSuuVw89tOYXkfHjwzOaGi0aOJc2upvq6EZ3k8Mckfp40 6RmTrxwzduyY3Bnn9G/C0kzdp00aM7v/LdK+q3NKVXKWvjNojCApvwxJ+RQk5a1wiTbsbdPbFmqH aYeFetSywbTBQi8w95ipmeZZllkB+sHA4ybqunAv3EjRwfDcMAWggaJCFl73Rbg8YQ/lGUsCh1R+ KKbVpyQnTv8/tjgr6ZiWBTE2Rg0Bto7sWB3YpnOtJrgV7gcynKm5qxSDGWFcnucYKyP790lQwhMK S+DtnY2rELyVMLYdhExFZKsLZ/9hNFn8+9zkfxfXCoGg0WK2mCyUKWhEAhewVOnYtoZg20A5/lFA b/3w2YCgi9cCkjSnuxshuJai4XmcdBwrRcfB2ylT75h2QVfruUQePiJ0i/+4/GfXLqhEt0VZWTRt dDJ062n9Xw+i22nXdf5n/zdDBARhwLsG9hnakYTYgBeeqrXyokEUvCL9GnzN9jb1F+NfzW/bTJea 53DUbGq2YY5lDjPXcRk3232R1+JRaJdipW1Ws10BJJeIlCdbp5dsNYcnux5AFjSCCxDE7KOWaD5e MWk404iGrpln2m7aY9pvOmQymvrgx70+pIJKdgua3A72dy/AJkMpQ/4xKQu2AREhUGHg8EZWcAre rQMfoxn3415HiAsN2pPdZCkPr27bREyWEXDFYfem2xXK2wRUWRhUmXHF4fSaVQjxmQUbj06iShQ4 b4eAK7eAF5r7BnZoPGowDAJrFlyRhSZYIjBUpKXEvtuSf6bSy9VeOPjyjsJXkN/xMnRP/mjVqo/w C657qXAIctvxox0O/e7XH+57+KH9+7DnvHADGb0442i9lm9iXG3V6JWtPwtOprodsyDqE9Oljqvg dTVXNNh+b3qJec/8nvX96veaPjV9wlgkuo6+znwbvZJeQ5vEIBmyUqpKkoJVqqjPUjZ+1zFT0kg1 VZyNoCOZcuU8wRySVGdKsTFJBS43mEE4FzPFFZcFWvzNdcAph1xVerSCoUpKVzrfCbQrud4PthMH wo/5D346qLjSPZawN2K7o56EFDtkiHu9aeCvz1ZHjklSgWnb+ijD3h3sRD/hkDrGlz5uzcLr/+vK Qv8LH92mr8PNq3CpP/zW/Sv37l153156xspzp1+154pNhYHNBZMe4YpwRY4Aojl37Xnjzrve2IO9 kajvnkZ9FwEpeAbOffrdBldbEgtfq6ttLXgysDZGTwTn+2eBn/vnKleC6/2/aLgR3O6/uWFl/KG6 +xqeiq+pe6KBeywCH0yullcnad1+cFa6gXTdbPPsKqplXQ1PxGq4ZBwAf3W9L8djIO+sV4KMFXuI qhWwXDVHoWSV5B4Gupj9zCGGZvxNNQpOercqvD5s2BPeHz4UpsNSY8mJXOkZImRHpHpRp+KA8Xz7 j7mFfkLLHtuxfj3pVQoB4ZhQh5PiJoTaPtSzySE9q3vtT8hI1J2i0SHuoTWvEE8y8ScX5hOX3q0f P1/oh/SL+2/de//9e/GLem0l7sEjr5R6FP5zM4SbnhsojLtrz5677nrjDf1ZB4Zz6KuRtvdowvVO WGftYuby1/C38PeaHnabg7obJ7yraL0FPFuptcjY0TRr0SjDqUHWal2JM0leELXW5hTsNtQnRrMD uoHgZJloLAdqTUyeRZMhssWwSRZgXOZDZsrsrweCHHVFJkR0B96hiCki1fXfMTgh6vRjnX1Mnl5A DOtSBlfItf2rwfw/OQminuOKPbfJLThFPlhCUMVRd0wymBM5YCnqsUfHjFssuRmnO5KRhj24HV5F oPvl2IrfTQiE9Iy990ye7XdLZnfEP3V1IUM6h+e81PNFfLNnYB9dQKNsNPxGWyrkgyMp/gwwDcwZ vUZeM+x/tr7ufm3Uh+4/i3/u+Muov7sPZD4fddR9OPPDKN7mNonGDuuosNsjejoCo25VV2S2uWxT 3Oe0zmmdm7u29YbcLa235B4XNgjMHblNYeosS20yEm/SRrRn/D6X0+yxt4FMujFiaGhxOe00A2hO yo0YoXBKJ9MHsxtpGQfWwHu1YLxFUUDOPLlN6Qrh0H465B/bNCmSS3oUDc+SIpoPtWnzkjApjek0 06Y4o9jOKw45ErYFdb84rD1YzEtBIv1xH3cPhvm3VQT6F3MB8XrO3tZho3g5GHPHvB2eMMgF2sJw mIwqfhTaFfO+MPD6OkYMr2pHWMafa28Nt4SBMJIjUJpkrCBVMcCKYJxS72/MCRkm+PzAZ8CLRu9o NGw7hGFo9PaqYntw0K9LAmf0UK9WNMdakdmRE1DVimdcH+tBe6gajafY0QKaVEcLNlc+iD8H3Rl8 0WYMLARcVUyxaHb/sVR4OJ15BX1BMFXQFwZTnVfHo8WswvT1ujWL1/VaJy65/czc2Mab142+8Pw/ vfrqIovHQQgMkjeyct5jq86aWHh16Rl7l6+la6uQpN4Z8otSe3VrW222PRF0uX2R60+99MnZquD0 h55B4utpCDfmrx19ZiolZy5pv2wRtjrvRmgrh3nN4DUteiQAHQF/gHqM2cS8zLzFHGCMv3De7Fzh fMK50/Znm8lrwc8ZWAsM8ArNYzEYzBYVsoLVw7lYjheMkj3ZBx/VuFAuGjXnIAQmuyLZhKWGPviU JtTVWaxyXNkJgmxQDs4Pbg8aEQL4pLceG3r42VJkmeVwKZUUpp/rC6XH5cfT11f8AcZm81vDgAnY w0BfXykmMimNcE4YukQVzx673iJ6ENwnmQwKrQsXTN45THCwPof8/YLla0mo/YO4M+gZeHD3v3na jGbZgZ8zo4z/1UIqhQ+S3Gr4Pp6L7uM0egaoRprYzhg2iVRChH6Ly0o0sD1lsdutFtWlL6TaAmcW F1KrFbxfj5P4j5WjUUVWq6HoEmQlB6oZry8XDoVcFmuOdZkEhbbJMgBeEdsg1iTLyZY9ZmjGDvbE UAd7e7ue6LkYp1YMbPpXp8OSutUYqGFlKx/jRufdOL+228CFAW8S9DuvD0N3cRi+ADxo+IkIDPED HxdXDEkASHXF7Sd9M2xwtxT/cfOaXddpP9M9QZec+cfVpBu+JmbEdQ91Tl1IhUhn3D5x7vN6U/cj 4z7I4Wcooz6IwPO1ptVwNb/GTcuMbJNx8iOn7JKR5ZaDrfxw90XUxdwcYU5kHbroaTevhSFOx7VW 8ziAg3WkHLTjTJKWS2U4Xp9E0a8Nwwo3KM65tRbn7p1Okm6pVgrqbs+8T/d7nll2e3IUhLL+5Doh AoDsFgS3W3DzEDBFB2eAzTF0jrGaIjmhD87VbG4ql+Ly3DqO5rbCucANrZpD42EjP49fxb/BG/gX 4DokMzGoFCO/ERD6lHAeDoIK3kq+/SfpDkODt38kUvtHIrexJ1DnOxzj1GseeoRaf0fhybOJ24tk 77wVZmKwgeRWhe14RWQy7SAZ8nB3nqLbfyVfWOvAgOEe1JMJuk57PCFWe2+mnxYf9/ZRW8SNXgug WGqRuExcJ74o7hMLomUVtZ7aQ9EWg8XjM/g8CSppSHiqva2GVs+phlM9UwxThKmeqdLUxEXwUsMl nou9F0sXJ64z/NJzv3iv9wlqteG3nlXeTdQ2Q59nvXeztDnxmviq9y/iXu/fxAPeWpsYEGupWrHW u0RaklgjbhN3GncKH4ifw8+9P1BHxB+8nB5D5GTLQUQ642GtVjc/CkFUjmpR+hBurYq+EaXnR3ui FKZAUNHoSsJ/UIv8h7Va8nxCT6IxC6LLSn9thesIFYLGGV6sK0lkpFqkQiCprKpKER6EKku+FYQH MXC6li7xIOQyD0Ku4EHIFTwIuciD2A73I3P7KiRN+7ErEu7XIgYwCUJ6koGpzin+nOzOOUw5uyLL DofdNM8Hfb+XIF5Gj4PlktaYlbREbUbSYtWoqgqhSvKjysVlpJx2QQImtsEnCQHiVs0rTqa0prYM ha+j8HWUxnIZqg8+qTmM8gUe6Pm9YFgu5IzY1dWYxZve1rYM2a3Vd9HXkC36BLJF7ydb9GF4q/Gi N2PUPNlFxmVGCvMlKOML8GOQrBgx33V3l+fug5gT0Y0pE+hfPyFMdJcIE7WHP8Unge9YHlH+MM69 jhr/NmXiOCd/d/eC43hGP3awGH1a8jhsSlgki4EdBDTwCsVM09UlSkTJKKmkRJSO0Usv2dJ3ydpk Oez30hW9s/qWzcXe6U8x6E1AKth/AFaM0Isoof9L6oHKUTob6du5aJR2UndrK8JcmKf4Vm4KRwWw jyWsXgAv5+cp8yIXdP4e/p79E/8n5fXI6+mXMy93uizAB+5X6R+jPxDKg6xTHggVQtapEFQO5lw5 pCjdOT6n5OScvymXzkVzkVzNqFxnLpvL5HJaie5Q3dBQnZ9mzPTBho1y5wN5Fi8WBTDtQVFEu90I RIipDw+4jPOQaPjHpNH53sgD1Ty5TnmgepqrKlV0IxirpNEM42dqTDnTp1uhufw4sBIQPoDJDxJ7 LAOiG1MdMA2C0B0wIeegjz1Q4j8Ut37gG8J+IJVxSUOJ0PCHIYSGNUVCw3e9fARvP8a+LbT9cEOg veM4SoQWYVswiaKuTKJg0NvYEGYuhDCTQi2/q0yD0Kf+TZzP4co09w18vgFti9m0yBpQkSHxsWbl bXkuZOPzzfiBSaejBseI3g4OTZkdnSNDfB7iqnNYkMtDXHUOC7CohapOHCINcaUwVXJHxoWqtCAF OliMu9MYaKMtX9x29g3s6GUF7PneoTlQI9KOKgVXJ0zdgcE41Bl3P0W5KD7J4wRh8qYItQoujgsu ZKV/iwfFrYUthW1kAit8HfK73HG4uPB01I3Of4Lns1kwAKtm4SH0CT4bha8UlplFR3E5qq3wqu7r dIhmZJieaiFnsI/ma8jpo8ouWtCoWlG4wXA/GlVp+DwCE8DH+9Rah+LNwizX5dC8R9z/W7VZ3ePc p6uXwEu4X7p/qS51L1W3cC+4t6o71XdUJxqafJrn0m4d04QcjlQZzATUUE8IhlaqoZCqBtQI5lys 3djQSGxDb5F0odam3VY9CNBoXKmHAFohwOmK0JTjbfRCb4qkLFL97jRmXqzVLq+uThHqhVoTUd3p tKznpuDQ8AVQALwbwDQ6wXMQWEJG3oqhTyAg5Px+NKIpDH2iuZqmXG1tjROEJoSo+aH9oUPYMs1M wIQ31igb5xv3Gw8ZTUapuWYr0eL6Q5e6F7CfIvVXcjJUgJ9ipOUSSwNZaV2iK+Wf0sX/KiAq7bJD rzZb2HZLu04JhaVnKJ5QvIasgyrUZYVrpZDf4REJ92IBnAInLigyelihof/LG4nsEao6NCPdzDs8 VqKcu6hndRFCwjXoMcI6+iAA9FdImrzgbxrjxC5iaHEy1AsD3wHHwA+AAQZsj5hTJCWVyohEZEa7 Uy63m3WpohNSPCU7nILD4XTYKScUHZQdOl0y8CLUK9vsDOw25FxMnpmH/XWS2D3PDu2Sb2GFi258 Md75QJli0Tb4pDmk6vTEq5S+aE7haRypK7JFGgtt392A9FVJRfl+kptBco7UQg8sZWo2K1lYfsYW /ef+W6lWEm/RD6gr+r/Tjbtx/SOuIhntxlEvX4EbrwL8b1ix3AU+GSywHS6nrkDlN9Tz1Md0q2Ga 4UPjOtPN5oj5vyxfWScy59km2lbY/l4qDuBUXbJrP/tb7jp+hDsuXCAc9azzdnifkKx+EGgIfFGV DJ0W9oTvki9SJkWs0RtjK+MT4/eg8iYq38S/qf468WJyYU2k5uXa+XWn1nfVP9+QSx1oHN70TPrF 5tsyc7OTWqqGLWyVWv/S9lJu+YiOjtl5eLKcLCfLyXKynCwny8lyspwsJ8vJcrKcLCfLyXKynCwn y8lyspwsJ8v/jwUAMJx6EeDnTON/c0mN2xCIZA+3KeCEjcU2Dc6BHcW2oeIaI/DB+4ttEwjC9cW2 GewsX2MBjeCJYtuKrnm92HZQD8DPcS4m8i9r+I9iGwKbYXOxTQGz0V9s06DeqBTbhoprjMBuPLPY NgGn8Zxi2wxmlq+xAJ/h7WL7/1D3PfA11/v/r8/nfd6fHXvPMDMz/z6O7Qxt58y2JKkkSWxopIWW 2cbGbGtmJFeSunLRkoTkSpJcSZIrVypJrutKkiS5kuvKdfsjdV1X83u+X5+zszPUt7p/uj+fx+v1 fr1fn/f79f73er4+7/fZ+Rz1UKYwINc3MmUlLBsugbYirDdYlpAbWu+ybLH+E5bDWP85y26Wz7Nc LzCHjuzMoSM7c+jIzhw6siukjDOHjuzMoSM7c+jIzhw6sjOHjuzMoZbDQ/qvdN/CGrAcEaKP1HJY a5Yb6r6F+VluDDkq7GqWo0PKN+ExOnJMiL4Z1+3HcnNuy7HZMqRM6xA5nsvfznIHlkeznMzyXVp2 h/TfHdJWRIg+omYsz5JNqZiRFOoEaSAVUgHSTCqlElAF3UVlrLkeuXLImudCX8QlfLhzHRXjsikL upGoX0FjOVeAtAClK8HzUVJbGId8EWtt6ot0PNIiLp8LqmDb+dCPQVpOo6ErpRE/oV/aaglbdOrd glwRcronNg2AlMs5p+USaP1swWbbhYEe5nGPS7hfRVzax+MaCW0x9/DC/nT5jlF24Vkoh4Wa/qXB VkfMuk3tYKUIbZXjzlgebwW1p0EXlL8c5fUq1bXvWO+PEWVijnrh3njulx5lH9yrwFXMJW/jejbP 7F1Ix/HqODPkrMAIbqmCZ0Tny7jeGJ63mpkbznVrZvUGzGsG1t+pWx5yp4xHk49W8tiisxrjua08 8Eu36+R12Tz0ehx7Qj6XLQXP5/tlPPN3BdfNaasoYCEvYKuAufZO+6KR6xLFLLVDvfZItb8ND7Z1 qX6VXGT7h89SrfV8tjQSunL2Jsev8oJee+nR13py3X5dFTIHeiTOWCq4vRo8aPvOWPPZN/TISxlj lx6pM9O5dWa1IICLC9GhZ7UC5cZxTd3bSh5NQdCOLlmMEt+7Rs/aqSkpneyBhQV2ZmlJacVdZQX2 9aXlZaXluRVFpSU++7riYjuraGRhxVg7q2BsQXllQb7v+tJx5UUF5XbfgvF20Vg7164oz80vGJNb PtouHfGdtuyiErsC924pKaooyLcHVORWFKBySb6/tNwuxZ1yO690XEkFTI/1ZRWMHFecW15jp0tI k10qC8rHantpvo4pdrvMorzy0rGlIyraDwroL/elpATKo3j/AZkDe5WOzy3Pt/sUVFQUF5TfVjrO HpN7lz1ubAE6hAGMKC2psHPH2mUF5WOKKnTnht/FXb3hlozrcLecM2Xlpfnj8ir0MMYXFuUVhtRF WlSSVzwuH1UrSu38orFlxWgAY0OtIhTIQ6mCkgqfbdc0XlpSfJfdrqi9XTBmuK5Va6ukpvQlu8TF 84tKRtrlBWMxV3l6akOa50kO2LqKe9CuCK1UFIzR61BehFbzS8eXFJfmhjaKTuc6XcUcB5ejdFxF 2bgKO7+gsiivQJcpLCguu2BECIKlDMFcOFsJnL1UA9CoDwcbhfynHKBr7juhX4OGw6RYKF4Qr4hX QS+LjWJViC1duiiY/5htF9Rpq6CONbbnauXq6OrjutF1NfiVKJ0LUGi4OQ+JQmON8ST2azoIXIfy 5YHHS27NnhH/qtsiklNwLxf6T5DeKcWTcZ73StDoH47rwXu7HPB9/Ftd7+PefnMmGeYscwEJc6G5 EPLj5uOQF5mLID9hLob8a/MLyF+aZyD/Q0gyhCXCSAi3cEOuJ7DLEuEiAnJ90YhMESVioGkqmkIT K+IgNxfNIbcQLSC3FJ0gXyF6ouSNog80GeJuyJPEL6CfLO6BPEWchvy1OAf5WxfG4zJc+l1yoXd0 rnC9v3LVx05JuGJcTSHHutCKq7mrBeSWrraQ411eyIku7LVcKa6OkFNd6ZAvd3WCfIUL+y7XNa5u kK9z3QS5t6sP5AxXX8j9XP0g93fdihazXSMgj3QVQx7juht3J7nugTzF9STkpTKRDNlOXkZCJlnX kWF1t3qRsG6yekPuYw2APNAaCPkWKxvybRb2wFaRNYpMa7SF/ZhVbBVDHmONgVxiVUIeb41HmQnW BGjusqZAvteaCv191kOQq6zHoJ/v3oEd2x/cn5Jwn1D1yVCRCnOumir0R7VTHSBfpjpCTlVpZKp0 dSPkXgp9UzepDMiZCjtJ1V/1h3yzuhlylhoAeaC6DfLgiD7Y+WVEZJIZ0TdC7/NdAU/TFA647CWR W547nKILC4aXU2pxbkUJXYM7xi1ZPWyKJoLnmY6vsqQtaBs6Z+jdK5kZA3vZFJPVL9OmFqynOlzq IE028w7M08eMHjOaBjMfHjw7mXWkRtjZW9jFu7FjDycFv69PkdQA7TWiKGqMnjVhFAjujZO2Qs97 AoKDgI0RgFklTaYHaDbNo8W0ijbTTjpEx+gz+saIMJKMdKOr0cPIMAYaQ418o9iZFaMT7BhIz6B9 pBE2eoE0squTNnTOU0bDFU65Rt1If2/UiIpGPgxpN0cfNSyQ7nHS6I1cztW0uOmUpnObruCcFXso 9lQzq1lcM1+z7s79uC1x++JOxFU795uvab61+f7mJ1tQi2jHTsu5TtpqipO2Hswl3Xa63cvOsSvs GfYSe729k7X14zfF744/Gn8mISLBTkhP6JUwNKEsYVrC/IRVTq+9+ZojneFY885x0sRiJ20/0Uk7 rHHKJW0OpNvYE4ykaqS6bOo/0/7zF9pqwNGLOG65OWKFI0o1JsURqL7LwokzCjhuR40ZwdHAbj9q bmUBwTawO4g8VjYQHA+cNaEEoGQQJatsYCWFjHo96i3VZyRE1VSipJ4gIMy3C2kWKBvyXqSIu0n5 oErQdNBmohREQt8ByGWB+130fwMaIJxt07ojnQSaDZoLmgpaCFoCWh5IV4HWgjbA1mGkW0GIDr5j SHcjPQk7K0C9QH1BeGak4bSeNgzpCFAxaDVoHWgj6DXQNrN5UoSvXfJi/4ikeJ+PqYOvW1IHf3lS d1++f4J/crLbdzbpkO9scpwvR1NSsW9q0jCmuUnD/NOS1vk2a0pO9X3GFOnL8c9wyiZ7Qcd8R5L3 +rsntYJtTbEBWo16mqJ8XUDpyYdR7gDKDUb9KrQThTJRNf3xZaA/Of4JvvzklbC5CfdTfD2ZekE/ D/lOkDX1RX5RnX5ORz+XhuRnM5VDHsE0O2kPaLJvFdM036rk9UhXoG8rAn18DbTNtzVAO5h2Qta0 B/Ie1h1kOgT5UEj+KGRNX/wfdMh3PEA70O6OpAmQNZ2DvJptOOuA+U2OxviOok+HMO+BdUlOumD+ B/mjkoeCKvytkiciv9ifwrTMt8MP+8kr/Z2SVvtXJw105i95TSj5I2rGn3zM30uvH9K+vI6OX6zD mvRkOhTol416oOD6OuvaJbiOofO5utZuUldfT//GkHW7cB312jvrPwrtvoY1z2Ia6Cvzb0P+wvIX 18+GP+9E/UrU34M5nRqg2QGqm6/1k4VMOl/O+SWg5aHl4bOh5Zdz+RnwHU1VvrUB2sA0I0DzcG8e 33f0i3yr/PuRX4p0USA9hHQj5mljwPdeC8zd91FNuQAeg/6537cbtC/Ef/cx1frvPqZtviNMh1Be U43/noDvnQjx02/YJ48nm5DPsd/WXf+j7BM92SfhixfdPwEZMYVjg5fvsx8H/dntyPDn00wXxpUa P78G+aPIQ/afQL4H8l/o+35KTvV/kxzpj/DP8J/jsp1BNfEIcoqJfG9fTopb5/1Wium3kuP8Ecle UGc/pZgpkU55nQ+U74/ywF3ycH9UShxwNQW4moN8IfI28g8gPx/5EuS9yM/0t0rpzDiMBQ5jgcP4 5In+Dg7uUpLgv5P821JSgbVOSSv8q5PX+zsl70K60t+19j7iL+uRr41XC+F3C3UMZNqCtmpxG6Xp It9YfWlK3n4B7QpQDeZPIj3FMTnfX4W+1JQ75uuG+wNRbjDSYclnMH+aqh0K8a3ddXzrKPKaamIb 1g0+e5rjUmdnnVL3p87TeGBM1DxbdmFs67EWgTSpQ5qXqbt/sn8eYnsnxAdNfdOSgKF8J2akpXKs muefjHiRkZSC/EDkMadpnX0ZaZ2D+XUXldcxqQp+XPMsGhGY+0vGCDwDZ6RdA+qR1jutP9JBwXm/ 8BlxzsFODabShvuOMw2FPLT2fkC+GFsX5C+FBaYaLGgcMBbSCv0z0krSpvhTmCrQ3kQ8A+o+E84m r097IHlX2gM185I2098pbU6KntOctGWg+cgvrs1f+IwJxp4LY1Bg/P/hHZpJTc3PcYYlnD2RE2k4 gcaIe3HGjMMp72aa7RqIs16VTJJP0Vy5XD5rRMjVcqvRUG6T24xEud0yjHbogDSGW26rvpFvNbRi jFFWrBVn3Gm1sFoYFVYr6wpjnNXFutZ4CKe8fONRa4RVaDwZfmf4ncYynMtaGU+rIWq78RzOCGvM yNr9oicG1IKM+MVIPaB2kJfpn8QGpYOwn/Rkg7AH9OIsEb8ScrfA/XBQwwBh79g+CmkGCHtJD/aa Huw/PdhHerC/9FQGUuwnPdhHeqbD1hqk2Fd6cO6P1z/DvQTpJtiZAIoFtQLFgzpgT5+CtBOoK2gy aBpoBqgKNA9nKy9mugv1wDkqG6ezYpyiptAMmosz1ApaS5toG+0m03su0Z1oJmL8ieHe6sSGiS5I Ed7TiVHes5BM74nESO8XKHcmMRx3YyB95t2XGJUYC+mod6f3nHcPpAPeLagdjhqWd4P3uHcz113t PeH9Bnervcu8e70rIZ31LvTu8x6B9I23yvuadx6kU94HUHsXpLmwvcqLs7V3Bmqu9m6ENMVb6J3v LYFU6c1B7eX/cd8U/DkHWaU4/bv5zN0QPhJlTMJJKYI20mVErU+B0IPW1UQ2zq021t3GmtvwFxs+ YmON2x5B2sK51xp7/9YnHbLhX97PkOo3yuEjNnzHhu/Y8CsbvmJnBVL4mA2/seE3NvzEhr/Y8JVE nBe8p0FnIeMIm2iB4GdYEUocDMI5IhHnCJz9KLGcLktYlrAyYU3C+oRNCVsStifsStibcCDhcMKx hJPg6xNOeStR4kxCdcIyr0tzUHXCGm+4t6E3BrTDO8k71TvdOxurs9C7G6t30HvEexzz1AirgHkw T5tfk2n+HSvi4hWxeEXcWJEoqscrEs4r0oBXpCGvSCOsSF+K5RVpYQ3CirTCWkRRaxWNFYnnFfHy irT/L7ZkAC+FvModKAyzDSTaON3ZONXZON3ZONnZONkleCksflv8zvg98fvjD8UfTYjTf6E1vzK/ Qh+/Mb8hQzSGN5pWP3idgL/dQi72N6kaq8Zk/ejSvXAyt/8Np+5Ic5b5KFp9zFxA9fhzxQj+XKu+ e6f7bYp0v+PeQ1Hufe59FO3e7/6Amrg/dH9ITd0fuz+mWPdR95+pmfu4+zg150+0WvDnVK0xX6tp Hc9alP5MBTEz0+PxtPP4POmeLp65nm6enp4M8CxPdptlnhxPvmeUp8xT6ZnUZlebXZ6pbdZ4prdZ g6vas9CT7ZntWYKSWW2W4VrjkMf5F2qx1l6+tqUthdiZi/vZkOZAM6fupT/tMBF1yDKXmK9gLl43 36RW5lvmMWprTbQm0vX6CUE9VGvlpRv4s1r9i1RRgU/aYoL1XaiPp4K53NxI0twEW3FcB08OiiMP z4f+Cy7FR4BGkGFP1p+I8Se4sIE2tLd1q503exg1tgfj2mPvBx3SV/wUXL3j+8cPih8aPzy+ML4k viJ+IvdhPmzXM58xn0EfnjPxFDOfN5+H/bXmWhLmS+ZL6OHv0CuJsW0nN48qnHuoEM2mG9v5iZdF jQLR6aeT0XYHZbZegms5aBVLzhUqXyqvr7UX6Ndeooy+NnyH/sde39fHC/v3XX25VH+W//i+YAXC GYXEKDQYhSaj0GIUuhmF9RiFilEYwSisDxR+Sg1+sBcbZk9zDnw5AnuAOKKWiDkhRJeg79J/V9lQ W2abw5xmtpx50bUSV428BtfFJWa2nINrZsv1LQ9f8q5zbWp5DHw+rrr6LS13BeXtLU+G3DnFmjPf YzO0V7taVoPvZf6vX98/ame8TosH6vRk5gVjDB3djx3Xv3zpeBF8fjyG2LMAT5Fw9x/cf4Bv7nbv hm++534PvnnQfRjPkk/cn1Bjfk5Eq0yVSU1VP9WPYvmZ0exHxd9s0v9zrEElHIGb6v9xgZbRbOS6 BqJyUy63FYS9Oh2oLWc0pLPIRQfL6Qj8OLCGXZ7TPrfWilvT39VxMwaJMehiDFqMwTDGYD3GYDhj UPGTsP6/2ZKeDeLZkDwbCT+zJT2v+m8FiE60l+cwlnX6G2v6bw7VtTrDctbJaBGia8WrZBjpIbpO zjoZGSG6gbxKhjEqoDNJ/Uu+pr0s9jvXxmJLxJYMtmSyJcGW3Gyj3nfWdqFns9Czh9E/g3tmcXth 31lDmLPNqsBYBPfT9Z1r9GPKfn9PLlXjh41cI2whTeP1dJDTjFfdwZwB9NXoTOz95vN6hpZb6qwm bQjo/n24+n78ht69ePQ/7K4e096AzztjimPdKTrIPh+iM8LpdMgcObr0gM+H6jICPh+qGxXw+Rrd f9bj/30++6/h6X/V4w1aTzt5L65Xh2Jx1o7FWbvJZsqM3va/eukxu991v4vRHXEfwej+4v4LdD94 V0hraWPtOaUxdm1NJ1Fm4324DmredCDLwTRw52BI7oKrtmR0d4dC6gXvh9i72FaIJnpj3Utj1P2+ +8BPHWFUNVNmzGRc03BNbhzVOErnGu9nPox5ipMGZFwxM2ryuoZTsrZM8JrWeGeNxVp7NeXYToiF mMlRp6NON55c9+IR7nUf+xH7I9OI59P3qkAkaQ6dMJYai4wk5OeHak23aRr6BDy1jrbELDTOEP+v EiHaveYuMwf5QaFa0UWkm3qf1a2OdolYKDog3yFEa7pIVIVEuOYhY4syl5pPYWxPm8sRdZ81nwWu V5mrcFZdY67ByDeYGygMI3+d3OZWjL+e+ba5G/Fxj/ku1TffM9+jBuZ+cz81NA+YB6iRedg8DJuf mDom2spGTGyr2lITlaASeOW/L2r8d/uiT+6zmD/8M7a94Gdp++Gfse05P2Pbc3/Gth/9GdtewNEp Vccho+bbai1Y1wExy6Av6ug8fG44WEcXZ+hd5PY6uigjArl1dXThhv5205I6OpPOITczVIez4OmQ fV2LwL7uZMi+ztGdoKMh+zpHd4T3f13r6A7wmahdHd0e3kdEB3U6kuuIQ7wPMXgfYvI+RGAfcgi7 4cPYjYTVQUjQY90H63iv5o+E6B15b62X6T1OcNVnhcgP18qhZQJ1Hw2x6cgf1fEePa525AGP0d8M 5JG1rC2HUehya8n5bNSgcJLY9YcH83WewpFHiRp0pkxV8r96hZwUfuA+w1hhfMafp5Zj3NiekxEZ GSSdv5AcvRlCQy/IDw/KRmQhqIRTR+emzPCUn/E69LO2/pOvf9sZ64fuPo8YMez3PQmrHeEDpRPV K7s0RYQH5OxaioihTHfPn35F0L9S+/+6fuK5/idhKmw1GWGTg6TzF1Jd/bCLy7jjastCrqEaXaZ1 8H/4OhKg/7Hrv44p/X3nsyFnCf3XOXd12bdHQ68f8dTVOwyDUaqfY9vPd655rpm5sgnzVuD5zMfK FJYN1rcDH8X6bP1GrulxZbI+EbxI5oF3c+WCr3dlsL6Bruu6GXyoK4vv6jJj+O4Q11y+q+UrXENY Pqpltp/FJYcEyuu7W8RK8BT9lq+ZYm1h+QuWczQXezV3dWa+le+ityJC60WEa5HmciZzYq4/j90i 5mvuGsZyOvNzrNEWNrG1bF3LOC23azmgmQDu1RroD2qZW/dyLa/MZz6Tuf5efo6+a+ToPoBvZe60 uJfb6qw5l9zi+oblCcy5h9z6Fl3X7MH2e+i6Zg9eix5c9zCXrGI5KcAXsV7brGILy+QS8Emam9Nc 94HbzCfKI+Bn5FPga+S3mJkyCf8wZ+h5FnutJM31PEOu0nqtwV09824e9SbmM7hvMxyZ+zaDZ2CG uYJnZhjPBvdTa4wqUcZ93sryXpbXsByh+89lktjaHec7Mtc+Vn7+SvDK8wPAC8/rdc86/yz4Z+cf 1yuuPdmc++0BLWtOZ6v157Jn2cO3s7y9Wu//5mluRmm9sVrrzajq9cyP6zUNaHSvyr+FlxqR+q5R zuUjq8uYX6M1rE/iutncejbXzdatG1sCfbC1zHVzuPWz3Pomtl/FdrZwK0lcpsopyX0+W71K63lE UQ7X5SFr7BzgFqO4TKzmppft5FTzHGpOZ1lTpXtlVGkZNmGBjvFsrGRrbraTL5vxzOiSp3lFegdm TPfwMK/UaV7B0+xdp9mvIp3xOh7Oo05iCzu5ZG+en9PaD2kmjzfWsc8IytbYMWL57nbtt3RQ20SL q7i3B1i/iPVL9Gc4Wk/r2JN3ybdg4T75Enh77bcY6QEeKXug9lXS/4zzi5iv4T18KstbWXbOWHyS OT/KhIXzDVnerzlOcFqezrzCqXX+7+CWLlnNnzwZy9iCc446y2UyNEcPqObchLnT0SCbNV8zf5Xr lrP8HPMPWDOJZec06JzrnmG+lvnbzPdwySrmh1kzjzmfK41Ylk8wf1Fz0/l865WAjNOJuIFneBuj O/38INTaoDn0/VkfrWXXdi1bHtZs1jFBl6FtLpzKzBbfbmM5Q9fVMizgbGt+bGUz76a5XlkRoyOk sPX7ZuDZ2o4uL+ZrbuZb/Zi/yL63neVleq44wvS1JmlNWFOO8Dry9LAi9d2wbNbvZs6ytZPj4QSW q9gaexdb6BHQHOS7bPNb/ZTJrx4NvvBbHVcrv/2tfsp8+3u+q+WbXAP4GVTNz6Dn+NmkMf6wxPPT vOf8E+A+19ds+Wqu+wjbH6HvWk9rC5a2Vsn8Jete/exjfT7LWXqGzSzp4afbO2z/APPt3OLXzF/V d/W3JMxKqXs+xOrDvDt4Y+tDbcFqwpjlmMBoXcJ4TGGE3lvdCLwb8538tGqsYxe9zxFsi35Ogeuz 3xccE2aynU06DuNJp7lbc9rOyMrRiKazjOscPcOQ9XOqsfYotKr932Kf7+VgKnBqTtZ4Z//MYb6F y9jsk17mPVjPn686n5ogHukys5lP1Bw90Pwo801suZe2THQ+hlvZzBy7hfM51Z9qznZ2MH+d+WeE fQjqaPl5tnAt85VOnCD9TuEDRgmFvlPYi98pHBR8p7AVvxcYRvr3RtzUgBrpH8Jnnd6jhVE97Kka UhQpksE3DU3+LKHuu4atQt4yNHBCcNJIapyXN6aMKphPZD4lv7hoJE0fUVSSS7OZzy0qKaqghcyX FI0tLablzFehYC6tZb6huDSvmDYz38p8x5iC/CLazXxfubZ5kPkRHrsZ5Ca/s0i8O9RchvCwEO4K 4SqEi8BcEu8wNbdCuDvAIzEDXvJRp0u+9ejUKwuklc57fDTT2bUaQ8HrIa0MpFVOau1x0vAklEda f5tTL/Jk4O3H1Y6+UeBtxEaB9wQbTdJnOjL4DVODKvR3BskVFhFWPywyrAH/bekfOrobrQ2b3xzc Aiux5KEk9L4b9aaB6LFGiUtE6W9qsnRjUOoVlG4KSr2DUh+WLLQYTXFkY06S2MqXbOEU1/6Ka57m Wl9zjW/0L9/Ay2Ixi/ECJwnzjGjKteK4VgyXb6bL61MBRYgmbCea6+q/Gn6JVkmEiTAK429iuvnU Kawp1j0me6xwfvwnXITzHjqC5wElxKdWtHhEl7BirBjAIM7CiVJ//1yXMAbRCtFK2CJetBNJwidS RScxVUwTD4jpYoaYLarEXDFPLBSLxVKxXKwUq8RqsUasFevFRrFZbBHbxA6xS+wR+8QBcUgcEcfE CXFSfCa+EKdcN7tukcnSLzvKNHm5vEJeKa+W18kb5E3yZpkpb5G3ydtlriyQRXKMLJV3yrFynBwv 75J3y1/Ie+S98j55v/ylfFD+Ss6SD8lH5GPycflr+ZR8Rj4vX5S/lb+Tr8rX5RvyTbld/lG+I9+T H8iP5Mfyz/JT+Tf5pfxa/kN+axmWtOpZ9a1GVhOrtdXGamslWIlWe+syK9nyWx2ty60rrKusq61r rcFWjjXcKlSxKk61UEPVMJWvClWxKlMVaoKapKaoaeoBNUPNVnPUPLVQLVZL1XK1Uq1Wa9V6tVFt VlvUVqX/4rlCtBQtsRqtRWusRlvRlkyRKBKxGpeJy+BFySKZpOgoOpIlLheXY03vFfeSW9wn7qN6 4n5xP4WLX4pfkhIPigfhDbPELKovHhIPUaR4BKvZQDwqHqWGYoFYQI3EE+IJihJPiiepsXhaPE3R 4lnxLDURvxG/oRjxnHiOmornxfMUK14QL1Az8ZJ4ieLEy+Jlai5eEa9QC/G6eJ1aijcFTrXi9+L3 1Fr8UfyRbPGOeIfaiPfEe+QRH4gPqK34SHwED/5YfEwJ4s/iz+QVn4pPKVH8VfyV2om/ib9Re/G5 +Jw6iC/Fl3SZq7+rPyW5BroGUrJMkknkk7jIL1NwSk2RqTKVOsp0mU6pspPsRGmys+xM6bKr7EqX y26yG3WSPWQPukL2kr2os8yQGXSl7I+dTxc5UA6kq2S2zKaucqgcSlfLYXIYXSPz8ZS8VhbKQuom i2UxXSdL8MTsLstkGV0vy2U59ZAVsoJukJWyknrKCXgm3ignyonUS07CU/smOVlOpt5yipxCfeRU OZUy5DQ5jTLlA/IB6iuny+nUT86QM6i/nIkn6c1ytpxNWXKOnEMD5Dw5jwbKhXIh3SIXy8U0SC6V S+lWuVwup2y5Wq6m2+RauZYGy/VyPQ2RG+VGGio3Y892u3xNvkY5covcQnfIrXIrDYNfb6dcuVPu pOFyt9xNeXKv3Ev5cr/cTwXyIPZII+RheZhGyqPyKBXK4/I4FcmT8iSNkl/gxDdanpanqViekWdo jDwnz1GJpQN7qeWyXFRmuS033WlFWBFUbjW0GtJYK9qKJv1eSisaZ9mWTZWWB7vK8Va8FU8TLK/l pbusdlY7mmh1sDrQ3VYS9n6TLJ/lo19YKVYKTbbSrXS6x+pkdaIpVherC91rdbW60lTrGusaus+6 zbqNplm3W7fT/VaulUsPWCOtkfRL1VQ1pemqmWpGD6qWqiXNUEPUEPqVukPdQTNVnsqjWWqkGkmz 1Wg1mh5SpaqUqtRYNZYeVuPVeJqj7lZ30yPqHnUPzVX3qfvoUXW/up/mqQfVg/SYmqVm0Xz1sHqY FqhH1aO0UC1QC+hx9YR6ghapJ9WT9IR6Wj1Ni9Wz6ln6tXpOPUdL1AvqBXpSvaReoqXqZfUyPaVe Ua/QMvW6ep2eVm+oN2i5elO9Sfp/vDtIo4VHeEUHkSLSxWkxU8wR88UisUQsEyvEOrFBbBKvia1i u9gpdou9Yr84KA6Lo+I44uVJcdo1wHWrvEpeK6+XN8o+coDsJ2+VQ+QdMk+OlKPlw/JRuUA+IZ+U z8oX5EvyZfkKbHjlW/IP8m35rnxffij/JD+Rf5F/lZ/Lr+Tf5T/leXHcUsJjNbaaWanWUGuYla9a qRw1XI1Qo1SJKleVaqKarKarmapKzVXz1SK1RC1TK9QqtUatUxvUJvWa0t/BHs2RjDiSGRzJTI5h gmOYi2OY5FhlcZQK4/jk5vhUj+NTOMcnxfEpguNQfY5DkRyHGnAcashxqBHHoSiOQ405DkVzHGrC cSiG41BTjkOxHIeacRyK4zjUnONQC449LTn2tOLY05rjis1xpQ3HFQ/HlbYcV+I5riRwXPFyXEnk uNKO40p7jisdOK5cxnEliRGfzIj3MeL9jPgURnxHxnoqYz2NsZ7OWL+csd6JUX4Fo7wzo/xKRnkX RvlVjPKujPKrGeXXMMqvZZR3Y5Rfxyjvzii/nlHeg1F+A6O8J6P8RkZ5L8b3TYzv3ozvPrwHyGCk ZjIW+zIW+zEW+zPybmbkZTHyBjDyBjLybmHkDWLk3crIy2bk3cbIG8xoG8JoG8pou53RlsNou4PR NozRlstoG85oy2O05TPaChhtIxhtIxlthYy2IkbYKHjhSRor2ogE0V74RZr4SvxKPCweE4+LX4un xDPiRfFb8TvxqnhDvCX+IN4W74r3xYfiT+IT8RftFa4s8ZUryzVI/Ep2kdfI7rKn7C2zZF85SA6W OXK4HCFHySo5V86Xi+QSRO0Vco1cJzfITajzrkiQ2+QOuUvukfvkAXlIHpHH5An5mTwlv5FnZbX4 i+xihYs2VpQVa6XK7pCGWHdYeXKPaq5uV7mqQBWpMepONU7dpX6hfql+pR5Sj6jH1OPq1+op9Yz6 jXpevah+q36nXlVvYaxj/z9DnH7mt2TctWLctWbc2fxUb8Po8zD62jL64hl9CYw+L6MvkdHXjtHX ntHXgdF3GaMvidGXzOjzMfr8jL4URl9HRl8qoy+Nn7fpjMHLGYOdGINXMAY7Mwav5OdtF0biVYzE rozEqxmJ1zASr2UkdmMkXsdI7M5IvJ6R2IOReAMjsScj8UZGYi9G4k2MxN6MxD6MxAx+3mYyHvsy HvsxHvszHm9mPGbxM3MAPzMHMjZvYWwOYmzeys/JbEbobYzQwYzQIYzQoYzQ2xmhOYzQOxihwxih uYzQ4YzQPEZoPiO0gBE6ghE6khFayAgtYoSOYoSOZoQWM0LHMEJLGKGljNAyRuidjNBy/nZ1BE44 w2gpraL19BrtoL10iI7TKTqHE0vg/EMd+NcguwqcdXDW+Dv4NPEP8Onin+CzrXvBW1lFZMpkazS4 3xoD3vESFr5hC2fYwlm2cI4tTGULo9hCMVsoYQs4wVmlugRLZUHpzqBUHpTGBqWKoDQuKFXWSBEZ QSmTJZzfEHUOEyE6fI5WT8mvyIUogVMjIsU/yQ2Ev6Y/nzAWUTPqTN0pA6fpYYhwFThLTw/O3QE6 ql/BMqKNVkY7I9XoavQ0+vM341yqHc6FC1hqH5Q61EjmHyHNZ2lXUHo7KO0OSu+wJPh0H23u0Tnz dTJVX/MTyPO4zLvB0nuD0nt16u3jelvAZ5lvgD/KZd4PKRNjbtX2zDdxjp2PdH/Q0gdB6UBQ+jAo HQxKHwWlQ0HpT0HpMEth1BDeYQc+pehq/h6tPYH2fs+tPmG+xe+17UBuMfI7WLvYxO4G/OOgrSMs 6Xcfne/7LjGXo+QKcxWFm6vN1dTAXGO+QA3NF811FGWuNzdSdOAXeKP1r/rwu3LEf0HW7949iRu/ MX8Dm+tQXpivmK/w94ZNcy7/NVK/V6XP6WGwIfnzrLaBX1Rryb+l1go2XqXW/NfFa/mvi9p+b35L ykvp/FlBQ5WK5wE8TpyokawY9og05L7CGf4jLhcp7sHTA/ecVJzgTw30yZL4jGig5p/485L/V92V gEPV/f/Z7VkGYdCQpax3LJFEltBiG2u2YhpZsmQnYaaypFLWaDEMIVtlKclWKmsRKVR6X2sluyTF 786gvG/1e3/P/3ne//u85vHMPd9z7/l+7znfz+d8v+fOcy4XZPkJJgI2DFpKW8GHwih0vUiwj1fX UejrFLBm+r20fBv3AdqvUuhHg9+OhlaPUCG0s/9r36yuQ63sGoahrTRy06UQjDpAxqiimKQiDSLn 2KAMMAoZsxkUicOgUBwLwIRCSq+DwwSQEMARxSyNgiKgZBUYFEExA0wBmTUSwUzhCEGIOv1jDHGi b4p6mL6ZKRGiQfsAImsaQ3A/57sWXuPP3mlrv6FD4SavfL5KigyFzNMHkOH14L8sBQ6DwmAc+jX8 SX1n8Ho6c70eBmy4LIDtm6lQJGgUKZZuJNwCgULDbLRwPACaVmBEs1oRff2IPp5YHUdvIo4b4KKJ GdAsuv4+To6eAa6HDxNx7GBroJQZjTJ3cQz0I+KEAAxNwILmXhZgdYg+fq7OrgT6TpS4DYAQrRqO 5l2pNnf1ALU4enjTNlbU0QKE17MBijgFQAmg/9msZ8PRiooKispblbfaAGZrjLUww60HeJb1r7Mk +riauR7ylMHu8iTI4aSBzcuKRFcr6Kpom18u6zIj+tA2V/SlKSVDRdf2ChQJgZOh7BBQzgwjQ6GQ vKabWS2t2GLmYzEFUf4TpUaTfXXsNYccq6gHBXsq55sU808AMdZhp3vdX225wl7TPho0FXg1zEu9 JqGY7Y7LzOHEpiq8bL7B9tnyZ/b7MbD0z/Luwllz1LSrAg2w38L34vvXHRjdIRhWwfZa81FpX1TV /hA3nBw8lYTO1cc+xvmyWcm2BikpJnGlclW8dpG/NtR/79RpqfuxIlHOVcetrbz8a9SvSUTZN3Hw qKefeGdex+xZv/hg96sKBs4U0dBeDcl24aDRdFzj5JAof299ib5OmsB+ivC5AYfZsdDJY/lO0LhZ Q5bXbaKWuUmtRdEBRWN32KYHDLspCy6UIu5tJVF1lTA46PhUUi9AegEooRhBj0UiGaBQxCZAAhBb LQPQSD4XPz9vNXl5L4Kvt1wA2O++YL/LEbw86L4jhIZClxCMAAr8gkEhgBZNtgGhBqgCWyhKFIVI YOVygs/hP1wtv+wra11FR0sOPIvuqULiCFaAedUKOCOwjiZkp+lCgAhAgRaCZU4E6JlZ/MD6Vf+G o1nNzbRAR1OVxckqK/4JFXASCbLbff6d9T1dQVxMcKp0cg25ANoluLf1+ilrzz7GzVSHhqYE9DAC zzauLykPUb0+0JhglNYp6sQzp6kiYuyNi5iMVY0qGRlJgSw+sUg2EnuaJ2kUUnTLUWta6vFwY7fD q0rpkxpll8u6f7Naqi59EDb7hPXKRMqidMc2PAajKjmnuRvE8BJAhg2v4JjtrfRE54vN0XwKSCaH tIDoP+P4b0HGj3AEVNfC0ep/VCoPyC4rlfgrpbQ6os9fQvKmySaDVx0uISf4dJ397cPqb6cTJJa2 61wK5VTlELfw7faXdP1qVIG162Cep2CkPlhYiji+EO4duKvo/mj8FVWFeBaTwFpuJmwX6qy8H3lq 52KAUZ9ZRCYJe7ko2i6TcW4QmB8TVdmrzfy47+GG+i6LtyTNMjxV5ho0ZCrz2hnlxfQhezdk+nb3 /prk2sWWA/M7hhkouu9Jpp7ZUlPlpzg2fYh7iaJEmqQd3c3IBgg1cVxxn3trXYTI25F6c9NIHG+B er+Z154O5ctlXgeFSpJlKrcPB7/3CJnnHZIoLB5PNbu1QybpdvC1xU58/ma/MO3RrcKZbrxD+yrF XF5AInQ4oiLcVyDZBJAe/R8hyfoNkjAAAigug1EGkAI2USQoYpGivwKjn6+vLMGRDj9eOvxoTfwX BKJq/ycEKv0ZgbRRjgry7jHCQ7G2b4IbyUD91wr+5KrzkPtVra0PZ9a9WJo3rFV0AjgfzPphOuNf 77+ERd8I3Vlt0np8OGL98RzJhENovYWm2xe04C0XTW2RseG5XtMYE4yY3JTrmcOic5VNvEkfWP1q XQK736c6RdX5nvsU4xeyMZ964WjKjbm4zUcM5fwxBlo9E2VsWPOuQEoKmeD6lenJqQn/SqaL3fOc FhJpjgrVIbDrRyOrM+/HisoEtSsH3I33tZuvGNrLw7yxZeBpp5Lcrh086uwHQsQeZjuPJz/xfq8x PMMW9rI9lBpwxLXukrE+oCxyI7NYwElduvvsNSmGoy/4SuyO/n4522tRPaYQICO4QAr4vEwB7JA6 SKy6ejRnu8ZHwmjfjrU9hgAZwHsV2yxoUR0v72Af2u7R2E2EzVjc1q0q2G/7NdP3hpbDCQOCyyfz /LFmZddonAiwYXmY+L7X4728/LBa/n4uXj6ufsE0etiqAuBwAKCyQg8KAE5BEbdS/Acs+supHFZV 5z20bcoIsyk9JcgBeJeZd0Z8/6fFpL3UW4uXM7EaoaaZFzPjDii4t2sfDB4rCGg075l6fylSMC79 hHPJA/cQp41dQuqv2aHxI8n1NbLOaWkuEqltajI1rGXWEnV6w8waqskyeZu25o7uOq7df4K9Mu2w hWMBOTTjgGzg3reppQe3pZkI4hjFuNPzhs9L8w1tv0DgPmCNJKYLqeCj5nLGE2EPMR01FjtLYiJq 1EbNE42KvuaEePgZFfO1JDNtEoFYnTvgqlK5h4tB3XLJdiHLmZnx6lOSpdV4+TYHXlIgoudjdVFE 0uL11vCuHAEfO/WmuxOMVFGgBHWysQQbiD7Zt8IbuQApGyBl0nAJRZDSAFJKBIdtm/e4q8+VjaZh 3DcNzy41Z/j8/48f+S98nM4KSSMstWemU/iUP9yGir0I5Jy2O6CQfoWlWQN5PjquUW1IZGrCKkGm jKLf4DT+5XnLtm02eVvMXRfFPDQbW669Roa+wp3Zns7h7Va5yGXM51r7pU2nn9MGa/zO6WjxNf4G aRVx2WpiBtcpcXYCdc5ccF6ksYtnGl/gqaPA8JW8/tPgocNsph+rJvGPqobrgS9YHFO0UNJmAcNn QrDsyYg38FLbmRuvGqzGiLse4c3LS+GbuJbOdU0wxoXdTnmQryIzEDKQG9gfQIG0uWnWPd1y6o0W V66yG8atV/m3TkHEQO5ORIONoqqnoSCb0y3mzNMdz8w19VoFLa5693KpRSX4p+c8pYCscB8MDopX AgM3llTjWohQPmdPPSzDWfLOapIg9E9RArAFjBeUcCpKSjglWgAPUrzCllVKIF39Y8iABjiX0w1m K0dfFzAU8AP1cNCnEDDZYMATD3p4eR5ctYz5V5b96jYVQKU/3OZGQGT5NgTW1hwk0oMPWjRiQk8K sD8yCRuNSRjpTHK/BXvmbt+ShslYyL1OMfGPAY9FllqlLI2aLt0i31QOloXU5zI+IzTeyv74tq6u 68bp5EyGz+zlZHzae/LDKo4HubVj7ifOmmEqTT4fhMbU8XaSXSA7gnRnuVSNFgimbz5vrxhUudFH YNi47cgOJf0Z9yK9WUlfYdFmbX5h03J8Wge1Df2QX/MIymMqSUR3v/aH2sbUg9jbdUpfMnWHjt4U kr999fVMRt9FEfZFa5yWhWpYsfXwwOi+YPH8OSl5Tk3VIA3t8ByXgTBRl/VDu+Prg3Tx+hnGJ2IS LtYeOvqOaSESfuxj6hF16RznCy19sr9LwwTYlQyIs+pcxZNRgkISeK8W0PfgVDJUCuwPiZ/F4fB/ B71woZhWEnAekF9gcDgEQU9RhdYheBHc4p+k99g3+JgXDn6kSK3nXaibNyMB/N8u4YYhWIWZIWYQ fzBd14FoASz0wIeed+gB7N8CLCQAB7/W4JJOY4T+N9PI29ffsbAotZNxGjFOO58x5sw7Ehvk4J9V DbSelE1JHu/of2BpllvG/7hlaJIyb1lukKgvNpi34WVI50feEK7e6XOYUUb7kpPnKk5bVwq2JHUk JSrOnH+9FH3RYc8uk60SaliMucqXY3Y8CfdfCp6dcMSrDzJ8cB4PHo17bEUgJvHtooT0EW/1SRQt NnCVP8xsebg/1nu6qTef7Mnwkshfkfsx8h6T9oVJiQLXkBt10jnXnTdkF0cxuqegb1/fkiqMpKJV qbUFgMYdkefA1SYnLsFiqzODkyGcdxzUWVUmE+rio40QNki7R0+68rp/O3Y+SHKh1DM7DqVofcNB ipMdICMVQSrDLNMYs6PelWb6QgvxhxWKfwtlfOe+rUqKSlto2ZIKGBuBRWVaEfD7W+5jpR7+i/q/ DIlaScmqRXaZU3V9r9vyk850qV/eEHvfPlLOfuKGz2x+QbRbWc8N0aMsDQ3Ze847iKLfzs9uvFw2 4xlQND6Wpf6ovnafnWZ+ia+ixFUnkmNwhtOMZ3RSm+erR+lPs0w5AxzveJ8iZiTzxuTYk9p0nQd7 La/saPryMkBMTheADHYdO5rE+cxaiDpizNIY/TKzyyz1cBOhKdUtLd5hryHniHyHra3DfjzVVza7 8sROttP8PAHNjD1pV715RgxHXb/a33SP+7DZVEU19qHeLp5EkwvXZ1yynr9mOnLI70rgaaGT7inv hvfvbHkzdIStnQBJOIq7cJalFF1V0jY22ScylnfAcUxFZ/v95ZCIDI0He+TsD7nLdzIY63bP8zdr NR7DGPGjhKmX8p8kfv0F8+XRpBsRpAyAdCXipyyS4Zf1T/Dfj8HCnuXETxfQBnZQNCjqkWprEj+P 1XbomZ+3uytNKr/yPhZfeRoAaP4P+r4CPSE0XpOJ6gBagOa3TBQWqbjSbmBg4M/aJfr82KDfz3JC 1e7xJNWLdhe47c09XftgDcMlCx33DAvl88PN2XoUyj+5DbEtiAgEamS7hJQmhZ2ym9KpP36ReCza xDSUzD173Pd5ZrVdE8z7scTh9Xfx3NkxtbcGMloy/C+fP7IdU2sJsSz7dEKix0FxoUs8xCGt5+rC zJSWQIGFXqHBy/OqaGumXZPTuKgNdxFnbbmI8Lcspm0ZrKdSq7rrctsYecRFysqtYgTbbSOVs5u+ XosazVPRvKXj3o+d3Hk3rOjtpMXNDIO7xGozpe7GERQBgQryNFkyqLz4TscmqreQOWJ23wOZgcFw 292DCsFjoifjWWVLTGwf3tthbZ3/tLVfvq511CNdJRhHRjSDtPkIBoUCpLJ/DTn+geC/L2NTSCMA 97cJdRMUxwBH0h9c0KbZlaFnguNY166cg6Z/L7Hg1gFra3mAjd8vROBA3BrHwm6fuCWwJXodBjuy LTzjN9SSA+Cz5hJW3EHAiaIaseUnbyTDQvS+vSXqF+8my5CIEPulb/sFe3sd8nH0dgn+czSJIEMh JkgR3qqL+HHn5lBjk/dX7wuTgsb48NrakG1oKUIuurqnPOciOfbDBoiLxEjCq6LPSx7aceTNBlSZ xC+litUzWWq7nPyE8gc0ng9U6A9/3Ir3sLw/ZK6Uj5btP5+gJP5wvj2RUCD2KctISU7QufpwkMO0 YZoa017j3+O1deUejGGpwmIES52+Q+egW4oL53T37n+lzhlsn1+I8WmuuhJ7lnpZNmPqE3selMj9 /pW7vCkDb35ixHWnsPOXPlXutFkoG4jnim0hx6MULN5cvh0b+mT8HGWyXJKdVZINMlFLUl5X6Juw EGRmNuHz+1DKXO5HswK9s3XGTTXvxdKzZj5Mt3MI4DPIYFhEhi58HzEUjgwdBUUjNPc+9Lcsav5k KZUVxbhsAAxkGco+gG+t77F8f7QDBV3vWw0Sx06b78EJXoG25KGsZAPy7xrX40JwUL+oNU8FKao9 O8DUbvRe3/wnLuB+IdKuMDHXXN7I0NzVe8iCEFz4oJSsEz0cFMQWbvMs8ASHxKHEvqfRKHx465xE 4Vnib80LCoE8dS6PhOKzvNBvKe/0LYLY9ynXdDs/GxV6yS2vprSgEx8wrSmYcDrx/fAtuzcyFTbx lWJ67MgjBpyao8hw5yCL9aOUYOtcpbj2gU9yFce5hRmDe6tcRpU7LTZeCM0qxbgxDVoNYFpNjToz yXud9nLVKxBfKHRo1A8QxJt3Y7JLZ0c3HorTdJcdZAhv1/JgNa8tqlM+0N8YcQ0mIH+48vqXPXc5 MILbPwu5XHE2eHksh9XC6Tn7swQ0cmS9ODolqbqqc4KaMbVVc8M7fSbqfwAIhDYaDQplbmRzdHJl YW0NCmVuZG9iag0KNTU2IDAgb2JqDQo8PC9GaWx0ZXIvRmxhdGVEZWNvZGUvTGVuZ3RoIDM2MT4+ DQpzdHJlYW0NCnichVLLboMwELz7K3xMDxEYjNNICCnQROLQh0r7AcReUqRiLEMO/H2Nl6Zpc6gl sHY8MzuGDYryodTtSIMX28sKRtq0WlkY+rOVQI9wajVhgqpWjkvl37KrDQmcuJqGEbpSNz1JUxq8 usNhtBNd7VR/hDsSPFsFttUnunovKldXZ2M+oQM90pBkGVXQOKPH2jzVHdDAy9alcuftOK2d5ofx Nhmgka8ZhpG9gsHUEmytT0DS0K2Mpge3MgJa/TlfVMdGftTWs2PHDsMo9OwFj79ZF1O28zSW+y3e ZDMYcdQKv3GG4D2CWwSTxRedkr/towJpW9QesCp8FWO0JMRqgxX3FcfWgl3HTm5i8yUaZhIxavEu HO8i8C58jyAmELkHE4Y9MYjYI5ggiJ6b6NcFb75vPltEIYuvg7KboDm2yDmyi39MBdK216bzz55n 8jJJ8mytGyI/uH565rlpNVxm2/RmVs3PF1JH3KANCmVuZHN0cmVhbQ0KZW5kb2JqDQo1NTcgMCBv YmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGggMjg3MjEvTGVuZ3RoMSA2NjIxMj4+DQpz dHJlYW0NCnic7HwLeFNV9u/a+5ykSdq0SdqmaZI2SdOmtEna0tKWR2lT+uBRoQUKtAi0BctLGFoL jOAD1FG0oKD4BgXHt4ikBbWgI6j4lsFRxOf8QQcHFSs6f3Qe0Jz7O6cpFMbxc+797nfn3tt9sn57 77X32Y+11l577zRAjIhiASLllE8eO1qnHbuV6PhFRLa60eUVlbGP66cQ3X2IiF80uqZ6svXOZ08T bXISDZ00evKUUWrV3lNE7y1FI4erJ2fnxnhXdhKxLrTaOLV8fF1u5/h0IvsgIuPtcxY3tVg9c+cQ +Z9He5fNWb7U+UR0cxxRAPmIdXNb5i3uMBXkEuXkEKk+nNfU1kJe0qL//WjPMG/RirlNVxkricaM QRtL5zc3XXKw/ZpC9FeE8oL5YOieEuQ8xkOp8xcvvfzB4bEn0JeFyBq9aMmcps9v+vZKomXoz7J1 cdPlLYZpkRgfuxv1nb9qWty85t0qDdEtM4h0FS1L2paGPCTP/yG5vOWy5pbnt653oCvU0XWQLDsV 0aqiY3c2xBT9oNGCjfBg2sQmOX5x1JdJUsQ/NoinNV5ktUp9OSBWP95zD16OlSKkd8XTZ0v6QpfM iaqmChKUPCcDZcsjEbagX4UjHmAb0LtGda8qD00m9cZCE83lJpWKRwhazlVcFI9SprSPLi9TRoBQ O77MSQFyOpPE46Gr5ZHweQFikiTh7dnibfJMSRQP0Dy5NuIwsRP0vyGg7fdAx39BPSNoGmhVOF8H 2tKv/It+6dUXvLvzgvz6/4lxbgjH20BX9/WB+CrQlH719oKeC6cXgW4F+fu9exB0G+jif3cMA+Hf C7Lsw/FO0Ce9aZb2f3ZUA2EgDISBMBAGwkAYCANhIAyEgTAQBsJAGAgDYSAMhIEwEAbCf1QQSGBy UAkC44yRRfVN5D76m0YiDamlEGlJK/WQTsFIigRGURRQDzxD0aQHxihooGigkWKk02RSMJYMwDgy AuOB/yAzmYAJFAu0UJz0d0okM9CqoI0SgHbg3yiJLMBkSgQ6FHSSTforuRRMITvQTUnSj5SqYJqC HkoGppND+oEGKZhBLmAm8BR5KQXoIzfQr2AWpUr/TdmUBsxRcDB5gLmULv2F8igTOIS8wHzg91RA PmAh+YFDFRxGWdJ3NFzBEZQNLKLBwJHAk1RMucASygMGgN9SKQ0BjqJ8YJmC5VQgdVMFFQIraShw NA0DjgF+Q2NpOHAcjQBWAU/QRVQEHK/gBCoGVlOJ9DXVKDiRAsBJVAqcDPyKamkUcIqCU6lC+pKm 0WhgnYL1NAY4ncZKx+liBWfQOOBMBWdRlfRnaqCLgI00HthEE6QvaDZVA+coeAnVAJtponSM5io4 jyYB5yu4gGqlP9FCmgK8VMFFNFX6nBbTNOCvFFxCdcAW4GfUSvXAy+hiYBvwKC2lGcBlNBO4XMFf 0yzpCF1OjcAV1ARcSbOBV9Ac6b/oSroEeBU1A68G/pFW0VzgapoHvEbBa2m+9Cldp+BvaCHweroU eAPwE1pDi4A30mLgTcCPqZ1+BVyr4DpaAryZWqSP6BZqBa6ny4AbqA14K/BDuo2WAjcqeDstkz6g O2g58E4F76LLgXfTCukw3aPgvXQlcJOCm+kq6X26j64G3q/gFlolHaKtdA3wAQV/S9cCH6TrpPfo IQUfpt8AH1HwUbpeepceoxuAj9Ma4BN0o/QH2kY3AZ9UcDu1A58CvkM7aC0wSOuAHQp20i3SQdpJ 64G7FHyaNki/p2cUfJZuBXbRbcDdwAO0hzZK8t9H7wA+T3dJb9Pv6G7gC3QPcK+C++he6S16UcGX aBPwZdoM3E/3SW/SK3Q/8FXaAnwN+Aa9TluBbyj4Jj0AfIt+K71Obyt4gB4C/p4eBh4Evkbv0CPA Pyj4Lj0qvUrv0WPAQwq+T48DD9M26RX6QMEP6UngRwp+TNul/fQJPQX8VME/0g7pZfov6gQeoZ3A o7QL+Bk9Lb1Enyv4J3oGeEzBL+hZ6UX6M3UBjyv4Je2W9tFX9BzwawVP0PPAb4B7qZt+B/yWXgCe VPA72iu9QN/TPuBf6EXgf9NL0u/olII/0MvAH2k/8K/A5+lv9Arw7/Q68B8KnqY3pOfojII99CYw RG9Je0hSsL9P1yk+Xff/pU8fNODTB3z6gE//X/Dpdw/49AGf/h/l0/9fOqeX/5s+vWrAp/+sT28d 8OkD5/Sf9el7/qN8Oim/DpbJHv4F8X7kkGJvkghrIXhPJ1Jq+Nih8E2V8D0XwavUYs03YzUvwgpd Rludsc5EZ5L8+1/ULoQ/q+hXbw7W/qVY1ZeF69klSfrTzzxzjt5/9L6jd/3TL5r/ZWBqOvfDaM7l 3zpfUAFTFH/yVautL5Wa5qFBGYSdAK6f4OYJE+kXyqly9BgaV0U0oZomTppMU6ZOq/ulI/x3Qu/P tTto5y6srF8e/q/RVqC0NlBSPLJoxPBhQwvzh+TlDs7JzvL7vJkZg9I9aanuFJfTkZxkt1kTLQnm +LhYk9EQE62PitRpNRFqlShwRr4Kd2WjM+hpDIoe95gxfjnvbgKjqR+jMegEq/L8OkFno1LNeX7N AGrOvaBmoLdm4GxNZnAWUZHf56xwO4MHyt3OLjZ9Yh3SN5e7653BbiU9XklvUNJ6pF0uvOCssMwv dwZZo7MiWLl8fntFYzma64jUlbnLmnV+H3XoIpGMRCqY4G7pYAnFTEnwhIrhHZw0egwqaHWXVwQT 3eXyCIJCWkXTJcGaiXUV5TaXq97vC7KyOe7ZQXKPCsZ4lSpUpnQTVJcFI5RunAvk2dBaZ4dvX/u6 LgPNbvRGXeK+pGlGXVBoqpf7MHrRb3kwYeUxy7ksGjeV1a3pX2oT2issC5xytr19jTO4dWJd/1KX jPX1aAPv8rTKxvZKdL0OQqya7ERv/Pr6uiC7Hl065ZnIs+qdX7O7QuY0LnQGte5R7vntCxuhGmt7 kCatcHVarYHd2OqtFc722jq3K1hic9c3lds74qh90oqdiQFn4vklfl+Hwdgr2I7omHAiSt8/0Xy2 TEkp1eVU1aSzkmXyiNxjYRBB5xwnRlLnxpyGytA8lNrnDEU1hHqGt4KXQCMLgtqyxnbDcJkvvx9U pRnczvYfCBbg7v7mfE5TmKNOM/xAclK2k7OmhvK+dNDrDWZmyiYSUQadYozFSj7f71vexRe4WwxO RBAf1UC2TfXDsyF+l0tW8NquAM1GJrh6Yl1v3kmzbZ0UyPbWB3mjXLKvryR+ilyyuq/k7OuNbljy LmWZxwc1nrOfGIM5tmL+8CAz/0xxc2951WR31cTpdc6K9sawbKtqz8v1lg89WxZOBWPL6gQbD6e4 TVBKYZQzzlaWM3VRQTENH7Vi1Jd0RWhglQqHOSuDhsYxvVivc7l+4Utd0nfyW0p07rXwMIPDvefn R5yXP294Ue0CBix6eFXt9PZ23XlllfBA7e2Vbmdle2N7U5e0erbbaXC37xY8gqe9paKxT6Nd0p61 tmDlunpMYj4bDmvlNKrDzW6c2BFgN06eXrfbAId+Y21dJ2e8rHFUfUcqyup2O+FzFS4/y5VzTjlH VQyW3sk1SpFtd4BotVIqKgwlP6eLkcLT9PEYzenivTyDwkPw78Ghfp+wr3NKXqAL0XAl2hmdmrta jiP1StypzSspzRb2UQtoB+ggSKQG4KowRyAHsAQkc9cr5VuF5ygI2gd6ByRz9oCzB5w94OwBp0To IiY8KzzTmepA17t2Jqbmniy1CjtJAnHhVmEttkWHMCscN4Tj9YgzEW8IxzcLaztHOGJKtcgzOgmU QBxz29w5ujp3t5IoLFISm/o4m3aC4yhNFDZjVJsxqs0Y1WaM6iSQodVN4G8CfxP4mxT+JmJKU66M cFPhxObOGHOYg0SpTqgXpuLu6RDqwvE0YWpnrmNvaaMwBU3vUHCrUAtcr2CDgtUKrlJKVynpJUp6 iZIuUdIl4bSM2f3QoWCMjMIkYTLuyw5hojBOiWuECtyrHUI18nI8QRirxOOF0Up8EfgWxFWoZ0I8 TqhU8mORL0c8Bnk5Hi1UdpY7ckpbkG9AGUd/Mr8cYyjHmMohJJmzHrQVdEThNABXgQ6CBKUmE8rx lOEpFUrxRgBtBFASIEEI4CnBUywUo2Qk6o4EBoQiZY5FqFWEnoogqyK0XAT1FEE9RRQhFAGdQj7l gAKgGlAjSIV2fHjPh3H50INP8FMq2nLxdRSH2BmOHXwtJSNO5ms7kx2BUi3fRTWgRlALaDXf1aky xZTGoZ5cNxtUDWoArQJtAe0AaaiktyQQyUt4iVDNqwUR1p2xs6goV4nzCnpje1JvHGXNjSm9TMiA mDJoC0jAkDMw5AxMtS/nAHGYTjrtBR0EHQHJAk+HMNIhjHRMMB3vpyu11Eq9kyAJJMCI0tH++XVU ytsOUHa/VmTuIHAGITcI7wxC3UHgHgEy5Q25vAa0HrQ3XJaiGHOKYpwpaCsFo80GliipGKBDSOnk 2pguyJcNjykthNyrQSjkN0OaN0NuN8sWwuVFnI2SknCN9aAdIJWwG08GnnQ8g/Ck4HHhceKBBoVk aG8DnvV4bsFzM551eNZCG3E7vHu9vCF/Sf6q/PX5W/J35O/Nj3iON+Fp5I0BHZnN2AlNRo211MBF mkF69g8Ftyt4mYIBBRMC1hn6YzP0r8/Q3zNDf8cMfd0M/YQZ+soZ+uwZ+i42O5Dg1X/i1W/w6qd6 9QVefb5Xn+fVZ3j1pUZWz6aRnl5QcJSCuQqmKJjEpnXqSfs8u5hcGlg8S9/lusbxhatLZJ2O61xd GkTX9uYu7o1GyMxnHDmueQ5fL8fTG6W6fieiBZrCnqQI5g34It6IaIgIRAyLyIrwRwyKSI9wRzgi 4jQmjUETrYnS6DQajVojariGNHFd0tGAV76FxakNcqQWZRSVtIHLKF/YcHTgTMNpHAVjhSpeNXkU qwrum0NVs53BHye7u5gOe6rKPYoFTVVUVTvKEiz0VnVFSJOCQ71VQW3NxXUdjN1Sj1yQ34gtq7au i0ky63qbfHzdTYz5rr/ZFo7r6+V36jpEdvPN9WReXmIpMRUbh1WW/wQ0htF7Lli8/TMYSVLwzqrJ dcEnkuqDuXJCSqqvguTk0+5uPpQXVJTv5oVyVF+3W7eaD62YJPN1q8vrz9UjJ/jlu8klR0o9csr1 yHlBvWReKNdLk6PeeslKveTz6nWMdFWUd7hcfXVGKnVGnl9n3vl15il15oXrCL11XP3qRBwll1LH FXH0n+ok/4I6aT9Zp580m0d5fyaw3TSOHe4oWylfFRrdFc2gxuDa5fMtwdWznc7dVMYOh28RnsbZ c+bLcVNzFzvsbi4PlrnLnR3jVv5zeXClXDzOXd5BKytq6zpWBprLO8cFxlW4m8rrd45uytx+Xnc3 9XXXkdn0E401yY1lyn2N3v4Txdvl4tFyX9vlvrbLfY0OjFb6UqweZqmhUfU4myrxTh6pgwE32lz1 o8yGlmLFmke4LFfb9ojEHqNIHNWjcO3Tg+Qif6m/VC7CKpOLouUbYbjIcvUIl20PeyxcZADb6B5F looF5fi0tYUTv/DT1ta2dFbbrDY5Vj5tS5eBZDVRG7UtJcygNErZ3xzwxrJvXgtap/hooa2tfikp Om1bRnJrS2U41/jZ1DK0zNr6GwG1XRhky/BSL6G5tmUMteSKy8Jm08ZQiGZIHmS4FSLxOOg2siFO FmZjxybpSJg+l/9lu1we6pEk/gEq14apN9TiuUPBWja+N6ZL6BAtplvpLvDy2O/pcQpQDPiHSGDE 6qiINtKv6X2aIn0ProsepJPko2E0XwqRkVZRiF1FDzIuS4qG0nvUTBt4keAVT8A5ZrIcYRu7lvxo pZbupAQ6iBYzJR3yO3kSL8JbtfSW0KDxSTnSX9g+8Q1pNv2WFfHD4lP0NnWzFJFC10lrpU3SZoqm U0JSz8vSYGkx3ppCjbSMrsQIVtP9dIDV85F8r3QTxlSHMayiZ+kt5oVBNeJENwm1f0N30256gQ7S h/QFYyyGDWKr2XvskIp69of2S2Ol2dISqqAJVEOrUZrE0lgpny5MF7YLH/T8KXRUSkbbtbScLqcr aD1toG30AX1EnzCB63gtnyJsJxuNpOk0G9LciDE9Tm/QEaZhQ9hwFmA3sCf5clHokb+rFCkeEhyj SP9W2gSZPkw7aD+9Q39Am99DpgJLhPKnsBnsKnY9u4Xdzh5mT7Kn2Amu4h8KgnCN+Kp4InRY0kn3 So+jXxvZyYmzrg86uAj6PEBfY36ZzMdK2Lvcy30CE6N6QqE8abS0SnpF+oDclI66I3GuraDxNA2j XkHX0XP0Kt49QL+nP9NfISWB6ZgJsnAyN5vEJrNlGMV2dpL1cDP0N5Qv4p38kOAVDojTxKd6doXi Q52hkyFJ2iYFpZeltxX9Fijf602hmdSCJSZr7Gn08wodo6/oB/ShZg6MdQyrwnzvRvtH2BmYk4Zf zZ/kEk6/G4Q3xETx7tCE0OLQ3aGd0hBpPGxLwKErkYbgGQ5rmkL1aPtaSPNBegKa2QnrOUzfMgtL ZjlsLJvK6lgjm8+WsBbWyq5gV0Kqj7Nd7Dl2mH3CvsXVUc3jIScvn8Ov5Rv5Lr6fH+bHBBIm4w7T KlwhbBR2Ce8IX4oG0SfmiOPFRnGFuFKFI5narHn7TMKZxT2ze+7teTmUFSoPXRpaG3oxdDj0uRQp 7ZW+wFE0B2Osp3kY41WY/w10C22BfTyBMX5Gx+kEdP4XyEJgWmbFiB2K3sow7vEY+TQcmebimc8W Qv6r2TbWyZ5n+9iL7A32FnuXfcpO4vIcz7PwjMAqmMLnYg738m08yD/C8wP/O67lPiFXyMOtohGz WSPciPncJXwqfCFyMV4cLE4WV4mvqQTVJao7VZtU+1Wvq75WG9QXh33EOQ8if9f7Nn9RLBYW0Vbc DgTha/4uL2JX8dPsUZ7EXkRvSbhv1fAyPgJno+dg5YspLmKT2qV28TgyRDTKbfB7uF+YJnqEKFqK 9UZ8Or+BN9Ij7Hk6zcfA0pYLB/hW3iBsEm8Ti9kHuF+8KBLXsx+plEpZMXT3HrVCQ35hh/h7uUWV RjijWsz10hrxuIoL78IPjmRceJNNZ92shpshrRH8FnIjb2DdiMdiBX4Ey9+NY+dQ8aiwjo/jn4C3 iDayFzHH52gRf479FnoZivV4Gathm4XBdDVrhTSG0UJ+O6XwFp4Ce55C/82uZfFYuaehm1Q+l0RB z+fQIV4Prb/DTDyLXQ07XUxrWTv5WA/bR2/zW6mANQsvnEnsGcTZmW7WIYyhDnZafEN8A4fv05Bk EixXgwP3Z7DpTejlVXIJHljNUFJx3OOwnhqx1o38B3YlX0QL2N3CV+xhXkrV1Cy08Up2Z+gHsVTI g8T2wJuUqYdpSFWkShKHQOPHqRjWOI9IPV88orpWTgvvCaekeskValBFhz6llZDOGHi3tVhLY+hj Zmaz2ERR4lWiJE2lbXyH+KmUwKKYi/4gYYWFnmZFLFVyslYpkk2Ehc+S/68Xca14vbhMvBJ702l4 zRvoNrqXXsJu8hD2rXTI8SJIcwZ8zwLsETmUS/mYXTGNglfq/XZ/KvxpI7zkXPoVtcLz3kdPUgd2 qCrIYxbem0sLwW/DDnUFXY31v4bWwQfcSY/QH/gTfAvuuDfyV/hyvoA+po+F14QAm0qHxJvEVTQZ d+CJLBY9F0JLDry3TnoPvWWQDd5/CFYp7F46IR2WHus5iPYewdhvU4+iE+oyGkTV7EfRylTwb5Ch OE8l/wkkgio71BFdLGoXZ6QS5YRAOrUKiWcEgVu1ETLvGUaJmuorLN4JhlNF43uKJhh+LBpv6MGl vqinSKbBOXlGlzHNZXTNE+mMU9h3JqCi0+QU92E9nZA+55+rVNiJHFQdiDkc+UUk10ToyMBil1rR /LOBWD1ZI81PGYqZrjjpKVyjIljE83wsdocQm0AWr+HHmd3HjhmOHaOSkm5DNzOahuEzOAduUVCr 3SmedMGTP6QgL9ccHycoqHaDCxZ/1sMTjKYEnsaz3e6s5nTvyOJMGcTbeqY7rVYnf8QSmZKV5dad 0Yz0+opGZvqL5CvSe1JIOAyLi6fVHVphD3+c1KwxkMnVaoG/oI3S6+fFU1x8PMVriUUlRMZHkWBg fF6kzhhj0ImGqMg9mAXjj+1K0Caav9nD1GTBbQjyOzbecKob0zAUFRkgOGPCMHk2mM+wNdFZ3uir DPstzNAz0jQs20KGH07txyTzXfJ8MB0kmDLd/CGFwjU9jyTEmiyCEHpKY442WdTiIs+4ZKs1ecsN p1+3Gi0GnQn6PS59LhxXybtOGg1mawLlpkdT3qRv6dso0SomxXv907zNXBUZLVps0XGWdsvt7F7N vZEb07d4N/sfZw+mP8336vZE7fEe0L3pjV3BHnbxwXH+LumbTrs7uUv6Y2eOO2uP9EeKl/62y6gZ NChV5mUOStkjfUNp0ted6SkuVA6YvIMCGvfIjAx10shYVfZItR7XzI8ChowMs8EzUvjMOrLEXG3m 5i7WHYjMc440fOYbqU3MfaCf3E6N7z7VbTg1Ewh5Zf+ZSrpLupHoHpxTtiKQ4x9scxjjRU2yyRkg e5w1wLIifAHKUXkCzGFMCjBbPMCvyQ7QYBGgnFVluAaBhoYD60vQTDazlVrL5EugV/pyZ7KpBBP5 cmdCtBIHcsz6EpUFOZUFKSanmEXhxUWVxFtQPV7mxcu8eJnH+h+r65nZHFbpkIJCT/pZ241QFw7x uFPU8XHmvNyC2H5pIXbBpUe3bj166cIZmcPfv/OuQ8Mz9A8sW/rAluW/3pLw5OrVT25ftWo7X5v3 aOMdH398R8OjQ/KHTZzdfvBg++ya4V8t2rR54eyNG0MRSx566FeXPfYYPIARHmAvTuSZlMWeCXgL jDBBW7Gv0D/aNNZ6ka/SX2OqMTdYG3w1/r9lxngpM9OXxTj36wxd/KGAWb9ev0XPj+iZPsOo1xuM STqjyZ0hF0V7PHmZHk9GZpI706cVFJZanacsnCQt9yfGKiyzearJbI41JSWajCl2mTXGQY7Vjg0O 4R0Hc2TYHA67LSnFZrX6MjOTbdY4m81qMhqTuT8Oo0h1u3VaDbFkb0yWA0eILG2i3+exxnqsidy6 B8d1HysOxGV6bIEYbQkZWYzNYTtq+84m2rqY75kc7jH6PaY9rJiM0r6dRl2JsUvaFzCgboyRkbHa eNIoGUUj6u7Mrlhk6ZItEC6oFUqEDXb3JnvkZVzUDS8o2+NMxRFiSa9RZXmxiNdkWbxrrtpvIU14 MTPD9zNbs0/t78/4t7LK2xFwGzLBK8xkrj5X51IMKS+P9VpUnotdUCAIbkG4oufD1gdkBxF6VcZS 1vY3OWaPsntLFfZrDqvVsXXjl47P2JrQAdm5WEyxCcLXCbGxCadf6suzNXxOz33y3jENNlQPG7Jj V8xlcwO/25G5zfuq7pXID3Sq9Znt3vucm9K2eJ9KU1+RuiqtzbvMv163Pm5t6vo0zRRDs2GVrsXQ YmwxtcRGjHOOd41NrfLeEK3KjRnhHO4anlaSOcJbETPaoNFmJzrtLluaLdOW7Y7J9GpWGJ5PfS1b qHSOTVvuvMHZnnOH82Hn006NT2M3J+KumWTmGpWXsSRNjjNacA+KznWmJ2V4zOkeTXJS8uDcXLOG mzXutJgoR1R2VElUdVRD1JKoiKgudl0gw59GRoORxxg3GPcZ3zEeNX5nVButQ9IHJTMiA/HvsDUk 5o1b0WsT8EozW8P74czW8T3YpeDZoS8YA8ykW3HscO8JwwibluGHQ0V9seK0klN9pjhdZKzHm5YZ 5/ezNJ3bz3ymDD+lRnr8jM55KGqdyVpbW2cipBn7lKw4DMWRnFV0rCu3sKAgH34DO3GukkKSUaus X26475WHr1tZ83BTzzo5/wrLaKgeWX77r0M72eMTLy+uv39t6N3aXnU/vfLehuzNs2rXzpZVzgvc 9oWF1defMY9ZOCxwebH8lw7piHiRuB0nnyOBy/1xLJtKcIYTVOZ489SE5rhLzAuyWuLazC2WXQm6 QntBzjjzuIKLEy7OX5gwP/96+z3ZurzBMU5bCq5EmmhzQmGu050coyfBFOne5TWlFUauFZPTvIWC yL3aaI+m0eXxWIfbPDGDHYOzB5cMFgcnDlvTTwnju6GB8T09svhLZMn3Sj9hWO9BoVcHiI04M1BV MHJyVTB14nT4djt2MmMcydtVkvTN02Zzgt1iDu8B9fIWgJUeds69DjsdjzslQi0/YBFcc2Gf70Z5 epaQnz/EBI7woSzHhFhjAldNXXp709SAZ1S6nRl2LdpWY4w3mb2TDiy4eNaYWTflXn98zTuiY4Ss kq8cVouttrTe6/BPaKis2/h86MSshnizMSF7xky3bcy2W6dtu5Ipfy6rw9rLxtrLZ6aAtcGxRL1K LRgjo70mU1Jkit2R73Yn2QWtGn5tZ0xyiRwHfDGJJeqpHF44zprgjY1Nsg7JkgXKB3vz85Oy0v2U acjkmV6PJ8nv6GKLAkVWzjyR7lSPNZ88aclEkVYeqUnxxNjZSbtk5/ZSHO21rEa7VfuO9qj2O61K m+/xZJHf4Of+Lnhgc1paKpy0dlJstumk6TuTYEosGLdEOUXOLBrf3VMEh3lK9pyGma3dWErh1YN8 Edyq/MFq6cYxaOahorOJ8ApSsl5vX8FZPhQ8kxldYaUZ+zzg2VVj7DtKnasT5rAp/AZZZ2eaZFW0 KmtGaJM5PY8wv6XX/Vl4fsih+M3QrnPeMXRE5hwIVTUoJd/K2AAtbYGWlkJLQ+j7wKxGFYvRRnkN hiSty5acn5KSZMvzx+Q4cniOd8iQJD/cVoHstkyJ8V6jMSnR46MMQwbP8KalJflS3J7EIZSW6iFK hFa0iVyrGZLmT/OQz+Cr8Qk+Wd6+1FQ3MY8hxUM2p43X2Lba3lH2PZVtktFpYGRYbdhg+M4gGhLz f9zNNGQ568IgfENYH90Qv3xA7Sk6p4sLpU/9tTDzJ5TAZCWcvwn1qqDw53WwmTkVEdr6dBATmSzc Jwu+56rzlXDe/qTX/bQKoIMvsFV9BR046IOAP1vMUrmjnHpnnDM+256dXKzKi8qJy4kvsZckT1CV RQXiAvFV9uqk6uR4+W9eDwUiowoMUVEx0FmiQ8nbC8hud1BSooYreehMpeJQm8Uk59PjC4zx8SZj ksXhSTR5Ei2cezQxHq1WIx9XjNUGZkh0rjvStwaUK5TsrOSTRPfZzR7nfvplmZ+StKvP6sNsfmuv UHsWKfu9M3RU2Q5ul1EsPmM+f6eXSZbbathuHeTmokWBoXAt+bJrkQ0XW6wNruWTsCfJlz0J90Ta ZOcQo2VaK2wwOdaUmPLwin4Xxj/PhE3h0tjd33L+yZ4wHdwj/9Xa7Z0Oe59nyYZwplGewOuvK5P6 om8ybEKyNdERmnXBhLj8/4qKF2M+btzavwtYcP2xRSSTI9ZmcqTZ8m0Vtt1eXaYpvUv6NmBYZv2N ladrMjUbrXc4eJ8leMOW8NOaH4xV26t5n6J3NyWnmWJSS1J5aqoF6s9Ig9+0W7P9MANDYtaP57av vhPEePlAKZ8l5e/zAzGpgUhTSWpAGwOIjCmR7w3h2/YvNw3cZFpxrWn9F4uxT6bybuZOC58YcGAI XrgKIeEvt38yOreqZvjU0N9Z1MwHq564NvQ+Oxpaer71vH3TxGvThlpjaydfXjznftmO1kPuRYrc bwlkwgHmyw4QW1SBvEXB5+XLPi820VwA+0p0m3DWh2vTJHaxJc8YDMZk+X8oZksCToM9295oP2gX Y+wl9mp7g73Fvt6+w37ErrF/lfbSEuU7gtZTyqZxDGKUxXSBU/onF2W84JRs7HNM5xJ8w8fKyvmr jB+HHlNu3NvliZ6/cEJ/lM/O7Nehm5T4f7D3LeBRVGfD58zMzs5estnL7H2zO3vNbS8h2UAgkSyI iHIVQQGBGpIggZCEEECQYrT9lFKkiIiCN6pILSIiNyNSUT9EFIvUIkW0iBYvtWCpUuqnkPzvOTOb LAH869ev//98zxOP75z3XOacM+/tvO+ZYRMEeVsOHtINbCvKQ73xlNR1G9TrfBvibEQd9pVzLZZ5 rrnuVvE/XCvE+11Pq9eK61ybEtvVuwzPidtcL3j3G870smqxExdgdo1ppYu5Lb4k/lB8g+Hp+Gu9 3u31SS8hL9DGbEq5wgl/OBzwB/LMORZ7fm8/6p2P2RK9Jtq7DR9PTcCL85C2xM/qNH6yTzTBPpFf rtfniQ8b/Tlq0pCFJMmfyrJVZvtxwl/pH+n/kf8x/7P+3f4P/YLfVWb/RZGfJ+2N/GP8bv5DnuOd fQpe7HK9cOHw85+OkEMi2Z5BXE4D88QkwCoraLxulo856DlHNyEFf8yp+GO7kbrjG5TsOI1KAZwd Z7aahbigeGPgiimumwhdX0Re6GLpeJm0gHc8yV+qxNPAVDuRYnDSlA1HdtDS3GYjtE0Oq/uw454/ +MCG43/ot3hka+uU5ySN0a41VD886rEtTYSTr5X/9Jrnbxkxr3nmi9Xz16xuXLAj27j4qql9tQ6z SZvtKnik+vwhIgX4cZNxZPnoYdNupHvO08D7ocD7AnR6u18Lymtt6zibigLyuvWD8Hu5x33H/X8J f5GrDllzbYOk4eHhuWOlSeEJudOzpzvrwj9z6m1tHV+lZlvE8ZYbrDPCU3PPulS8y2m0usAlMIdd S4wPGVc57nc9aX0S+gYjZlO2U3RTb9rpsRNP2qRDi03+fLVuK8d7Hrf7gzpDuTB+rQ8v973sY3yu qOiPkOh4bQRnR3yR5RE24izcsywjsAHOnpIDGxLpniLMPHVCcaq7HGp6DgccIFYGhKGw012Wz+Ui XUcYnX5yMIBKk+A5s6+RvRxTH5l/duWLrx7eMGX/aKvRZK99Yt/+9u+wbv8rbJaH8OEln8vuvrr1 iweeODRklGg3FQ6cgdnX92M9+QZ9EVD7afJmEej90Y5rCqYVMMREb0oZkAqrEtRKBwSvg1QZ3Qm7 2+2wB7xaWyBPM0nbhqu35vmB3rg6JQX8ohfpdaKafCZh92mkVvLODWNXNOxvha27DS/dWljQmj4R mKXQ53yF7DJVgq906gT8f4bI+mUM8yQi9EM32xSZ32oQzAIR4qGb9Z1hSQGEJZKYuxO0IdLx2dag EHJ2akGn2QpSiSciD4S1pw165qERx8hCvOKj5t/Nn/+72R+souWmI/evOnJk1f1HuM++m0mk91f7 5h+fd+uHC/bho3Rj3bf2gw/WPvbHPwJtW4G2CZBkJ5LQwVSd1rbayhQzA5nRTDWzl9lredN51HzU +YH7T45PfN/aspyeAk+SKfNe6x7mm+ie4Gt01/sWuZe6V3tWe59XZc+x7fTsYfeY3/C84eWF10wu SUIYm3L8djXnN+n0Y1zlaxFuAg1qw5+k7AGpHJevFXGjuFt8W/xQ5ESnv2BjhogOP0UPY06dSJ8G 0sCb2pQ0MbfYRIh+Tm9ziz4v09ZxstOYQHSH/TZbtwBOlkykpnKr5mLnnrJ98uvJBwZYDEaHsejv dxxp/xBn7zuAtTc6373vvkMu/MgTr/cvyXaaTMbiG7H7jecx3/71HT/ftPEeIpk/bl/ELQLq5aIS 7E31ukpsEpkP/L8Pn/SfCH/nPxPiZ+TPjFUnqksWZC3Mn1WyNL+15JH8e0uezl9bstNrYAQisVOo EGtUKkETYJC3sJdDMtolmM/gva+XX9IW+tF9EbVQzvCYx3k5Epa0WiOEZJs1bLZmpOZHmmc1b0Nk 5iqN+1uDy4Nrg5uD3O7g28HjwdNBLuhMFlRdQFAq0cRPA6Emp+2VJ4jaV6bPM/p2E+QMSr+I3B1n kKvjzJYCobit45stXgG1QSkqFJEsX19CKmO2RFvHF2UZ/8n2G5emxdokqg2McnxfYifsKSWSzkBc XVJ8wZnoHa9R/yTkaJo4nDr8f7t2Xq7t7nef+e67Z969e/8997z55j337Gf2raFS/cKYgdHJebB3 O/CwawoGnHsB4+3bMWofuvKt39638re/BakbC77KTLAkZbg5FVvt+k5iOGzFNfwcfjleyazF65jN eCujfZJfr96m2q7eqz6i/tCldgkmO7Ut2aJPZMSJDlG0OwKm/ASp1EUnFkWjiaJAvlEr26QsnDVR k5Wl1QSM8i6uC09UdvGyYlIOliZ6lZYW9wqUYSnf4+fy8/KA3WWIUxu1gkZyfujAYMueSOn6Ib/U a3fR2xBBtuG/bO17dVXnWSVRBBpaK2aJpFOmyxql7hbqe5qe45krx5CvvDpe3uoOJXFbx/EtJlcS gXtKT7WMLrdKzYfdKqcPu9QeHyZfixTecQdIirnTwPEdZ7ZLep/otSknLUQGTMSQ2bp26k6/TN7N 1RfVKzKCR4+676YpP5s42ecEz/+vxMRN/smciQMS9ZmxIPViuc/Of3fj1Vf9YuT5f6SdN4a9aUFM mnf+ZLqC60/EBaRhN0jDfSANpUzbCygfHteWVZlPTlREPc1TI826ylss6y3MniQuEAvC8fyCZF5p 31Bl+Ir8yuR0cXpQN9WCg5beFqZQHJn/Xvi95MnwyeR34e+SQr9wv+T00PTSp8Wng3yoNAguI1V3 Xaeue4hwbEM+7PORSfXGSh89pgYvwjcx6PMFggEPBDMlVKqKigYni4pKkoFYstSkowMZElqDQacN mNxWUrZkO3wOxuFYLTocVjHgFi3RCKm/Oj9/Yjg/PxIORMOhcCgklSbF0tJkULSYLRIKigg8d0tp SFQFcaDc47GWu/lIebSkPBaLRhldudmEhHLMaEXicGoagzi4JhwaW7oTr0VhqMlqSrYmGSlZlLw5 ySaJ1Ob0sSBkBivVpGnVMEaNpCkChNgrXuPs/SJ+BCJPB67JOF0lsktOh+T3P+TQnUTLVKIhcD5V QV8I2vvezcUL6QsbS8ehrd6KSksb5J4+cu4slnN7jOZbxLxKpLyLuVv14z13G+KOQhV5+fZ9B/IX Kcbl+4LIX9RdbTBWVKTVx9JxfKsrlCTfbG7NNiUtRI0gJ4sCPcKZ3kAQvAFRCO8k/xy646ysMLMm kS0MekCvUUqvb7aGnUmp8+SSHB7jtI6UdCH4wnA6iLu/LcB412tdgd9ruLaQBoBZRLGq2tvwY1UE az9NasvbH8Bz25d06c25b3GUuHUEb/+yfXzna4PZoFEvgkaJoFEONCmVnGKdbf2JFTYp/TijMaCB UHAcBj/N7LDebzIFHEgjaBGWTEbjSONuI2t0Oq+7/YJjk8oLjw7Q95w9+dNPz9yLryWLP++gj3Tt VxBu+tJuUIbyw1rrYa03wt5dhu9O9XmXf1dg9vB7BOYJYQu/RWBnqVvVTLW6Rqhxsw+5n+SZ23xb 8TaG9fim+xiEOYbxwpPIu4LVZ2Wsg51Wq8MZMHffFWRlNSADNgxW9FXeFYwobAwz3baGrNLB8tZQ XF7G4534OJLAb7Xk+Dk17BJmCEo0Wsn1oRM7iaoZ6QaxvGgtbBBOsjt0ki+9N9CNofL8GVCjf2Yv +Nd2BtHtUQlqgRcY3qOCKNkt5Mi7QwHdHdxpj80nwq3HnnOLsnMwi778mDRpErZSTzdjhwhm7hDf s0HcOG7Z+JtHlt10NeH6R0QABt858/oFszL3B9rGTrl9/KB878+vOf/Xrv1h/G1X/sf5v3WWX5Al hEH3gm9cARKiQ3Y8JFVmtnE20W5j38Bv6N5l3lf9Uf2ujp+hrjMxtUwtVyfUaadn1ZtqLVPtgtXP Zvs1EJar9X5Ez+idlTQ32GmeyrKWbkbYiIrQzYhFbczdKYcZ4nBygp+CPo0Qir/NH+dP8yq+DX+8 1VHwTOfOD2p/6vykWWTTpd8ZnFIcYl2nm2YDN03sOLPNKBpE+86Oj8EWfbw1y2vydnlkk4iBIa+/ UzqbaHRXiuRiIkGsJdtbqRPhImjhoiYXE3nFnwN7oVrUmaERLjbRZO8vkotFzBZJjz0pMyBaLWxj ArkwbLavgnxGeuF/47GIurzwzFimov3Uq3vav8TmPa9iy9iP1q79iAB+9uX209i0+2Vsaj/9yqPH Pnzk4eMfAm9i4HkT7SVfPcRSlb202X1zAUpj1+GxzKSsGgw84WdkteDbCprjuv/kX9a+p35PczT3 vV6f8p9oBScbZW9TL2VXsxtZ3uahKutM5DidnpyAzZpNy+Z9BrM52xCwhn2kPCCQ8AYCPm8gjLPy E9nlVk85SKoh4ddp8/34Pk6NfOVhPuLPFrDgKokig+TNzhmZ86Ocxhwux1k8OSP0ppte+kTwVAV1 wS/lgX//6V9mEJSnL9pJfncDuF6oz5Iw4Xqvjj8+lxvs5DnlOAngrYobRhiRe1mVymANLhi6cc7C d2a3n//NR0vfoirVmPEK5ZHfP7j60KHVDxxip6y+aWLL283b2zueb+eJPtGDtHK6VdTd+/bB5fce fJucnoDlncDOA8tgTYkLDTiqGamdbp5v/pl5Ff+IRe2RnWbfPsUHclt3MpvAZUilNIprUxgmPUbm jQjl5YVDgUKdQaT/rFmlzsIWJBqM2lC4HBXy2kojGE7waIhj49Zmq0+rGbUrhkQplB0cFZTDpdNB PuiMnl/WZTzlw2z5LJuci1TQTwAIa0z0nKtv33/y8P57DSawz6Swb7tFNNjMHtkc4lkKh9IvJGXT d5nzXYZZ98RVQ+9wWrQGSzDp7PPQbtxCN8CZ5Jh8/0Pkyk45tHJsrcviVFuCrnFPtycpa8wmO7NL 8YTf7viQbQdtGoT/llosVnoGMOZhaDyqG7RR2tjnl2VvWd4YeMxy2Ha4//sD/2I5kfx84DnLmeQ3 A806C29T9dcM9FmsNmt/98CfB+5Pvpitu9EyoayubHr5grJF5T8r+1n5k+IWUbusfLuPuU4ozA9G eqWuqEi6HNkGtVXfFyWLi4JcvHe2Qc9qEWtyll9xhd/kv1Lbhku3sVIcx9vwqpQn0tvvR+XqsX39 I70/8jZ6Wa9rcK8xwfJ8qz9FLKoNbGdqfGM+zndedaWa5SNav26ycpJDYqRKTF8kn8GFp4znT1Dl I++TCY8nkTczpr4J5SDTpBxmyidhfcn5F2xuZX0GmiVP2BK297f6ULm7rw/3keBiHghFW6XDh+yO /lf0y6mAfc9VXlHm6+1D4gAT2QALySYsX5TPhOh+mOb+tnIxqfXs6vgM2TtOokHgDPYX+4DJ3Rqw VXi6omj6wdIk6gCXgT3WZNkqy0W4lBHr7DBaoQSXQcQcDxLBAA8SIZDwkHGAMqTT82QTEsklwxzD TnCp199W2OhIkoUwV5S/Skt/xmSnxyqlydxIKCIfybILZZ+QnPSVjb77nhHlg4vuenZQ1Y8OvP76 7YI1i5gCs9MeXN24bu11o9tfXzzs0H2b2MIckNTlXpfNWZFb1rewtCLPk21xBBcOmfGr2oBocHmf AfG1xn1FlQsGjUgkpOS0ivrbie+2Anbmcm4FiqI3UqHv3DjL7XIz67Tbta9qf689oVXNNdxluN+w 3rBXd1jH2wWsJhaEg6DfKnCcWghgo6ixmrKNJrOocurz2/ATKZO3PBRSl2OMeL3fqRMXc2341ykx GoWIPOLfizxGj+Rp8uz2qGC3+GRrDHZkshufqCDxyxl6QAUWvMJ4/pR8dEokqJvBBikyuNxanc6l 8SGtW+9DxDlSvv6YhNMabhK7H1pFSju9e4UF4BrS92LtZXNmjd3bR8wyOrKkf8y6b9NDpPYhwgx2 ClHu87+7ZkqJlOU0ZWf5hy+ZwyRIJX2/Teh4E9BxPDsF5YIl1mu57TYmz4ZdQraGWmB9QtDrNUIg Wz5a1blHKEeruX5SjqEQDg2WQiG/FMjFtmxR8pejXK3dUe7zerMFTbkxmxf9rE6SELLbiL+qyTea JOFtNVaT44y87scZFeQVTiW1t0b68aRiefv+Uw5q2tymtDhFjK10waGF2cLxqrCFM/mQmRdlystq aFHU8DfICupng43T3PGxcoZIXzrkZpCf8qZPVzH9zuGujftuS10vx1PTRvz2acqGv1KX87aHrxw3 h/FSZtwzevouGT33lV2JQ+5lfFwFMxtlIVdKrw4hnSubcxpG3UH2oxPGT1FiOPh3+II3vhx3jgZw LPmohPF1vdVl0FbmY/ZvEIFpkAUNSuXoGDfDsFlYberQarH+JouuRfu15agVt6Cvgclfbxcxqt7l AAuJjWdJ/E2+f0P0kwDY5kioZSmxKEagC9t69GmN1+Zx/hzyHFuOk/us/Tq73urNw39UEFjJ+8zH nFNZSWXKKJgxZyCL0Lbovja9oofJU9lW1IK/Vr/CHIVlvP60vIwz5BzgLFwyl1GClZc9Gdjy99rf d3itXg0z8b32D5w5Nq8WFhLM84pZdvysggCFcZi5h9lPV9IvZY+ihbA4NbcDa15h0Bb8dTbjYxim DTds1WK07gWcg+R1nJ8k0+KU8iGyv3PineCL/sEdcQZZ7rPzR4qDTq0ekR+5kdO9PyD9ncHdExvk /NxH3EeqbfxcktRmmhbISeitpC2XS5rNms3aW3RW3TbdNv3SrPtIyq7IXpG9wviEaZZ5pHmkxSE2 WUXr4f916bz1vG2g7W5IO3tST+pJPakn9aSe1JN6Uk/qST2pJ/WkntSTelJP6kk9qSf1pJ5kI3+f oB/zEkr/KP50+UeT6I9F2miJ4Awy4CKU/ksGE3B/Becy+qiQAz+o4Dzy4M0KrkZ7O/sIqAitV3AN 9HlLwbOYNfjzzt+3L+XuVHCMdNzzCs4gtcql4CyKqfwKzmX0USG9aoSC88igmqDgalTd2UdADu5d BddAn2kKnoWHq+aSv8zAsTCXnv9PipPfzDHyv6c4T+v/RHE1rf8rxQWKd1Bco9BQxmUayrhMQxmX aSjjXEYfmYYyLtNQxmUayrhMQxmXaSjjMg0Jrs1Yv46sTZ1NcX1GvYHgah/FjWRt6gTFLYCb1VdQ XMzob6XPKOO2jHonvXckxd10LnnMnIw+vgw8RPtPongBxWdQPEbx+QQXMtYvZMylz6jXp5/l10hC xUCRItQbsDFoGqqFfDhqRA0ALWg+aqI1V0KpGXByrYL6OtojDi0DUD0kCY2Gulvg/hY0m5ZqIa+F 3nPhWgM9yQhzoFxHayU0AvJ5kNfR/lUALXTsGqifCXkzmgF1jWjqf2NdZNQGOqJ831go1UGJrERC 1wNWRUvyzA1Qm6AjSHTsacoKq+mKG+i66mjvOH2uW6C2nq6w+3r6XeYp+1EqNMMI6fWVwFi9gOoS yoNR6mCuZmiZTZ+3BeWjG7r1L4X+hEsXji+PPgqeiPy+4xBom0fXRZ5yKLS1QKqnPcfT+yRK2fmQ z6HckSkkc2AqnamFUoSUm+h9Mynd0pSbQu9NU/UqoOsw4L98b3NGSxN9mhqYpZqOKHNjHp2rGq6X nlcuk77VsOo5VBJqaN9GuNbQ9iZK+fmdfJPnqlNGqFbGqqVXIp3SRU9OetRTLA/uy4ecyNuUzrku ta6Gi8b+56nUNXoNHekWqGum0iTLVXWn1F766bsk+cJ1lWfQgDyJ/CwtdL60PpDx5WetobJBnryR 6tiln1SmdNUFVK1V9KK7dhCqttC/1tJCx68FGSdPU9s5DulJ/p7L9/Lo11JxUVFvacy0Wml4Y0Nj y/ymWunKxuamxuaqlrrGhrg0oL5eGl13y7SW2dLo2tm1zXNra+JXNs5prqttlkbUzpPqZktVUktz VU3tzKrmGVLj1MuOJdU1SC3QNrahrqW2Rrq+paqlFm5uqEk0NkuN0NIsVTfOaWiBoWfHR9feMqe+ qjk9Tr+MKfvNrW2eTcYrifcqkvKG11U3N85unNqSf4NSXxovKlL6Q/dR1w8fM6RxXlVzjTS0tqWl vrZ5fOMcaWbVfGnO7FpYEDzA1MaGFqlqttRU2zyzroUsbsp8utSrxg4bAK3NtNDU3Fgzp7qFPMa8 aXXV0zLuhbyuobp+Tg3c2tIo1dTNbqqHCeDZ4K466FANvWobWuKSlJ68saF+vpRXly/VzpxC7uoa qyHd+5JLot1r6hpukZprZwOtqglpM6anRFbGKqcryKuDWVpqZxI+NNfBrDWN8xrqG6syJ4VFV8lL BRp3sqNxTkvTnBappnZuXXUt6TOttr6p2xOBEWykKlgFwtYAwt5IFBBngYBNh/KfqYFOt8umnygN NZPsGvY59jfsboAX2J3sxoyxSO+6zvJHdOzaC+aqvWA0Oh7n5XpxQ7mruSvg2hd6V4FSEHWTN4lp eDP+JfhrxAgMgP7NyvZSlfYZ4b/2IP39zUv9rSIWEU8phHBHh/wXsBD5R7yDqG83Ga6Hoe4PkFh0 hFmKMHMPsxqxzBpmDeAPMQ8B/jDzMOCPMI8C/hj5SSbmb8w3gP8Xq0KY5Vk1YlmBFQDXsOBlsVpW D3gWa0IMa2ZtUGNn7VDjYF2Au1k34B7WA3gO2xvwPuxg6Hk1OxRqhrG3Ab6Q/THUL2JvB7yVPQP4 39lzgJ/nyB+8whz5Fx8s8eg4LfGvuCzwlFjOxtkBd3AwC+fmPIDncEHAQ1wE8FwOfC2uiOsFeDGX BLyU6w14Hw78Lq4/lwJ8AHcN4NdyQwEfxo0AfCQ3EvBR3I0w4zhuKuC3cPWAz+Rug9aF3O2At3K/ BPxxVS7CqjxVIWJVUX4AwvxAfghi+Wv4awEfyl8P+Bh+DOBj+XGAj+fBB+br+OmI4Wfw4I/x9Xw9 4DP5mYA38HMBn8fPgz638rdCzXy+FfA7+Duh/if8LwBfzj8A9Q8Kb4LHtl/4M2KFL3RZCOsMOqC5 zq6D9ejydAWAF+p6AV6sK0GMLqm7GvAhOlib7hrdMMCH68CT1I3SjQL8Ot11gI/WXQ/4GN14wCfo h4LnN0w/HDH6EXri53OKpBHQgrocQmxVc9UUJE6rndKMiuurWhpQf2jBY0cPkpCIEEgeI8sqxcgI 9K+WQYn8RD54wsPGDJGQbfTI4RLy0Hp0wVVFjDSS6LWAXpMzZ8ycgSbQ65TO2Im5ADOBZ8+DFy+Q v+uJdCD3WciAsmE+EzIjC6zMSrWApauRcy+sfDCo4A2gG+T3ROeiRfSXeFehR9FG9BJ6Cx1Dn6Iv 0Vmsx1GcxBV4EB6Gx+CJuAbXy1TBvWEcDPk3MD/keglWAbmhQs6NcjyFjU/J/UwpWCHkZhHKashT cr35ZiV/R87FnbQfZ6+3t9pX2p+iJd5xzPGVk3e6nHHnQLnd9arrsOsLV7vc7t7s3uM+4j7pQR5R HidnpZx7W+XcN4H2FKSkNESaLLVIS6S10g7pLVqbFdoVOhg6EfomrA9L4WR4SHhiuCn80/CD4Y3y qiM15Ar5Enm0yAo5z62X8/wFcl6wWe4XfUnJ91JJwNF2yEnf4u9K/v2J/lY7sV6I2i2BWiwtWCkL 0lELlMXxEHGaQY/zkIVqsAi6OxK5+dGgwRLo7g0owI8DDQ6BnllRGLTkBhTTjQNdKUJYM0jzOImR wKoWIxQdDAAaFj8A+WiAcYAfghzsbrQGYC7AYoCXECoCSxg/CniT0t4PIKUAxLYlAyFfCLAMYCXA nQBrANYCrFfyjQBbANpgrOOQ7wEA6xD/FPKDkJ+EcZ4CGAIwAgD2jBKI1ktuhnwqQD3AJoBtADsB XgbYy7ij+nhe7NHE1GgoHqdQEE9FCxLN0YHxmsStiUUxIf5t9Fj825grPplAtD5+Z/RmCiujNyd+ Gt0Wf4lArDj+JQVDfHJiidw3FgH4NP5x7FBiYNQLYxNwKLAJ7iNgjvcDSMaOQ7+j0G8C3L8c5jFD H3N6PfFhsJ7JiVvjNbENMOYuaC+KD6YwBOpXQbk34ARGQPnhC9a5GNb5eEZ5GYVmwKdSWBZ9B2BR fCOFn8Y3xnZA/hSs7SlljS8D7I3vUeBNCm8BTuAdwN+hdR9QOAb4sYzyCcAJnP6/wLH45wq8CfO+ Gb0VcALnAN9Ex5D5APSNifB8J2BNx4DuCl9i0W70vyFhjk0EaEl4Ywug/GiiiMK6+JsJGD+2IdE7 uimxKTpGpl9scyYk9Onnj32aGEL4B/kIykdZLrYBTwZTOKasS4L7ADr5K/O1XycfM+m5qWvcaEV8 cGJnBt+685HwXub/dJj3ZeD5aApj4k2JvVDu3v/i+8eBPL8F98+F+98Bmt6pwDIFLix3yckaCqTc TMtrAdZn9geZzey/nvZfArJDYHl8iwJtFJYosAraVtF2uf7h+MbEESg/DvnDSn4M8p1Ap52K7L2s 0O77IN1P0cdO+TwSPwhwOEN+D1Pokt/DFPbGP6ZwDPoTSMvvFyB7X2TI6Vkqk5/HGMDPUbm9kP8n qEwMpjIJsnhR+xeAg02htiFC26kcd8qzIOMgz2codLcraTnvD+UTUAY88QWUB0H5NGlPoFhx4mzM kNAnliTO0b5lAGl7BHgRA+Vr45OLBFJO8EVMgo+5EvpYBKAsgYqYIoPcn5SV/qOgP+hdbErCXOQC vWoFvVoB5WlQlqB8F5QfhHIDlCNQXprwFpVRPXSAHjpAD0OxBYkCWe+KoiC/CxN7i4pB13pHn0ps iu1I9I4dgHxDoqKrHewvrYdyl71aA3K3hthACq/CXF16ayZwkWxsujTE9nWDAwqkdf4k5F9Rm1yT WA5rSff7NJ6C9jHQbwLkN8e+AfoRaJchQ7YOXiBbJ6BMIG3bgG8gs2eoXSqT+VR8pHgV0QeqE+m9 5QA82w7ghZJHC0oiFAYmFiVWgW3vDfaBwIiSKOhQjWwzSoqprVqVWAT2Yli0CMpjoAw0LSmLDysp 6yxvu6g/sUnLQY7Te9FUhfaXtBGwBy4p6Q8wqOTaklGQ39BJ9+57xDlZd9I6VTIl/jmFiYBP7GpX 8It1q1v5UrpAIa0LRA+oLpRMSywpaShpTRRRaIH5FsAecOGe8G1sR8ldsQMld6XpUrI00btkRRGh 6eSSdQAPQvnRrnL3PabT9nS3Qcrz/5s9NAbZmb9CDIsg9oQSWwIRqI29A2JMF0R516Fl3BiI9Zar oqon0ErVetWvsV61SbUHG1V7VXtxrmofj3EeLECFp/ACn4VreCNvw9N5B+/Cs3gP78EtvJfvg+fw /fhK/AuI8mrw/fxUfhr+pXaWdhZeB3GZFz+pu0m3Dz8DMcJmxtDlLwZsAB6EQ49CHgDIA3wd5HGA JAD4k4FxAOADRiCWCG0APKW0awGMCoDvmG+GfBgA+JIB8DUD4H8GwI8MgH8ZmKvk4E8GwI8MLIax NkMOfmUA4v7QDsjXQr4LxrkVwAHgBQgBFIBPXwR5b4AKgEUAPwVYArAcYBXEVhGgdD80COKocRCd 1UMU1YqWoJUQQz2FtqBdaC86iJjIuVwhl8mF58/VRtpzjbkcYPrImVxz5FvAmMgXuYbIaej3Ta4W Wm2AfRk5nGvOdQB2IvJW5FzkHcCORl6Fu7VwBx9pi3weeYneuynyReQstLZH1kUORTYA9m1kTeRw 5GPAzkaWR16OrALsq8hdcPcBwFbC2BsjEFtHlsCdmyI7AWuNTIs8GGkAbG5kMty9/t8umyw950B8 I0T/Ao25jSAjZrwQIiU92okKEfJ9BQAr8LUjJEHcKgHfJeC5BPIigYxIwOPgx5B75DYf+P6+kzJI IF+RLyHPAwAZkUB2JJAdCeRKAlmRRis5yJgEciOB3EggJxLIiwSykgvxQuQMwLeAQwibywOAnAFH UO4EAIgjciGOgNgP5TajwvC68Ibw5vCO8K7wq+F94QPhQ+Gj4ePhT8Mn4boj/FVkLvT4JtweXhfh yBWgPbw5oo0YIzaANyMLI3dGFkeWAXfWRA4C9z6IfBz5nPyaPnAB6MCcYf6OGOYfwBGOcoSnHBGA I2akoRzRUo5kU44YKUdMwJERyEE54uFvAI54gRdm5NOJwJEQ5UiEciT//+FMGPRlGuVyAVIDtUET JYjuJIjqJIjuJIjsJIjswhGkDu0NvRV6J3QkdCx0Iuwib2iZr5mvYY1nmbMIsxaQRoYfCVLHgryN RRyVN5XOorMg/gf3HgKRufQ/EHUbmHuY+2HWB5jVSEPPFfX0XCtLeEt4GxmE3wnvILNwWDiMROGI 8B6yCu8L7yO78JHwEXIIJ4RPkFP4XPgcuemJloeeU/mAXpvQNko1MzlTAZs5PBAI5AXigWSgX2Bl IBUYHBgG19GBcf51gcmBmsD0QFNgbmCh/4D/QOBO/+bAYv9mSO2BNYFxgWWBtdBztH8dpM0yBOT/ MkfsGq+GjEVGyhhnJbSPA2wF1Ky4MJHTDgasDuKZtcxvgBavMK8hL/M68ykK8gv4BehKskOgQTqf LoKuome15LcAzMpJm63zfg7uh12BWc/sRCpmF4zlovfAzoFcKEDpQd7gopAeYCrC0iJyIkZPcGEM mINIW6qLbtLNyCJNgPSOdATgGEmhVkjXhkaFbghNDE0JTQs1hFpCC+gaHoSxNcyvmF/BGp5hYBdj nmWehfG3MFsQy2xntsMKX4RVqeDZ9iGBPpWWrlAH1mwx3kd3vNHkb2JQ6/TfBxx8Ew33rYW0HmAj xeSUiV+qTNKWbvVbLtGHpLbL1P/Q9H1r7L6+y63lUutZ/8PXAhzQUi1EVAsx1UKGaiFPtVCgWqih WqijWqinWpgFWvhnlP1PSzFmBjMrQJb14AO4EMoBm5MB6BJwufrL9c0ci/Efp/nwnKUXpQ2Q0vhm SBf3WJqzAtLSnB05xy/ZKqddOZ/C9UFIF9a/mnOgE9+XczKj5Sta8833jJm5qgM57XA9RK//evr+ p5afV57x6AUrWdrtGTOf7oc+17+ciL3o3D8eANuzGnYRrbBf2A+yeVA4CLL5rvAuyOYHwnHYS/4k /AlZ6D4h6obrhiO7bqRuJHLQPcP5g+zvOIBRAA3UAtsR+UZpHVoGpQrFKttpvz0A5M8+H+3qh43o WyiJnf2IBX4IdA28PHl+OpuXzka+1RGoDiKqgxzVQZ7qoJrqoIbqoJbqoI7uhFn/wyMRaiBKDRWl Rvj/80iEruRdAVgndIjS0EHryBdr5J1De1cd5mU+YU9GnZdyCeNkRl1vmU94WEbdGMoljKcrdQzS /UuyRqTMcVne/B/qrgMuiiTrV3dNNUgTJIoSBFRUBO0BFFTMmEURUFlBlKQgCgiIii4KJswYUMFE MKOYc0RRkcWMrmLAVYzrGjErfFVvhnHccLu33915R//mP69fV70KXf9X9Xq6GwEsIbDEgSUeLGGw pAk2avxhbhn7X920ZvNp/TiomQDlafxhDszP5VOVbcFQT9kfnqN/Ju0/rsnv5fhrLWcMy0BT4Hwq mFMbzrqCcxxlX7WOp2u/pXA+1dNlK84m2qvU/et49Y/5q370t63/a0dZm0qUY17Rpjqge4luwJhX 03FaqEKtjxQ6Z+WYV9f1Uo55dd1w5Ziv1v17R/y/bsz+//j03zriObQbFcNanJ0dZEpjbVMaaxsf Rh5GJ/9bN9ZmzUual2jr7mjeoa17oPkA8X99VYi2o/1f4hRDumqrNQF5GF6h2w2GtXxAVn0rj9xQ 2/vV9iWlUUfFRy2f6riavd/aUtMY7f96YxzV/FGz9O+20KASPh4miXSbQrdEQwNDA7ZneBVwCKCk +FbKdDOZWb3PcihSfkmj2qYYFldb/GKvOh3YUbNgkmhQYVBhmPj1Bi0s0bz/T6yPeK4+RN+blJ7E jOowl80t5+zp/lJ1La/J8xyLgJO/0kbyYdw7BO9+VdOW8Gf5ALrfX12LW2Fnnq2z2n+lzcQZ2I7u 26lpeRnCqWoezkytbQZ8Np9D27aGX0u97gZ+A+X1Jn4TjVW38ltpy/fye5EGbXk+0uQLaPtr8Of4 89Q/XuQvIR3+Mn8Z6fFX+auoJl/KlyJ9/jZ/m9q8yzOfaCVaUZ9YT6yHjMUGYgM48//Ia/xn68Ii 9zmA879h2enfpOz537DsBd+w7EXfsOy0b1h2OngnR+aHuOq71cxBZ0d9Foeef6Wzgbjhxle6Ohxb RRZ+pTPgtOnezq90Why7uynzKx2PPtG92eo6GgtWqK3rzJXruidq6zqF7jEqV1vXKXR3YP3n9pWu FGKiRl/pLsI6wkilY56ceRwE6xAO1iE8rEMwXYfcoqvh23Q1ovEVQ1QjVvPGV6OX4UI1vUIu+TLK 2BpHddbnqMnzv8jqaZR509RsKuSbX40e1q5GyIaiCbszEFpm8SUdbQVLtx0pro1ySAux/72spdr/ ahbWLUdIzxV5iJH/rZtapPAX1xnceu4pXE+Noe2my3PE6eqqPmz/1x+Fnlf7+P9qP0glc7ph9BMJ 3wqdJvLQkr7hduublv63t39ZjPVXV593OBMY910QPdvaTenHGaEa0b//0dZSyr5fPtomyEOzy9/f tNH/J/efbX8zrv9bnNLIQ5xGourD9n/9+Vo/5LdpNOt8SUvl6k+1zkO48V+83VF+/su2/zin2P3O H9RiCfbrnGZl9Ody9e2fmHXZCoMDlrJ5rLDKtXpe4wOJMaAlxRDAWCKBzIG+EcXhoPdlT+TyNjIP 0DekGE6CKbaXBVLcLesFej2WV9aXor/MC46yNCPhqJ9sERxlsovMD+RyJoN9L0jpp0zPjh7DGylK 7ClfXhKOgfwc5ACGuIShzBWwAI7S2mJtpsfasuUMyWxABMiuxx7DSxnKhoDsDPgJNMzCQbDmy3Jx FaSQyUrNWIq2TEP1N5gMpdtCLlsSAjgbkN2XH8COcgGsDhQLABUllkBZrgwh5THZG5DHAkINofRj LC/vDvbdWV7eHc6FO+S9DSlTQbZX4nLQM5upYGE1yaQ4gSE/RTaZohVgArlD8R3JobiVfKY9E03o +OBnsn7GJYI9Q9bPVE5leqahR1nPa0KrDwLOhLrNVMhQt5nQAzP59dAzQ6A3oJ5Mw6XiaKhzAcgl IG8FWZvVH9LYg7XBVXJANsZiqlpSjK/yphhWxc67V9UGik+rlrEzzkYyv+hzKZMZog+V7LrsBxjh hSAXVrL132KGvAHTc3lMzxtU7gZ8yM6pUsNqFfOZjlJOlx3lYiC9bmU0YFumAb095PWF0n0hry8r nTumrAP733fHIG8AlP4BSj8I9lPBzjEoxR7SpCpSQp0/VG5iemiRgQJZeioz7pRCiQaQxpQhbwt2 AiqhDxmiD6BJZbXiUplMbbL/634femMjWNMEOyGkNvQMS1kBZ6SHssdYDW/DmaqAM1gBo6sCxpWu or2KEQ6ttgcLxZCyB/RPBRuHaDa011RhHxjky7jDmcLRQjZu0Q1mk5a4CWpbCvrloM9k13CYHu2E kXyWnKIWJpNdFBuzcUtbWgothRHIxipif1zVcsCtsIZ3BLkAZEWMBZFM1XCeWqiqCfJVhjSCY3IK YJwiV9VbigJLWQlXnrjVYEERR32ANL0Y0hqg6riJ9h3zBr6geQ14BPLGgLwZ8BpoJoCsiAYVcd06 wO2A5wAvQspUwNugWQwIcSVnCvJjwB0MecX1rUNKmUYnuDP08Elgt3NVf5prL0Oq9wS9EZNlhUwW bEBzmPkElgadlNGojDf/fBLkXiwvk6kFGtvyPwm+gO0ZsjOLTZiHxFbseTOKvswOS4+XMuRDhD6A O2DsFYK8mvUVeJjewgSm0agFHp55HndBlx3V8AX9eUCQhWLwh2NBTgVrMLrAgrtScwOOgs3PbJYJ qYygmPGZ+dX4z3vYLPP5NBxlcneZN8xBlTAHbYa5iXF8PqHzJz+xagXFprLXYLkN5F0I9oeyo8Ia ZkFg1uIBdwlJbO4DfQjIXqyHeS9iA7PbBbBfClgIJb4GPMKOsrsk+HjCau4n9ATsSNFQuM4sCMbA WfAJwNZM4KMEDE2q1KfYHrAYZitD5rvQj+DBjrF5iiKL/Z6DT5gNdg4yP0xnOoaaDFEhMCuAMRp9 AF4HsB6mMpunDNmIoqWy8S/AmO+m4JQyanZgfIfxGQB4DNJYwZi0BXQHPVxfVVw1of6IpZkLmMCQ 1oBhOeBBsNyNWUaoygRKOQxIVwtVAZWPGIKdIsB8wKeIrkNoHiZvAQvtADcq/ARizxRO4yKR+jOF 3eCZwv6qZwot4blA9l9jBboq00P69IgMdGyNpoFq0DVVTWSARERUTxrycC3h62cNLdWeMuRohKD4 1kWGwcEjo1EcYALgpJAR4cNQytDwyEA0F3BReGR4HMoAzAyPjRqB1gJuogkD0XbAvSOigkegw4AF gEUjQ0PC0XnAKzHM5g3AO9B2XoU8PLOIYHXIkKihhhrK1FBUQ6zsSwQrTIaCGmoqUZf2gC1qilr8 7lOPinzRyu94xXN8aLZi1cr5U6xBv+OV36mKb+Gi4lvLnqan3zonFfl0nyiffsxT6PWVTyPqK58T 1Gf/BoCePXjClENx7J5BJNPQ1tDR0NXQg9+W3jPvztXlrODJwWPUiimyQfa09u1RD+RDa8xYIsMG 7E5NkLqqpG4qqbtK6qGSeoIk0BKNUB1kRfvEHqy8AAsvIfcryFkBuV5DjjfszTd0lJnSXqyPaSTB v8O1IFcdyGUC6Wuz9CwqQNrYGOwYQV72q+ELWirCGlgDacCdmJoQdWJhkjCRhxGLFS//0cJasIbW hn6gKfAjwQgvZCkEE8GE0qCOQCNKdv85S8H1R+uxJbbC9XEjbI+bYkfcAifjKXgaTsEz8Vycihfh xTgDr8TZeC3eiDfhPLwVb8e78X58GB/DJ3ERPosv4iu4FN/Cd/B9/Bg/wU/xc/xS1lfWjziQZkRO nEhz4kJakjakA+lMupO+xIP0I9+RQSSQhJJwMpJEkVEklowmY8g4Mp58TyaSJDKZTCXTyQwyi8wh 88hCsoQsI6tIDllHtpAdZA85QI6QfHKcnCCF5Ay5QC6Ta+Qm+YncI4/IL+QFeU3ek88CJxChhqAj 6AvGQl3BWqgnNBAaCo2FJoKD0EyQC80FF6G10EZoJwwUAoQgIUw0FeuI5qK/OEQMEcPEEWK0GCeO FSeIk8Qp4jRxpjhXXCAuFjPElWK2uFbcKOaJ28Xd4n7xsHhMLBDZL57rsQW2oGejLq5Lz0Y9XA/x uCFuSM9GE9yEjiIH7IAIlmM5EnBz3Jye0ySchDTxZDwZ1cBT8VSkhafj6UjEM/AMOhrm4DlIB8/D 85AuXkjPph5Ow2moJk7H6Ugfr8ArkAHOwlnIEK/Ba5AR3oA3IGOci3ORCd6MN6NaeAvegkzxNrwN 1ca78C5UB+/D+5AZPoQPIXOcj/ORBT6BaVSLT+PTqC4+g88gK3wBX0DW+DK+jGzwNXwN1cM38U06 gn/CP6EG+B6+h2zxI/wINcQ/459RI/wL/gU1xs/wM2SHX+AXqInMU+aJ7GU+Mh/kQOyJPWpK6Iaa EYlGqRJxJI5ITpyJM3IkLUgL5ERciStyJm7EDTUn7Ul71IK4E3fkQrqRbsiV9CK9UEviSVc+rYgP 8UGtiS/xRW7En/ijNmQIGYLakhA6S7YjYSQMtScjyAjUgUTSGbMjiSbRqBOJITHIncSRONSZxJN4 1IWMpXNiV5JAElA3MoHO2t1JIklEPcgkMgn1JMkkGfUiU8gU5EGmkWmoN0khKagPmUlmIk8ym86k fclcMhd5kQVkAfImi8li5EMySAbqR1aSlag/ySbZaABZS9YiX5JH8tB3ZDvZjgaS3WQ38iP7yX7k Tw7TNdsgcpQcRQHkGDmGBpMCUoCG0HFdiAJJMSlGQeQ8OY+CSQkpQSHkKrmKQskNukYaSm6T22gY KSflKIw8JA9ROHlCnqDh5DmN+CJIBalAI8g78g6NJJ/IJxQpMMceJcgEGYoWNAVNNErQFrRRjFBT qIliBSPBCLHnUizRaMFKsELxgg1dVY4R6gv10VjBVrBF44RGQiOUINgJdmi8YE/XfhOEpkJT9L0g CRJKFJwFZzRRaCG0QJOEVkIrlCS4CW4oWWgrtEWThe+E79AUYZAwCE0VAoVANE0YJgxD08VaYi2U ItYWa6MZooVogWaKfqIfmiUOFgej2WKwGIzmiMPEYWiuGCFGoHlilBiFUsVYMRbNF8eIY9ACcbw4 Hi0UJ4oT0SJxsjgZpYlTxalosThDnIGWiHPEOWipOF+cj9LFNDENZYjpYjpaJq4QV6DlYpaYhVaI a8Q1aKW4QdyAVombxc0oU9wmbkNZ4i5xF8oW94n7UI54SDyEVov5Yj5aIx4Xj6O14gnxBF338zQO iMA22BbbYQk74wo8Gy/AS/FynIlX4/V4J96LD+KjuAAX4mJ8Hpfgq/gGvo3L8UPqL5/gCpm3bABp TdqRTqQr6Um8SR8ygPiRwSSYDCMRZD5JI+lkBckiG8g2sovsI4eoDVtyivxAzpFL5EdynZSRu+QB +Zk8I6/IW/KRVOGHgohtBEOhtuAo+AtDhBDRUgwQg8Sh4nAxUowR48UEMVFMEWeLqeIicam4XMwU V4vrxU3iVnGnuFc8KB4V2T3YEeDJEHgyDjwZDz4Mgw+TgQ8j4KsE8FIa4J80wT/VAP+kBf5JBP+k DX5IB/yQLvghPfBDNcEP6YMfMgA/ZAh+yAj8kDH4IRPwQ7XAD5mCH6oNfqgO+CEz8EPm4HsswPdY gu+pC37FCvyKNfgVG/Ar9cCv1Ae/0gD8ii34lYbgVxqBX2kMfsUO/EoT8Cv2wHgHYHxTYHwzYLwE jJcD1x2B607AdWfgenPgegtguQuw3BVY3hJY3gpY3hpY7gYsbwMsbwssbwcsbw8s7wAs7wgs7wQs dweWdwaWdwGWdwWWdwN+dwd+9wB+94Q1QC9gqgdwsTdwsQ9w0ROY1xeY5wXM8wbm+QDz+gHz+gPz BgDzfIF53wHzBgLb/IBt/sC2QcC2AGDbYGDbEGBbILAtCNgWDGwLAbaFAtuGAtuGAdvCgG3hwLDh dBQ+QbHYGjfAjXEz7IRf4Vl4Pl6Cl+FVOAevwzvwHnwAH8HH8Sn8Az6HL+Ef8XVchu/iB2xUyLzw K5mXrD+eRVqRtqQj6UJ6EC/Sm/QnA0kACSJDyXCSShaRpWQ5yaReez3ZSnaSveQgzXMJNyAnSRE5 Sy6SK6SU3CJ3yH3ymDwlL8kb8oFU4geklaCFrQUDwVRwJB2p5CcMFoLJRdFMHCQGiqFiuDhSHCWO FseJ34vTxVniPHGhuERcJq4Sc8R1Yq64Rdwh7hEPiEfEU7Stsf9jjGNzvgXwzhJ4Vxd4ZwWzujWw zwbYVw/YVx/Y1wDYZwvsawjsawTsawzsswP2NQH22QP7HIB9TYF9zYB9ErBPDuxzBPY5wXzrDBxs DhxsARx0AQ66AgdbwnzbCpjYGpjoBkxsA0xsC0xsB0xsD0zsAEzsCEzsBEx0ByZ2BiZ2ASZ2BSZ2 AyZ2Byb2ACb2BCb2gvnWA/jYG/jYB/joCXzsC3z0gjnTG+ZMH+BmP+Bmf+DmAJgnfYGh3wFDBwJD /YCh/sDQQcDQAGDoYGDoEGBoIDA0CBgaDAwNAYaGAkOHAkOHAUPDgKHhwNDhwNAIYOgIYOhIYGgk MDQKGBoNDB0FDI2Bu6u1aYQzBGWjTWg3OoqKUAm6hR6il+gTjViU8Q+yg7dBumEa69BY4y3FKfg9 xRT8keJcIYmipRCOeOIgRFBsJoykKP8dC2/Awjuw8AEsfAILyWBhOFgYARYiwQKN4IQolgKkaJU0 SiXFqKRYlRSnkkarpPhqSbuXSvIAicZv1OvcRoh6h2e01JfkFZJRL0GjRuopPiJNyvCj7PoEtxzV Rq6oI+pFo+kh1MPF0Vg6RdV3paicPYLFGXGWXCPOkXPjunCecGecTGxE48J0kBqrJLtqiT9DpaUg nVVJ51TSeZV0ASQM0b0Rf5Ht8fmIF3vzd6m8GNJcUqUuUUmXv8p3BfIdoziHP04xDdL8qJbGhC9g 9vgTNI5dSr+vqixdU0mlKum6Srqhkm6qpFsqqUwl3QZJA9Wko8NKeZXCjT9NS1tByzsNpa7gT8Fz bUV0byXdLwLtSp6ubij+pLJ1ByT27KPift9Mfi1NuZ7fhLT4PD4P6fFb+W2oJr+D34kM+N38fmSk fAOvEXurDzwrh+AXZPbsXRY9kMvnUps7aXrMH+IPwX3DPL8Ifo1kz1WxOF2D2iBwPaue8o1qFvAu NUtq4wiqC78utoNfF5n9HvCUlC1yhmsFNUVHOh/QEYcfV0uCCYwIJ7r3isbwNyGdLp5IZw96TPGN H8NVAxZZIogROZqzDK6XGCDFL5gy/gGtKbuCz/GZUC6hfVx9HQWuU/A/QFuKVee9nN2VAtI9lXS/ WhISWOp/2DfV16GUbw0zY1cajUCLzNykZDNXoYbdtG7T3upwGnxmslljqmrAc5xclGoIpIku5usQ JAUKWk0ETsYlu/CcLNNb6ivZq2nMsy0nmSM32PqgIHgp6gh4mWkoass2yVrNmMzoR9ONE4+M1ivx G1T3kuN2k2a5LkvsM5ONy6RkXEA/DpmY53i+ZtcjtdPK5nh16fT2+shuOvLVko6qqhyhlUqaBZXE /WSCIT+wg9xYMmQ7mobaA0Jj40JjIq06BUaHyo0kA6bWMBTdR8cEBUbGh48YESrXo9aoVstQ8AkL HBMXKreQzJhCNDRSKKw6hcbEhQ8ND4Y3UcrrShbsMDY0UR72CR9JSwkcGc1erNipg2RZS0dykjtK zhL8DaylI2e7To5OzVs2bzlQ8larbD9veS3JWFG+bv/QmHDv8GGR9lbdI4ObyptIjRUF2VQfgKLY yy8VZXmHxrCXK8ayQpM5G/Ve4QjCyZweonotPpnj0Iai7auLz1ht0fp+xqbpo5/v7P2iLF/vyLDA Qzkh5qUH3hc55U6RZvgmzr4ecbPFSr0jF56MfTlmbWKU25GFW3T2h1WMWFR0yMsht1ub17svDxps xq/60CzCcvXbnIy1dQr5nyb28rqrO+RJe/PEfTq32p3aWTb90OCE4fKmOD3JcH1Xq7PyWJ0BDmfG OjulGaQb7LsV1mzj/bvHZs62Oz7LevrQQ5N9B0SNPuK20Xb6oKKaxm6rpjz2ydeKLKg80ePmPg39 JTYTrrdteMFy7JNV8tMv7tvUvl6wo2unjDqDMy1TywNeP53w4vvcIG7eaw/x1nmb/uvTzuSlxOc9 3a/zqtzjWubHsMw8o9Y7pucf4DEd+DlJ16Wkq5KzoElHLCEaHCdrJNlK9av3JW6aaVhcXHSrZs2i gmOjm8bTfo+l/d40OGokjB0LQ46rkmlKAv3iOSR1YLq6slaSq9Qi0znTcZqkzB4cM+Kr3M0UY0V9 qHTq0JSmgpFq0UCmLWlV1wJrSrpMqcfKklEGCLSGdF9fRkfm6tpSrerxjQ21fbw70IHm6iB3aO70 K1bgpCTUI+L9Y99j7ubyGePSmyw+kryJu2Le68zWmb6RZZqNcwIKixYaPpB56Tzr2rAZct1afnph 74wSmyDjt+1crPtEyye9mOU6fcfDh0tQ5bl+i3vXv7ihYe+EvD2BHV7ZnX1w+lrAzQNNprbdtWLX tZ8GVB3eeSLx9Tntlc+XVDa51NrLzMy14dt2PSiHq6Rk/oGSxzqPmjwvudo4xdSR1AjIiE/5NY// Lcz4LR0lV3U6DviLhTaTHBSF2v5ZoexYaMyfUnK7Z6NuNy+FJUwxdR86elBiwd5VwbZVbTotn6Dv WrNBv9hroxuGf+69z8r/ktb7TDO7X/r1tw68anm9/KBTxKlnN3NcQueaLdTe7W3pP2Fo88FkZufK +N5l3pOyk6xW5KX4Z2u+vSe9f2rj0quj1tmyk3ULrvR7lNRul1eO/UYu4WX2xjnNK1fdHzScrGoT cffI4qOVxUPet3+gken+c1LfyDV2L3fPrNnol3k3hMxpnhnje2jqSBZFNVdGvH3kmyfb0D59e6OH 80w2ud31jup5qfmKXVEhFjsW2x9o82DczyMT3pvct9285Vm695729ml7x22sLPHKbRyX2PFJS8vs 4Sb3vztQP+wqmtSp5vRJEUpKFklJp/4mJbVVlOQlJDkpyGgv2UmNMm0z60+z+SMyxsXGOgQHAv1M gH7MxD9goHD0LzHQ+dcMZGd5+tjo0t5enJXf7XGnk6WCz/tqLz40Hx0/dObMyQrdq1XvPY46BUn6 J17HmZUsuDV4uZXhtgmdD3uemfxgUq3J6xouHGbY5WPR3qUdcPGyvn5k1sT1Ua/MPM3qN30ZPmeE zdsDRSZpv2jHHQ0bc+3n9KDp+bGp72bEJdTLzVk6fsm2t/Maj/JoOtqsW4fS57t0rHyujMlckhwc /rnGuZnPRx+osezae/1+thmBjocT+K3jpx3OPj7Lxn7shebxBxfE+r/fd7+XsVa94vKLJc5Nu7c3 dtMbklD/5Jqhzxafi/657YMKncQbFybkxI8Kz1/ep6vU3Hpb9pY6QW5Nrs3daKcx/qrpDv/xd1as iap0m7FZSpYZUBfwQeEC9FA+muXmlqJ/oe2b4Cdl7dV7TEY9QHQ1t0VDm05R0eNi2NujrRoFN7aS t2zpYqV6XzO8G7qp3FIyVyQ2/vqI8q3RcmupruI0mX457hUVFWfVYXRcWFRMeNw45h5aukhyuSS5 KN2DoyR3dJIrd79Bjf50KucP5Uffb/2yt1mjVUvGBkiPszfMaTD4XWVar5w9lSuyrdpO6Ju9LHve EMeICx1Dxj3dFH/ap/Tlz8unmc9bNWXojhMRCUH1rli43dLjFjxcXHDEYWhGRpht+vlW9ke0d/na 5nd5oNXWdbH9hkYt1z/pPrnj3Sl6BzJG9AvclDwha4jDmF6P0neGtM7wNJdr1jdateHB/Cam99ss DTYa4ktCV1m4eE1/u+7ZIv6k2aUj/TrvmDHpSKsnPot6531elzAyrvcW0+LFNRpZowGpQ8JdDvQ0 0HDrX+X3cfVQLc21F5P6D3i2u3WASdIYWembw3mT0iq3npl4ZV2dGH+3ooPPNXNspB3C1NM7rMYY Ti1T+o31UtIaKSmb8ZKTJWVISUsm1fQ7H/0sPGZlvb6JRts95lb9kBXznz9/yX8yxsErpD0Uj855 tcS0+S97ufpXx+i/8h/iuGql+ENbMj9l3ulW961fPh+w0H5XZtfCoGeffixu3XrghhY+4ZX1R7Y7 XbzxFplwUz6nzaqa0cMPVBr0MQ0/+ul8p7v6A636PA4av2Vj7cImLg0cDodmGcxsoBec89bH/L31 6SvGr7w2RXZy1PicXOvdvWEjdPq+OfTC69ShBwXSJyt5jRSLtMZ1PC5b8GteTLqNd/pVbLtZOOBp aPdTXj67d+JGBlWpV55rzkvcu+RErot9eUL5+jF34zPR+eHt8i+2mHm7g8H65sPNhl9v/lOJuax8 fWdZ4UAn10gPc52gPVrZsy9d9mnX5Yx5v7XR1w1aTV84etW6i5nUKxyni4MtyoXBcDG9z1Fkkatf WsBnDW24vzpIsPhWLkFqQdcLznIXZ2e5M1vAUxfv2KLaJSSt/XrJYCjpK8INrQGBsWF0KRBHy6kJ UwgNNjS8QkNGRkWGVNdM649q9kfNdKSF/qaZ9SRrRTPqqB8JCYXFB1uNeEJQYPVbT6LDPIkmeJLj xVZzDpZVtfV8mnCspH6DN/FnravO2PXvXbR8T/L25uMcUMF6zcvBp/esefMoP//KttmLszU+6O1O 9sr4OfnkoZon1h99GjFlrrfZAc8PIdyMfJOS5DDUfqz7awPX3h+D+97+0GbfPZdtZcEa9VqPau/c tSIir8vrhrGWNj90rG3Zd7dXxqWc84Yna7cbJYx8mWbtPrjjL0dPp4dY7c13/pTtfn/8dotme9fe qsgqW2atV+kr79DPNXGL74PyJ9+Na5D71q6ZfjvXsW07TlwXVp5oE1brfo8FBWPdvbpm9ZkyY+Gy o8PGP67xcRr+/k36KLcm64YuLS5zuNOEr6Pn3C30tZvBlhfTzS1svaKK6djDOcmcHe0P299bh+P/ DfdiINRQBuDG1L/wGCMZhKgWujITmVGDd016DiqM8dl8702mXS2Tj/nvvZOk2qosRrxM21ILeaPR NFzvhDpIIix8IO7oIumpFlhEwvRLjZfgxoLv3n5F9m59LIrOF5LlbWcEdb6sue59YGhhU/zBtVuH c7teNpx86e6J/t7rd9U+W3z/Reb7/ru7Lepa/96GujcSSt6YJBhcf5Vq9kRz0I6pqftm+x4wL067 lLbIqWL+raqUZQE9u3u2tG1lZebj8ul7f+OFx2+Yz30e6OV2T+OXoc/GPZl3dkBwaJpp98yEstA9 ZbZ5lYUGu09mF58cPCv6VdH13ORIjRuhtfetfzPtWI2OS1/YbgpP2JbfZN3WoXXXbJmuGbHEcO/W FumWJMfQNefoJqntfusfpbVFQQbmWwbMufciQX9/gJu2y4uF+QtSessGEv9T565suPbT9/PHNvy4 M3LNPMHJd1uAnb6elEycqCszU7gxrcAuK3+ACy2hv7lC8b/iMr74vpbOTs4tWLTkQtdGdLc525Xi /i3tUB7Hf3D8T5dEZ5IWu+b5Z7/ML7t1PjdtzhW3FXVnHR80remg59tiXuduShm+q3SbzXixsHBN z/kBNoaP3r+ut2JXRWR83rOnq91OFRz9zr9d7o5YJ9u1QUmB47KCKiJT0s5H3jy16uLqvvrxgfuj Z4ZmLTaZsW5Q0nn3ofeu91/ZvujTjfj6Td0ldO/K9+PT9C/7WuQ87COeTrmRfcU7fURRcFH68IwF Ab089B82u+TnFzDYKyfWYc2BKZ11Ztc2jv9BszRjbbTxQ48n4Z8HbY+Y90vjvi6us0526W68yHPp 1oqw1T/eqjFqWNzKMbMtpkYsefxgcOfi2/dH6VwIRgvHy5fOFXcaHtpx/umLMuunG4YEPnXp1Oa4 YkmUzC2gPTL3N7HLF2fw9FrEhtHeZ/o8NetdW7DMWZ57btHnP/B8G5i2niwpS0paOel3vUhW3Opv 4f9+u1joqQj83KWOUvvMtplu01qpBX4jq+1A5BcdEc60zZT/jyW2GSMAG/907DtCQNhHLRLtJHWQ 2qkiUX6ak9LumDFjfs9uaMxvDcb9Xkzoeu1Zmusy/6VGg3wiw8v4wgc7Pl465rG5We5EH51Sx93v ht/X+WhdZ0zbNWEJO9MSZ/q/7FQweVno9ymefSckG72eHPtj9mH/Ij76rO2IWge9jNbMOLqnPKs4 a/SK+aPamB3tj/rvejfFtjTA6eOVBgkBGaVrP1a87FBnU78um7vdmO9q6Fuj+4tX8ul1D8rm+hmE 4kdi3/NZ2jPTD13LX39e07iB9a7dA2aYX/Cb1nxN0eeN059scGm3p1PEXasXnQ8m5j160W97VreD oYe9na+dfigEy4SxkZ5V3Q4se9xp4PTrm7Umvf7uhH35vYl+Pe45jntqM3WBtsMOT7+Tx9r7+uZe PHO3Wf6ZJyNXuYyTJ8t+oG7zFM9xUtKu/xnn+JWD/3IZOzPpoWSkmlAbcXINTOCHCzbNKk99DSzX Vr9yTqv+ZU+U60rqR42lel8yyuSUt31m8Xun7KnTIkXXzOph64lZPwlVAVKMWhZteYgUlOk6qcXv /EcyK9RF9V+i/uB/k2XZTqr/h2M7blx01LCYwOiwcb9eTcqSOeRJrE0OLfN6NvSHCX08f1573DJp 7FNTr44dUWtDu+D1hodLd69bljzrl7oozPbhwpt5H6pGdpyX3Lhbjv2iTzudDlesbtU9KM4it7zt j+X7uj5409JrZP/j932ccw0d7s5f6Nzg5PsLi4I31X+3urdzU/Ohh0eMDXjlkdGqRq8+dxZ0dG96 4qlVjmX94P6dyoalci22bH7r3mvwTTf9cYNyN5vF/HBo5ay5OSscsl6+09vAhRr9fDOiWV8Nk9xF k7YGJc5f/u5A54Efd5UvMJhVnLxAcOx3e8XeWRPOPUvNfLG7oZ52Qx30/GhSc93NsQs/jvX2fh5z 5/7/bfr3Fd+C17j1HfQ/tf+1yvwlX95+viggFbSwCdgsamL8jYgxNsMmxjdAoReg5J1Ok0FNLEOp PGwcEAcwAUuZBZEGEshpjxsxtcMITHpwGVZDflB9D6zgjUBDHqYmUcDyFynpCbEILP5jdfpThbHV 1QTOi36v3UOwJIHsGW0xa6esCNH38w3JLHgWmly59uiWJueO5xUVvPVRV8tbBNTSp9y/1MEWVH/2 u9ravtSHp38blYsezDguO2lJvvDLBa/cQyv4I03330y7+kb2joi+lclv50lln+1lJvdMef18e8wD nZ1Rk3aruPGzFnoI2r9hrU+rCBV/s6AyYoVJ/8UnP/R2NovIcVTe3pvxxvRKqPKMmiVbpLM4n4Y/ kT4b6HdlUZNPko/QEaPUG0aX7Y48SVY97SW9dMvXN8rp/fbZuk/Z6y865vKEHFh30DTh8cmGVUxS +jm7N/zx3iMgLWP7SzZjXprHndrlPKFJ1/mvThZmfSGuKjx96r69Vz4sXvjJ0l7+lTvnYgDu/x+L DQplbmRzdHJlYW0NCmVuZG9iag0KNTU4IDAgb2JqDQpbIDNbIDYwMCA2MDBdICAyNlsgNjAwIDYw MF0gIDM2WyA2MDAgNjAwIDYwMF0gIDQwWyA2MDAgNjAwXSAgNDRbIDYwMF0gIDQ3WyA2MDBdICA1 MVsgNjAwXSAgNTVbIDYwMF0gIDY4WyA2MDBdICA3MFsgNjAwIDYwMCA2MDBdICA3NFsgNjAwIDYw MF0gIDc4WyA2MDAgNjAwXSAgODFbIDYwMCA2MDAgNjAwXSAgODVbIDYwMCA2MDAgNjAwIDYwMF0g IDE3N1sgNjAwXSAgMTc5WyA2MDAgNjAwXSAgMTgyWyA2MDBdIF0gDQplbmRvYmoNCjU1OSAwIG9i ag0KWyAyMjZdIA0KZW5kb2JqDQo1NjAgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5n dGggNDE3NjAvTGVuZ3RoMSA4MjQ2MD4+DQpzdHJlYW0NCnic7HwJeJNV2vY5SbrvpS2FAHlLaFkK bWWzAgOlGzsU2mALCE2TtA10M0mhBQoF16nigqgo+47iaIioVVHRQYdx30Ydt0HHcdxQVERFIf99 zpNTSkUv/+ua6/++uX7e0/u97/Oc5+xLTyKWccZYAl4GlpNfPGlCZtND8xhPO8yYsbQgN7+kn+vJ Y4xZx8DLWpA7Ne/2u7ObGFtQwxh/eUJ+QSFLM1TCfyfS+0womlE8/rC5BK5bGbvnwwnFltxvXo7Y z3j0lYwlazOKM4fWVLvakfcI/MtttdaGoA1B2xmLu4kx3XDbYo923y0P/chYzheMBYVXNlTVnjw5 LZKxbmhPWM8qq7uB9WJm1D8P+WOrapors67+7C3GCn5A/upqh9X+YeF9H6H8qUgfKQxR94ZnII76 Wb/qWk9T+Fv8e/gOYCymuqbeZr0v+b7TjE0sZyz0cK21qaH/iX7XwX8v/LU6a60jrXrGccZm9mMs Oqmh3u3xG9nVqF+Mh9bgcjT4P/v4KGO9gH4RTIxlEGOblmk/LYgZ8x3rEcrE8+jny58X/GTuJ2E/ X3TGHfZgyGZEw5iO0YN8wewM44fDpyP9+rAHZUmdHn2xsBisbIYoH4+OxbJM5mDMnIx6pYshhN+E 1NCgO4KGocg+xPqX2dU6Fsp0MUE6nc6g1xm2Mt1XOUxbpsqeVqxpDIafDNSGkM26NI2xLbLQh4Ki RU9RevTZ1vCX2IXnwnPhufBceC48F54Lz4XnwnPhufD8f//oNvDwX00rZ8f+X7blwvNf+egD6BX4 FmAiYlzGDWwwE18VGBDXsRS21e9n4tO5ZL8N1mAqQT+ZBfMvpP6663cJMi9986Bjv/3wjtIuPP/Z R/+fLCxngn3B/MvmzZ1TVmopKZ41s2jG9GlTp0yeNHFCYUF+Xu74nHFj/zBm9KhLsi8eOSIzY8jg AWmp/cx9TckJcbExURHhYaEhwUEGvY6zwQXmwnLNm1buNaSZJ04cIuJmKwzWToZyrwZT4bk+Xq1c umnneubAs7KLZw555nR48lhtDBszZLBWYNa8L+SbtXY+Z2Yp9Jp8c5nmPSb1NKkNaTIShUhKCnJo BcnV+ZqXl2sF3sLF1W0F5fkob39EeJ45zxE+ZDDbHx4BGQHlHWBu2M8HjOVS6AYUjNqvY6FRolqv PrXAavcWzSwtyDempJRJG8uTZXmD87whsizNKdrMrtP2Dz7Udn17LKsoT4+0m+3WeaVevRWZ2vQF bW3XeOPSvQPN+d6BSz9KRpcd3sHm/AJvuhmFTZnVUQH3BqXGmrW27xgabz72xbkWa8ASnBr7HRNS dLFjmJCuNEPb0EL0LyVFtOW69hxWgYi3dWYpxTVWYfSxnMz0Mq+uXKQcUimJFpHSqlI6spebU8RU FZQHfhZXJ3tbK7QhgzH68icVP0jXvPq08gpbtWCro82cn0/jVlLqzcmHyLEG+lqwPysT/tZydMIp hmFmqTfT3OBNMOeSAwyamANncanMEsjmTcjzsnJbIJc3syBftEsraCvPpwaKsswzSx9mw/xH9w/X jPcPY8NZmWiHNykPk5JW0FZqr/Sayo12rM9KrdSY4s0pw/CVmUsdZWKWzLHegUdRXYqsUeZC37p4 K2fR85DUUK1UZ9SXidmCQSvEy5w7BgmxmC4ZFTOaO0Yr5Uam3FBLwEOoc8pBRJ+aN1Ek6UXWvInG lLIUen6jScZAm4JSvaGdyoqFoaNNVM+vNo28RYMGagWO/E4NPKfQoEADA6Wdv506MRaBipEjVEzn RJWkT8XOhU2HYqRJzGKy5mVFWqnZYS4zYw3lFJWKvomxlvM7pdg8ZeacUjnbgVVSck6M0rMp5mUp SFYRXR7WYGG6UU2rjE+Q8Y7oxC7Jk1Sy1hZqnlLcJgo3BwpkGnYQOh2cNsl6XXb8cGzNQpxu5kKr WYvVCtus7f7Wirb9OTltDQXl1aNEGeZJ9jZzcekYo2zrrNIW41JRVTybwqeU5A4ZjLMnd7+ZXztz fw6/tnhO6cOx+D1+bUmpT8d1eeW5Zfv7Ia30YQ2Hu7TqhFUYRUQTEVHSLERCpb/x4RzGWmWqQRpk 3NbOmbSFKhtntnYd2WKVTQebgWw50iYeTFJyNYYYx22BZhfTs7ysuq28TGwuloSpxA/3cvNY5tWZ x+7nuuBIb7jZkeuNMOcK+zhhH0f2YGEPwcLgSRyDI86ktnIzziksqFJm5LQU9aJIrd3vLylNecF4 rCwFS20eMKfUG5aOsz8odTL8JgiUwzzB22qzinYwS6nIG5I6yVaGZasKhMskbxhKCAuUAI9CmUcs R2SyYW4wgTJ/KyLe1jJvWbqotNRZJpdzrJdNNI/CtFOZQWmiosyytnjzULk3sRXCU68RFIa2seJS shgRRWVlNEghkWi5zYwkW7mG0TYwWzGWOp2l4UayOHAkGtIcEuHGQCIT3dKnRkSFe8MyUCB+hI7I EFsyKDWkrIwaL2PXBBxQd6w3Ai1K6zSUgQwYHSRNEm3BzzVoqnB9UhQzs53NMjfhZBGNliWFINkb lTrJisOf8kfAYs5WmUPFGRERKOMwWUNEzyMx7vrUknb/HnNzSqdnyGCz+OUgFiYzPoyFzcrauhq8 c9OHDA7tao2S5ra20KjzZ6DxCo3qYGHUCvBbgzFfmF5r1115ICyZT4a4QonVSqxSolWJlUqsUKJF ieVKLFNiqRLNSjQpsUSJxUo0KuFRwq3E5Uo0KFGvRJ0StUrUKLFIiYVKOJWoVqJKiUolHErYlbAp UaGEVYlyJRYoMV+Jy5SYp8RcJeYoUaZEqRKXKjFbCYsSJUoUKzFLiZlKFCkxQ4npSkxTYqoSU5SY rMQkJSYqMUGJQiUKlMhXIk+JXCXGK5GjxDglxirxByXGKDFaiVFKXKJEthIXKzFSiRFKDFdimBJD lbhIiSwlMpXIUGKIEoOVSFdikBIDlRigRH8l0pRIVaKfEmYl+iqRooSmhEmJPkr0VqKXEkYleirR Q4lkJborkaREohIJSnRTIl6JOCVilYhRIlqJKCUilYhQIlyJMCVClQhRIliJICUMSuiV0CnBlWAB wf1KnFHitBI/K/GTEqeU+FGJH5T4XomTSnynxAklvlXiGyW+VuK4El8p8aUSx5T4QonPlfhMiU+V +ESJfyvxsRL/UuIjJf6pxIdKfKDEUSX+ocT7SrynxLtKvKPE20r8XYm3lHhTiTeU+JsSryvxmhKv KvGKEi8r8ZISLyrxghLPK/GcEs8q8VcljijxFyWeUeJpJQ4r8WclnlLiSSUOKfGEEo8r8ZgSB5V4 VIlHlHhYiXYlHlLiQSUeUOKAEvcr4VNivxJeJe5T4l4l/qTEPUrsU+JuJe5SYq8Se5TYrcQuJXYq sUOJ7UpsU2KrEluU2KzEJiU2KrFBiTuVuEOJ9UrcrsRtStyqxDolblFirRI3K3GTEjcqcYMSa5S4 XonrlGhT4o9KXKvENUpcrcRVSqhrD1fXHq6uPVxde7i69nB17eHq2sPVtYeraw9X1x6urj1cXXu4 uvZwde3h6trD1bWHq2sPV9ce7lJC3X+4uv9wdf/h6v7D1f2Hq/sPV/cfru4/XN1/uLr/cHX/4er+ w9X9h6v7D1f3H67uP1zdf7i6/3B1/+Hq/sPV/Yer+w9X9x+u7j9c3X+4uv9wdf/h6v7D1f2Hq/sP V/cfru4/XF17uLr2cHXt4eq2w9Vth6vbDle3Ha5uO1zddri67XB12+HqtsPz7hcCt2Zfn7Em3Jl9 fRJBqym2ytdnFKiVYiuJVvj6RIJaKLacaBnRUqJmX+/xoCZf7zzQEqLFRI2U5qGYm8hFxst9vXNB DUT1RHXkUktUQ7TI16sAtJDISVRNVEVU6euVD3JQzE5kI6ogshKVEy0gmk/5LqPYPKK5RHOIyohK iS4lmk1kISohKiaaRTSTqIhoBtF0omlEU4mmEE32GSeBJhFN9BkngyYQFfqMU0AFPuNUUD5RHlEu pY2nfDlE4yjfWKI/EI0hz9FEoyj7JUTZRBcTjSQaQYUNJxpGpQwluogoiwrLJMqgfEOIBhOlEw0i Gkg0gKg/FZ1GlEpl9iMyE/WlolOINMpnIupD1JuoF5GRqKev53RQD6JkX88ZoO5ESWRMJEogYzei eKI4SosliiFjNFEUUSSlRRCFE4VRWihRCFGwr0cRKMjXYybIQKQno45inIhJ4n6iM9KFn6bYz0Q/ EZ2itB8p9gPR90Qnib7zJZeATviSi0HfUuwboq+JjlPaVxT7kugY0ReU9jnRZ2T8lOgTon8TfUwu /6LYRxT7J8U+JPqA6Cil/YPofTK+R/Qu0TtEb5PL3yn2FtGbvu6Xgt7wdZ8N+hvR62R8jehVoleI XiaXl4heJOMLRM8TPUf0LLn8legIGf9C9AzR00SHif5Mnk9R7EmiQ0RPUNrjRI+R8SDRo0SPED1M 1E6eD1HsQaIHiA4Q3e9LGgfy+ZLmgvYTeYnuI7qX6E9E9xDtI7rbl4Tzmt9Fpewl2kNpu4l2Ee0k 2kG0nWgb0VaiLVTYZiplE9FGSttAdCfRHUTrKcPtFLuN6FaidZR2C5WyluhmSruJ6EaiG4jWEF1P ntdRrI3oj0TXEl1DdLUv0Qq6ypdYAbqS6ApfYiVoNdEqX6IF1OpLxGHMV/oSR4JWELVQ9uWUbxnR Ul+iHdRM2ZuIlhAtJmok8hC5qWgXZb+cqMGXaAPVU2F15FlLVEO0iGghkZPyVRNVUcsqKbuDyE6e NqIKIitROdECovnU6cuoZfOI5lKn51DRZVRRKdGl1NzZVJGFSikhKiaaRTTTl5ADKvIliBpm+BLE 8p7uS7gCNM2XMAQ0lVymEE32JeBewCdRbCLRBDIW+hJWgAp8CdeA8n0JK0F5voRWUK4vvhA0niiH aBzRWF88fr/zP1BsjC+uDDSaaJQvTiyNS4iyfXETQBf74kpBI31xc0AjKG040TBf3GDQUPK8yBcn OpblixN7M5Mog7IPoRoGE6VTYYOIBlJhA4j6E6URpfrixCj1IzJTmX2pzBQqTKNSTER9KF9vol5E RqKeRD18sZeBkn2x80HdfbELQElEiUQJRN2I4ilDHGWIJWMMUTRRFFEkeUaQZzgZw4hCiUKIgskz iDwNZNQT6Yg4Ecvxx1SYBM7E2EynY+ymn6F/Ak4BP8L2A2zfAyeB74ATsH8LfIO0rxE/DnwFfAkc g/0L4HOkfYb4p8AnwL+Bj6OrTP+KrjZ9BPwT+BD4ALaj4H8A7wPvIf4u+B3gbeDvwFtRi0xvRl1k egP8t6ga0+tRaabXgFehX4lKN70MvAS8iPQXYHs+qtb0HPSz0H+FPhK10PSXKKfpmahq09NRVabD yPtnlPcU8CSQ4z+E9xPA48BjkZebDka6TI9Guk2PRHpMDwPtwEOwPwg8gLQDSLsfNh+wH/AC90U0 m+6NWGr6U8Ry0z0RLaZ9EStMdwN3AXuBPcBuYFfEENNO8A5gO/JsA2+NWGTaAr0ZehOwEXoDyroT Zd2BstbDdjtwG3ArsA64BViLfDejvJvCp5tuDJ9huiG8yrQmfJfp+vA9pqv0qaYr9dmmK3i2abWl 1bJqX6tlpaXFsmJfiyWihUe0GFumtCxr2dfyTkvOtODw5ZallmX7llqaLUssTfuWWBbva7QYGhMa PY36E418XyPPb+RZjVzHGmMbtUZ9pMfisrj3uSzMVeRqdXldhtFe11GXjrl4eLv/0P0uY59CcM5y V1Rs4eWWekvDvnpLXWWtZSGa5cyuslTvq7JUZtstjn12iy27wmLNLrcsyL7MMn/fZZZ52XMsc/fN sZRll1ouhf/s7BKLZV+JpTh7pmXWvpmWGdnTLdNhn5Y9xTJ13xTL5OyJlkn7JlomZBdaCtBl1iu2 l9ZLHysaML0XWsKMPDfLmGM8ajxuNDCj13jIqI+P6WnqqRsY04PnzejB63us7HFjD31M8kvJupzk gYMLY7q/1P0f3b/qbuiW031gRiFLik3SkvSJom9J00oKJY/LJ75ohOzrtCRzWmFMIo9JNCXqCkyJ nMUdjTsep098IvalWF1MDI+J8cfocmLgHhNtitaJlz9anxN90cWFMVGmKJ14+aP0STlRsIgS+0cW lRTGRJgidJZxETMidDkR4/IKcyKGZBUyPdc4ZzwWpA+F7wGeaCrUH+TinxoFMc5v2l9SnJ4+pT2U zZriDS2a6+XXelOLxTtn5hxv8LVeZpkzt3Q/5zeU7ee6vBJvgvgPtTJ+1Zo1rHfuFG/v4lKffuvW 3rllU7ytQufkSO0XmsGlLH2+u9Gdnu6Zj9d8tydd/iDGG0UsXRjFj9uDuAiNMs7Sf/MhN9ACNx5P wOb57Uz/2x/+P92A//5nPxP/vmC8X3cls+uuAFYDq4BWYCWwAmgBlgPLgKVAM9AELAEWA42AB3AD lwMNQD1QB9QCNcAiYCHgBKqBKqAScAB2wAZUAFagHFgAzAcuA+YBc4E5QBlQClwKzAYsQAlQDMwC ZgJFwAxgOjANmApMASYDk4CJwASgECgA8oE8IBcYD+QA44CxwB+AMcBoYBRwCZANXAyMBEYAw4Fh wFDgIiALyAQygCHAYCAdGAQMBAYA/YE0IBXoB5iBvkAKoAEmoA/QG+gFGIGeQA8gGegOJAGJQALQ DYgH4oBYIAaIBqKASCACCAfCgFAgBAgGggDDeD/eekAHcIAxO4eNnwFOAz8DPwGngB+BH4DvgZPA d8AJ4FvgG+Br4DjwFfAlcAz4Avgc+Az4FPgE+DfwMfAv4CPgn8CHwAfAUeAfwPvAe8C7wDvA28Df gbeAN4E3gL8BrwOvAa8CrwAvAy8BLwIvAM8DzwHPAn8FjgB/AZ4BngYOA38GngKeBA4BTwCPA48B B4FHgUeAh4F24CHgQeAB4ABwP+AD9gNe4D7gXuBPwD3APuBu4C5gL7AH2A3sAnYCO4DtwDZgK7AF 2AxsAjYCG4A7gTuA9cDtwG3ArcA64BZgLXAzcBNwI3ADsAa4HrgOaAP+CFwLXANcDVzF7ONbOfY/ x/7n2P8c+59j/3Psf479z7H/OfY/x/7n2P8c+59j/3Psf479z7H/OfY/x/7nLgBnAMcZwHEGcJwB HGcAxxnAcQZwnAEcZwDHGcBxBnCcARxnAMcZwHEGcJwBHGcAxxnAcQZwnAEcZwDHGcBxBnCcARxn AMcZwHEGcJwBHGcAxxnAcQZwnAEc+59j/3Psf469z7H3OfY+x97n2Psce59j73PsfY69z7H3/6fP 4f/yp+x/ugH/5U/ygvmMMfH/3Z+55Zx/PF3EFjI3a0W4mq1ht7An2Dusgl0BdQfbynazu5iXPcn+ yt78T/6L7TPNQbUsUv8QC2bdGPOf8h87sxtoD4ruZLkFsW4G7azFH+v/sovtyzO3+GPPtAfHs3CZ N0r3Kqzf8tP+U/gFi7h/pIjrroGOkTm+Dtl85r4ze7qMwUw2h81l89hlrJxZ0X87q2ZOjMwiVsNq WZ2M1SGtCu9KxBbAC4eJ1Ge96lkD4GIe1sgWIzRAuwMxkXa5jDeyJQhNrJktZcvYctYSeC+RluVI WSrjTcAKthIzs4qtlkoxWa5gV7KrMGvXsGvZH38z9scO1cauY9djnm9gN/6qXnNO7CaEm9larId1 7FZ2G1uPdbGBbexivV3a72Sb2RasGZF2KyxbpBKpB9kz7AF2L7uPPSjH0oZRoxFR41Ipx7ABY7Ac PbyiU4tp/JZ0jNYK9F30rS3Q0ybYV3fKsTgwjsLzCnhSKTQPopSWLiNxE/pA+myPKHar7P9Za+dR +S2rGo+NnUZmg4wJ1dX6a/o2tgk7cBveYlSF2g5NaovUne2bO3y3yvgOtpPtwlzskUoxWXZD72F7 sbfvZvvYPQhndWdFfC/7k5w5L9vPfOx+dgAz+SB7iLVL+2+lnc9+f8Du67A8zB5hj2KFPM4O4aR5 CkFZHoPtiYD1sLRR/Cn2Z8SFF8WeYX/BCfUse449z15iTyP2onwfQexl9ip7jb3Jo6BeYZ/ifRqQ f6fkjFv/Kk4NPQthl7BpbDqbe5BF4fd7EhvFH3ggMT8/dEjI4/jdrWMafvuH4uN5Xk6MQRf1UM+e 48wPjQheo4+b1M6HHBgXsgb32nGn3z/9Yubp94/FX5J5jGe+98H7H8R+/WLcJZnDPnj9g4uyeFxK nERCtC4kJCHY3DdDN6J/2shhw4aO1Y0YnmbuG62TtuEjLx6rHza0j06foCxjdSLO9a/+PEc/43Sw boV53OxhQX16xiREBQfpeiXHDxmTGls8N3VMRu8QfUiwPig0ZMDFuX2n1BT0fTskrndiUu/40ND4 3kmJveNCTr8TFH3qm6Don/IMNT+t0wePnjeun359eKjOEBzc3ie5x6DRKZNmx3SLNUR0i41LCg2J j4sckD/v9NWJvUQZvRITqazT05iOh/tP8neD5rNENpBFPxCUapwWW8jGjXvvRXRXNV6fRq1P7Na1 O4+FiOJ6xYfE8dBEcy+jOTE0OqzHAJNpYHJYWPJAk2lAjzDeGBoZajDgpX8kMj4yKDgyLvKnS1LS jRERxvSUlCE9IiJ6DMEEHfMf4/cZFsiWaAdZEj7xaSxRd8mDEbGD0C4nQ6NiD/NMmopAS/rrh/9a 224NiTEmJhljg3lccLd+vYx9u4WEhSX1690rrXtYWPe0Xr37JYXxESHhIXo9Xjp/ZGx4UFBETOTP Wu/+yRERyf179x7QIzy8xwCstG0XwoVwIVwIF8KF8L8kfNw58OEXwoXw6wF3mCG6vkz9X9t2+Raa s2gZE1rHovUGpv7v/Sx9fEAbOvkEsWR9bkAHd7KHsFP6OQEdygbpXw7oMKYZSgI6XLe1wz+CzTZ4 AjqSDTI8G9BRuvWGEwEdzWpCru/4f/+HhvwQ0JyFhA4KaB0LCVuq/i9/lhy2KqANnXyCWGTYHQEd 3MkewlrCdgV0KEsMOxrQYSw2vG9Ah/OiDv8Ilh4+NKAjWWL4ZQEdxaeGuwI6mo2MeFz8tQNDWGCc SdM4k6ZxJk3jTNrQyYfGmXRwJzuNM2kaZ9I0zqRpnEnTOJOmcSZN40yaxvkuXLeHsiyEkVDT5Cd8 Fz7bu4FKfPLWWJ78ZoS+H7HC4oSqYxlIGY9P/jXgWbBVsWqkuWXMAXbAezHednjmIV8NfCpgc8LD Kf2sQC3KskvfOsTcsNXJNMrvRAs0wAo/J0poRmwJlAd1afL7mAroGvhqss2NyG2X3/dUyVLqA6V6 4FEbqFN4aOhjvazTIb/XEX2ZJPtaCYtVft/gkr3QJFtlL0W91A8bUgbLkmulpUaWaMUYkV3VUoty auSINQRaWQdLrayVyhT99HRqgaixQfZFfR9Fo01tFzXVYwQ0+U1MlRwFp/zuRXyn5ZEx0WNPx3zQ mFEtmmx7XaBf9XJsK6Tn2RZ37pEYtSaZj3q9CPEMuR46z2Z/WVqtLKFZjkNjYOY7j7eYMeq/Q7Zf 9J/mxSVXg2CqUcy1hjIaOnpDbawK+LgRWxoo3YNe0Awt7pglq1wjVlhrz+mXWs02tMQq67cF6s+Q K7ZKzpVI+eUeGPWLXo/q2DUj2OzAKnIG1tsIlChSzr/qHYH1S72xBtpfJVOpPY7AiIk22uXKFa1a JOdM5Tl/auX/1Q4+u1pobiyIOWUbRP3FcrV7zpnHzEAL6jv1wBbYdx7ZS4dcy1NhsbEBco7xqV62 U2MTZKsorwehAaOYibBEhgy5x89teYYsvRY+Hqwt0f4q2YMGlNAMq5jBStkXsXPOLVXZK+W3wi65 flV5ZbLNtGqb5WpzyxZ65L5yy3OAcmuyD2JPOuSKcso6aIQqZF41egUYv6k4ESmvq1MK7We7HJOz e3RJ4NvU6l+pl+LC14ZV1CjH0N6x5u0yvUGu2OZO67xB9rQusNKpLId8i53btd8inU6IAcg1UK7O WvTL0bFnf9mqul+U/PvH6Gzp6pTWAucsrR7bOefdL/t+dr2e267RnUZA9IT6Qqe+WvWujt8gdnmG 1smz1PqrPaVxtp4zpo7A6u+6B8SoipXXKHPa5XkkeuPoKEd41sgz7bdm6D+1L87uiUzZGrEH6DdR hpyrBtZ0lzY0K2ukNs1pc9W76ys9Wl69q6HeZfU46+sytPE1NdosZ1W1x63NcrgdrsUOe0aetcZZ 4XJqTrdm1Wrr7Q5Xnea21rk1pDsrtUprrbOmWVvi9FRr7sYKT41Dc9U31tmddVVurR6uHkctctbZ NVu9q87hcmdokzxapcPqaXQ53JrLYa3RnB7UYXMP1ty1VrTAZm2AFllqG2s8zgYUWddY63DB0+3w yALcWoOrHu0WzUbpNTX1S7RqNFxz1jZYbR7NWad5RD/QMmTRapx1qKu+UqtwVsmCqSKPo8mDzM5F jgwt0M3+bq3WWtes2RrReWq3pxr1O5ZoLiv64nKi28hordUaG0Q1KLEKFrdzKdw99ejQYtElq7bE 6qqlusQw26qtLjTM4cqY5ahqrLG6OmZglKp6lJiaEbMxROiUNiIjK6vT0DswvqjGivKrnKIdDjTM ZbU7aq2uRVq9SOkUrTz/BMthQW8sdU4P8hd7rB7qYyYKqJcV2DB3HpfT4c6Y2mgbYHUP1OwObYKr HqkeT8OozMwlS5Zk1KrCM2z1tZme5ob6Kpe1obo50+aprK/zuAOuQlda0YFFwq+svhFD26w1uh1o BLokkjUrZtLhqnV6RIMqmmXzCixTxyPVJSOYZ3sjzeiSaqetulNesLPOVtNoF2NRr9md7oYaVCDG vMHlhIMNXo46T4am6q6vw4IY4ByoOWorRKazRdUp5/O2SLqLJY3hd2N4bLTuOmqX4xooa7RswAAn asHSF0PvEhvEXr+krqbe2rlStNlKLcXAd8xAfaOnodGDYV/stDmET7WjpqFLh37PXMiZyLQ7Kq3Y RBlWd0NTx+dB5k8WfxP+PA+HBz5RsG4sxO9nMYG/txaMBPG9eC/GfvG32c559JP1MyMjOXx4/u/1 j4qS/uW/1z8mRvov/73+sbHSf/3v9Y+Lk/4Hfq9/t26cg8VfnAuVf+dOfBpFvsDfoIvqkhbXKS26 S5qpU1pMl7SMTmmxXdLGdkqL65I2o1NavJjPUM5DDa3yYa1hnIcFIoiFc114UEesNYLrIlRUxCO5 LjK4tZMhSqeLCj7U8TD8BEYsHL+HDjO9rdlVwxKqXI5FLKvG6qljY5DCi2flaiwBq9Av1xeXSvyN PzFupPUslulmzZimseSSWVM0/M4kuyHAQQHG53tbg7uBDV6EX0tsqHxny/dY+c6X78nyXdQxm/If 7/7mWyc/hVMMLRH/KREzwNH6INw0imRbDWw1Y7osXRFbqdupe5Nt1W/Sb2KvM36XV7RT12Q4db4Q khWSFb42cuvZELWbgkjpGqKvjR/ZEd5FOBl/stu8bvO6rxWh58GuISTL6OtzxLSWQsqVZ0PfzSL0 Tz5vuCF9pwqZzw6dp8LFJymMuv6XYfTu0bvHrPvDwrNhbD8KIqVrGPvMuC9UyJn+K6E059mcZ8ef EOHclLy084XRu/M+KYgvOECh8N6zYcI9Iky8+7zh+KTPVJj81pTNKkzdS2Ha4vOF6e3T24vCZy7v FN4Wtq5hlqEovCh8lkHkKckQwbJcBSpp9tuzP5p98tKsSxdeuvPS92e/feknInStryz3fEG0oSi8 7NqyzRTmfHQ2iLrmjRTvWQaBy65f8JkKFRNtd6tQGUqh6v2q96sTgFyE5dW7q49C767e7dQ5pzpv k+Et50nnyYXDF85HsC9cvbAdWL3w8YU/LxolwsLVixoWtSHcs+jBRQcXfbzo45rQmlkI9pq6mvWB 8Ehtv9q1te21H9dlIYyqK6lbXLeu7o1A+KTuG3w0HIswtaFPw7qGkyK4DrgrRMCleLvn+UB4Q1yR wSdk7ETjoMZBnucb1y3uuzhncUWT1qQ1P7601HWAvMEnyGvpl8Jv6c/LRi2rWbZ52eFlX4qwfMzy 1TIcWP52S3JLX/CBluEIdS17W+5teX1FPELRijvhN2bFoRWHWobj/Y1QKw6tNKzss3LqysUyHG8t lKGpdXtLMt5NrUdaP2s9Ao8+q0JXZawavmo1wpFVp1Yeh+8RSlndq/XI6tzVU6+ovOKHK9deXXT1 nKvtbaPW5N9891qP4nXT101fH3vHh3ec2JC0Qdswf0PrhrYN6zZs33Bww4sbjm84tdGwMX6jtnHk xpyN0zfO27h745GN728asGnkpombVmxav+nVTV9sHrS5dPPaLZFbxm7xbLl7y8EtH275eevYrU1b H9k2fNvsba3b7tx2z7Y3tn2yPX77vO23bT++I37H8B2FO4p2uHYs37F5x9Gd8TvtO1fsXL/z1Z0f 7UralbVr6a4Du07uztm9dPc9uz/bw/aM3FOyZ/ueo3vT9nr2+vZ+clcbW8Pi/V+zbkACkAgkAd2B /sAAYCAwCEgHRrHu+ATXnU3xf8qmAtOA6cAMoAiYCcwCioHZQBlg95czB1AJVPuPMiewEFgE1AC1 QB1QDzQAlwMuwO3fwzx+L2sEFgNLgCZgqX8hWwYsB1qAFcDN/lfYWuAWYB1wK3AbsBvYA+wF7gLu Bh7Gb4NHgGehnwOeB14AXgReAl4GXgFeBV4DXgf+BrwF/NO/hH0E/Av4N8bjE+BT4DPgc+AL4Bjw JfAVcBz4GvjGv5l963+anQC+A04C3wM/+jeyU8BPwM/Aaf9Gfqf/eb4B2AhsBrYA/4eXe4+uuy7z Pf6LexgBQXTG4wxzZnR6xnGojIAKWkVFnfFC1Kmjw6UokKJj6Yw9y9VRWzsghnIpheZQAlVK6T2l TTEtSUPaYrOLJg1paNqQNEl3mqbZO2Ff8uveKyFpgi39nVdqneOZVVyDZ63zx3ulwGr2fp7v83k/ 318urMYarMU6rEcFNuApbMQmVGIznsbPUIUt2IpnUI0abMPuKFHUFHUVvYBm7EVL1BX7cvTz2HXu MjcGF8Ruir4Y+3pUHbvFx1t9nBsNx+qDjwTdwR9EueAc/CHejHNxHs7HW3ABLsRb8UdRxoRlTFjG hGVMWMaEZUxYxoRlTFjGhGVMWMZkHTVZR03WUZN11GQdNVlHTdZRk3XUZB01WUdN1tHgligMbkUJ ZuI2fBN3RceDH6MUd2OpKXwE5XgUj2EZNuApbMQmVGJvlDYVaVORNhVpU5E2FWlTkTYVaVORNhVp U5E2FWlTkQ56o4ngCPpwFP1IIuW/DWAQI1HCBCRNQNIEJE1A0gQkgwn/7dXooCk4aAoOmoKDpuBg 0ZuiI0Ux/AHOwR/izTgX5+F8vAUX4m3RQNHb8Uf4Y7wD/w3vxJ/gT3Ex/ixKFr0r6il6N/4SU/A/ 8Fd4D/4a78Xf4JJod9FUvA+X4m/xflyGy3EFPoAP4kO4Elfhw/gIpuGj+BiuxsfxCXwS1+BT+DQ+ g7/D3+Oz+Bw+jy/gWhTji/gSvox/wHRcp5brcQNuxAzc6X3/CHfhxyjF3ViIe3Av7sP9WIQH/Z3l UUbaMtKWkbaMtGWkLSNtGWnLSFtG2jLSlpG2jLRlpC0jbRlpy0hbRtoy0paRtoy0ZaQtI20ZactI W0baMtJ2oOh5Z/UL/BINaESTf/8CmrEXLdEBKRsMFkpYKGGhhIUSFkpYKGGhhIUSFkpYKGGhhIUc e4BjD3DsAd5M82aGNzO8meHNDG9mgh9GHdzZxJ1N3NnEnU3c2SQtobSE0hJKSxgsjMaCe3Av7sP9 WIQHsBgP4iGkolHTPWq6R0130nTnTXfedOdNd95050130nR3me4u091lurtMd5fpCk1XaLpC0xWa rtB0haYrNF2h6QpNV2i6QtMVmq7QdIWmKzRdoekKTVdoukLTFZqu0HSFpis0XaHpCk1XaLpC0xWa rtB0haYrNF2h6QpNV2i6QtMVmq7QdIWmKzRdoakITUVoKkJTEZqK0FSEpiI0FaGpCE1FaCpCUxGa itBUhKYiNBWhqQhNRWgqQlMRmorQVISmIjQVoakITUVoKsKiPdGwKQhNQWgKQlMQmoIwdl00wL8D 3DsQfNpz/Tv4Ms+Xeb7M82WeL/M28gU28gW8mefNPG/meTPPm3nezPNmnjfzvJnnzTxv5oNveSb6 Z3wbS3npEZTjUTyGZdgQdXNjNzd2c2M3N3bbnH9ic/4JRyY4MsGRCY5McGSCIxMcmeDIBEcmODLB kQmOTHBkwrYs2JYF27JgWxZsy4JtWbAtC7ZlwbYs2JYF27JgagqqH4/dZAN9PZgRu8XHW4MZwTSZ SMpEUiaSMpGUiaRMJGUiKRNJmUjKRFImksFFUvQx2+dqfIvZ/xnfxr/JwveiEfkYkY8R+RiRjxH5 6JePQ/JxSD4Oycch+TgkHzn5yMlHTj5y8jEkH0PyMSQfQ/IxJB9D8jEkH0PyMSQfQ8EOnd55OgOj wSlbKIqOFwUoio6rrjl2o6TfpNKvBzFnXFBhLBhS4RIVLlHhEhUuUeESFS5R4RIVLlHhEhUuUeES Fa6xW/N2a95uzdutebs1b7fmzz4rUblulL+hWbklStmxKTs2Zcem7NiUHZvSrZzOjOnMmM6M6cyY zqzXmfU6s15n1uvMep1ZrzPrdWa9zqzXmfXBw9FJc/eCuXvB3L1g7l4wdy+YuxeCn/hvP8UTWIEn sRKrsBprsBbrsB4V2ODvPYWN2IRKbPbvn0YVtmArnkE1arANtXgWddiOHdEmJ7YpeM6ff45dqEcc u/EL/BINaMQeNOEFNGNv1CwXzXLRLBfNctEsF81y0SwXzXLRLBfNctEsF81Bp7/ThW5/PuRjAj04 jF69P4I+HEU/kkhFfazbx7p9MhXKVChToUyFMhXKVChToUyFMhXKVChTIUOnGHqAoQcYeoChBxh6 wHS+wNBphk4zdJqh0wydNrH7Tex+E7vfxO53H2l2H2l2H2l2H2l2H2l2H2l2H2l2H2l2H2l2H2l2 H2l+A/eR0H0k6T6SdB9Juo8k3UeS7iNJ95Gk+0jSfSTpPpK070P7PrTvQ/s+tO/DopLgj4tmBl8t ui24uOibwZSibwVvL/pX3Olz/wh34ccoxd1YiHtwL+7D/ViEB32uh6PeoqV4BOV4FI9hGX4S9Urs lRJ7zem0SmrsO1E8mCqBx7nlOLcc55bj3HKcW8a5ZZxbxrllnFvGeSXJK0leSfJKkleSTvKkkzzp JE86nV85nRNO54TTOeF0TjidE07mNSfzmpN5zcm85mReszNSbhI5N4mcm0TOTSLnJpGzR0bskaQ9 krRHkvZI0h7hSn26QJ/erk8X6NP5p63DOMHFbNPLNr1s08s2vWzTyza9bNPLNr1s08s2vWzTq9a0 1E/eD0IpD6U8lPJQykMpD6U8lPJQykMpn9xfgzqWL7qQo6o5qpqjqjmqmqOqOaqao7Zy1FaO2spR WzlqKzet4qZV3LSKm1Zx0ypuWsVNq7hpFTet4qZV3LSKm/LclOemPDfluSnPTXlPmSlPmSlPmSlP mSlPmSlPmSlPmSlPmSlPmSlPmSlPmSmndcRpHXFaR5zWEad1hJvquamem+q5qZ6b6rmpnmd28cwu ntnFM7t4Zped+A478R2yXy/79bJfL/v1sl8v+/WyXy/79bJfL/v1sl8v+/UyXy/jQzI+JONDMj4k 40MyPmQy9pqMvSZjr4wfkPEDMn5Axg/I+AEZPyDjB2T8gIwfkPEDMn7AFDWe9Snz188YjSap0SQ1 mqRGk9T4Bp8xumW6W6a7Zbpbprtlulumu2W6W6a7ZbpbpvvewDNG2i0w7RaYdgtMuwWm3QLTboFp t8C0W2DaLTDtFph2C0y7BabdAtNugWm3wLRbYNotMO0WmHYLTLsFpt0C026BabfAtFtg2i0w7RaY dgtMuwWm3QLTboFpt8C0W2DaLTDtFph2C0y7BabdAtNugWm3wDTn9HFOH+f0cU4f5/QV3RL8uTz9 lTxdJ09/IU9/xTt/XfTt6Cj3TCn6vo8/wDzMxw+xAHfgjT6fPODvPOg1H/JxCcrwv/CwVC3FIyjH o3gMy/ATLPdk/wRWYCVWYTXWYC3WYT0qsAFPYSM2oRKb8TR+hipswVY8g2rUYBtqvZdnUYft2IGd eA4/xy7UI47d0ROstYa11rDWGtZaw1prGGszY21mrM2MtZmxNnv+ORLsdeO9hjlyzJFjjhxz5Jgj xxw55mhjjjbmaGOONuZocxO+2E34YgZpZ5B2BmlnkHYGaWeQdgZpZ5B2BmlnkHYGaefuf+Huf+Hu f2GNDtboYI0O1uhgjQ7W6GCNDtboYI0O1uhgjQ6en8Mci5ljMXMsZo7FzLGY52fw/Ayen8HzM3h+ hie5i4N7cC/uw/1YhAewGA/iISx1C3gE5XgUj2EZNuApbMQmVGJHUMw6xazTwjotrNPCOi2s08I6 LazTwjotrNPCOi2s08I6LazTwi7r2GUdu6xjlxS7pNglxS4pdkmxS4pdUuySYpcUu6TYJcUuD7DL fnbZzy772WU/u+xnlrnMMpdZ5jLLXGaZK9lZyc5Kdlays5KdleysZGclOyvZWcnOSnZWsrOSnZXs rGRnJTsr2VnJzkp2VrKzkp2V7KxkZyU7K9lZyc5Kdlays5KdleysZGclOyvZWcnOSnZWsrOSnZXs rGRnJTv7/y0hu6NqU7/d1G839dtN/XZTv93UP2PqnzH1z5j6Z0z9M7HrgrfbzFfHvh7NsZ2vjt3q 4x2eE+6M6mL1wcdiqegnsYHgithg8MFYOrg0lo3aYrngTcEnbPGsLZ61xbO2eNYWz9riWVs8a4tn bfGsLZ61xbO2eMpzwKDngEHT32z6m01/85mvGuRMdM5E50x0zkTnbPzdprrZVDeb6mZT3Wyqm939 E+7+CXf/hLt/wq2g4FZQcCsouBUU3AoKbgUFt4KCW0HBraDgVlBwxw7dsUM7KXTHLLhjFtwxC+6Y BTeY0aIXPSHtQyv2n35SOuAWkdSZvLvXBTqTd/+6IGhU9WxVz1b1bFXPVvVsVc9W9WxVz1b1bFXP VvVsVX9P1d9T9fdUPa7qcVWPn76v/dDdZoGnl3/HHbgTP8JdOvVjlOJuLIyWqnCpCpeqcKkKl6pw qQqXqnCpCpeqcKkKG1TYYLsXbPeC7V6w3Qu2e8F2LwQpz3kDGMQbeCq2rTts6w7busO27rCtO2zr Dtu6w7busK07bOsO27rDtj5oWx+0rQ/a1gdt64O29UHb+qBtfdC2PmhbH7Stj9jWXbZ1l23dZVt3 2dZdtnWXbd1lW3fZ1l22dVfRJW6PU/E+XIq/xftxGS7HFfgAPogP4UpchQ/jI5iGj+JjuBofxyfw SVyDT+HT+Az+Dn+Pz+Jz+Dy+gGtRjC/iS/gy/gHTcZ1arscNuBEzcKf3/SPchR+jFHdjIe7BvbgP 92MRHvR3HratluIRlONRPIZl+AmWe60nsAIrsQqrsQZrsQ7rUYENeAobsQmV2Iyn8TNUYQu24hlU owbb0IQX0Iy9aDH910Vvit146kTspuBCabgidouPt/r4nehRW/OXwQdtzWKbcKpNONWkt5n0NpPe dibfo/I9Kt+j8j0q36PBD2VpQfSS6X/J9L9k+l8y/S/ZWlNtram21lRba6qtNdXWmmprTbW1ptpa U22tqTbRZ2yizwQT/nwKUTC1KEARvhJcXfSP+Cq+hn/C7GB60Z7g3Ww3O3Z98HFVnKuCc2PfCRbF 7greFSsN/jK2MHhXcMfv+MrGMbv/mN1/zO4/Zvcfs/NDOz+080M7P7TzQzs/tPNDOz+080M7P7Tz Q08Ng54aBj01DHpqGPTUMOipYdKGoW6FuhXq1oBu5XUrr1t53crrVv6sz3Fmxd4+am8ftbeP2ttH 7e2j9na/vd1vb/fb2/32dr9uxXQrZm/329v99na/vd1vb/fb2/32dr+93W9v99vb/fZ2v73db2/3 c8U4V4xzxThXjHPFOFeMc8U4V4xzxThXjHPFuF09cNavx76qtl/hBE7itdNP4Ifl/7D8H5b/w/J/ WP4Py/9h+T8s/4fl/7AsdcpSpyx1ylKnLHXKUqcsdcpSpyx1ylKnLHXKUqfd97Ld12f39dl9fXZf n93XZ/f12X19dl+f3ddn9/XFbgzODz7H6MOMPszow4w+zOjDjD7M6MOMPszow4w+zOjDjH6S0ccZ fdzJjTi5ESc34uRGnNywkxt2csNObtjJDbP8K04vdHqh0wudXuj0Jp9mT7H6KVY/xeqnWP0Uq59i 9VOsforVT7H6Kbembrembrembt09oLvdututu92626273XZaQod36vBOHd6pwzt1eKdOZHWioBMF nSjoREEnCjqR1om0TqR1Iq0TaXsudAMYsedCN4ARqR4vepfOlOhMic6U6EyJzpToTInOlOiM53tc iLfiouh62emUnU7Z6ZSdTtnplJ1O2WmUnUbZaZSdRtlp1MW4LsZlaI8M7ZGhPTK0R4b2yNAeGdoj Q3tkaI8M7ZGhPTJ0XIaOy9BxGTouQ8dl6HjwreDPg3/Gt7Ewmqaz03R2ms5O09lpOjtNZ6fp7DSd naaz04KHoxoZulmGbpahm2XoZhm6WYZuDn7iv/0UT2AFnsRKrMJqrMFarMN6VGCD+p/CRmxCJTb7 90+jCluwFc+gGjXYhlo8izpsx47oUXv80eA5f/45dqEecezGL/BLNKARe9CEF9CMvc6iBS9iH1qx HwfQhpfQjg4cRKe/04Vufz7kYwI9OIxek3QEfTiKfiSRjso5oZwTyjmhnBPKOaGcE8o5oZwTyjmh nBPKTe2zprbW1Naa2lpTW2tqa03tNlPbZ2r7TG2fqe0ztX1uZ71uZ71uZ71uZ73uHyXuHyXuHyXu HyXuHyXuHyXuHyXuHyXuHyXuHyXuHyXuH9PdP6a7f0x3/5ju/jHd/WO6+8d094/p7h/T3T+mu3/M 4Z9i/inmn2L+KeafYv4p5p9i/inmn2L+KS76SjS76B/xVXwN/4Tr/P3rcQNuxAzcErzXE/qnPaHf 7Qn9a57Qb/OEfq0n9FJP6J/yhF7qCb3UE3qpJ/RST+ilntBLPaGXclwxxxVzXDHHFXNcMccVc1wx xxVzXDHHFXNcMccVe0IvdWeY4wm91BN6qSf0Uk/ope4Qs9whZrlDzHKHmOUOMcsdYpY7xCx3iFme nEs9OZd6ci715FzqybnUk3OpJ+dST86lnpxLPTmXenIuZY/17FHJHpXsUckelexR6ba8gUHWMcg6 BlnHIOsYZJ0b9Fw36Llu0HPdoOe6M1wWuz4qi90QLXCTvsrd4Z1n7g7vPHN3eIxlSmL10YZYyrOF e2nsZc8d2eDrwV8wTzvztDNPO/O0M08787QzTzvztDNPO/O0M0878xxhk2426Zb+Yekflv5h6R+W /mHpH5b+Yekflv5h6R/+reeBk6e/43WjTXOOV13tVVd71dVedbVXXe1VV3vV1V7VbQsX4q24KPrO 77grpPkuzXdpvvPUhI9FW73Dya80DvLdIN8N8t0g3w3y3SDfDfLdIN8N8t0g3w3y3SjfjfLdKN+N 8t0o340G/xacp9L5Kp2v0vkqna/S+Sqdr9L5Kp2v0vkqnX/mux4reW4lz63kuZU8t5LnVv6e3/V4 kuee5Lknee5Jnnvy9/yuR6MTaPx/+K7HZp7bzHObeW4zz23muc08t5nnNvPcZp7bzHObeW7zb33X Y/NZvuvxPM89z3PP89zzPPc8zz3Pc10818VzXTzXxXNdPNfFc10818VzXTzXxXNdJqmdu17lrle5 61XuepW7yrirjLvKuKuMu8q4q4y7yrirjLvKuKuMu8q463Huepy7Hueux7nrce56nLse567Huetx 7nqcuzZx13LuWs5dy7lrOXct567l3LWcu5Zz13LuWs5dK7hrBXet4K4V3LWCuzZx1ybu2sRdm7hr E3dd/lvu+gJ3/YC7Pstdrdz1Ee5q5a5W7mrlrlbuauWuVu5q5a5K7qrkrkruquSuSu6q5K5K7qrk rkruquSuSu6q5K5W7trEXa3c1cpdrdzVyl0buGsDd23grg3ctYG7NnDXBu7awF2t3NXKXa3c1cpd rdzVyl2t3NXKXa3c1cpdrfzUy0+9/NTLT7381MtPVfxUxU9V/FQl9Tfx06P8VCf9H+Kmq3jpKl5a xktPcNHPuej6ovNYYR0rrGOFdaywjhXWscI6VljHCp67cCHeiouie3/HVw9zrJBjhRwr5Fghxwob WWEjK+RYIccKOVbIsUKOFXKskGOFHCvkWCHHCrnXvQVN3jUXRotYYRErLGKFRaywiBUWscIiVljE CotYYRErFFihhhVqWKGGFWpYoYYValihwAoFViiwQoEVCqxQYIUCKxRYocAKBVYosEKBFQqsUMMK NaxQwwo1rFDDCgVWKLBCgRUKrFBghQIrFFihwAoFViiwQoEVCqww+XWaZ1nhWVYosEKBFQqsUGCF AisUWKHACgVWKLBCgRUKrFBghQIrFFihhhVqWKGGFWpYoYYValihhhVqWKGGFWpYoYYValihwAoF VqhhhQIrFFihwAoFVkiyQpIVkqyQZIUkKyTf4Pc/C24/abeftNtP2u0n7faTZouW1/n+5wCDDDDI AIMMMMgOBtnBIDsYZAeD7GCQHQyyg0F2MMgOBtnBIDsYpJpBqhmkmkGqGaSaQaoZpJpBqhmkmkGq GWQ7g9QySC2D1DJILYPUMkgtg9QySC2D1DJILYPsZZC9DLKXQfYyyF4G2c4g2xlkO4NsZ5DtDPI2 BvkbBvmfDHI5g1zOIJcySAOD/A2DNDBIA4M0MEgDgzQwSAODNPweBmlgkO0M0sAgDQzSwCANDFLH IHUMUscgdQxSxyB1DFLHIHUM0sAgDQzSwCANDNLAIA0M0sAgDQzSwCANDNLg9jP5M1ItLNLCIi0s 0sIiLaxxCWt8izE+yBhvZYy3ssXGYL3UN0l9k9Q3SX2T1DdJfZPUx6U+LvVxqY9L/eQzT5O0N0l7 k7Q3SXuTtDdJe5O0N0l7k7Q3SXvT6/604VJ36EdQjkfxGJZhA57CRmxCJf7PdwtrpaNWOmqlo1Y6 aqWjVjpqpaNWOmqlo1Y6aqWjVipqpSCUglAKQikIpSCUgtCTabMn02ZPps0SsU8i9knEPonYJxH7 JGKfROyTiH0SsU8i9knEPololoh2iWiXiHaJaJeIdml4URpelIYXpeFFaXhRGiJpiKQhkobI5HaY 3EMm95DJPWRyD5ncQyb3kMk9ZHIPmdxDJveQyR03ueMmd9zkjpvccZPbYXI7TG6Hye0wuR2mL2H6 EqYvYfoSpi9h+hKmL2H6EqYvYfoSpi9h+hImr6NoedRf9ARWYCVWYTXWYC3WYT0qsAFPYSM2oRKb 8TR+hipswVY8g2rUYBtqT38tv9k9fL97+H738P3u4fvdw/ebzoOm86DpPGg6D5rOg6ef4H/99L6l 6Nv21u321u321u321u321u321u321u321u321u321u321u321ldM8C4TvMsE7zLBu0zwLhO8ywTv MsG7TPAuE7zLBO+ytx62tx42yfUmud4k15vkepNcb5LrTXK9Sa43yfUmud4k1weT3/u/FSWYidvw Tfznn5td6An8HtyL+3A/FuEBLMaDeAgPS9LS6LtS8F0p+K4UfFcKvisF37XD4nZY3A6L22FxOyxu h8XtsLgdFrfD4nZY3A6L22FxOywuOfMkZ57kzJOceZIzzw6L22FxOyxuh8XtsLgdFrfD4nZY3A6L 22FxOyxuh8XtsLgd9lM77Kd2WNwOi9thcTssbofF7bC4HRa3w+J2WNwOi9thcTssbofF7bC4lM6T 0nlSOk9K50npPCmdJ6XzpHSelM6T0nlSOk9K59lhcTssLq3z7LC4HRa3w+J2WFx6V0nvKuldJb2r pHeV9K6S3g7p7ZDeDultk9426W2T3jbpbZPeNultk9426W2T3jbpbZPendJbJb1V0lslvVXSW2Wf rZbgNgluk+A2CW6T4DYJfk54n5Pg5yT4OftsgX22wD5bYJ8tsM8W2GcL7LMF9tkC+2yBfbbAPltg n820z2baZzPts5n22Uz7bKZ9NtM+m2mfzbTPZrLCnawwhxXmsMIcVpjDCnNYYQ4rzGGFOawwhxXm FF0S/aJoKt6HS/G3eD8uw+W4Ah/AB/EhXImr8GF8BNPwUXwMV+Pj+AQ+iWvwKXwan8Hf4e/xWXwO n8cXcC2K8UV8CV/GP2A6vuLp+R/xVXwN/4Tr1Hc9bsCNmIGbo6N27iVFt0Y77d3L7d1b7d0r7d2v 2bvX2Ltri2azxL/6b9/35x9gHubjh1iAO3BnNIv9ZrHfLPabxX6z2G8W+81iv1nsN4v9ZrHfLPab ZfeuZcA77d61du9au3et3bvW7l1i9y6xe5fYvUvs3iV27xK7d4ndu6Top/b1cuZ8AiuwEquwGmuw FuuwHhXYgKewEZtQic14Gj9DFbZgK55BNWqwDbXez7Oow3bswE48h59jF+oRx24z+by+/wK/RAMa sUdfZZJh4wwbZ9g4w8Y9RazwFLHCU8QKTxEr3Af+wH3gB54ivu1O8MfuBH/mTvBnniIWsvCDsWQ0 6klibywTDXqaeH8sF+WDCmYeY+YxZh5j5jFmHmPmMWYeY+YxZh5j5jFmHmPlNCunWTnNymlWTrNy +nV+iyHDxhk2zrBxho0zbJxh4wwbZ9g4w8YZNp78WdRXg+/jB5iH+ViAf8cduBM/wtKok2E7GbaT YTsZtpNhO9myky072bKTLTvZstM94yr3jKsYrJPBOhmsk8E6GayTwToZrJPBOhmsk8E6GayTwTqZ q5ORTjDSCUY6wUg5RsoxUo6RcoyUY6QcI+UYKcdIOUbKMVKOkY4yUoaRMoyUYaQMI2XYKMNGGTbK sFGGjTLsc5x9jrPPcfY5zj7H2ec4+xxnn+On/5+nb8GFeFs0yj6j7DPKPqPsM8o+o+wzyj6j7DPK PqPsk2effvbpZ59+9ulnn3726WeffvbpZ59+9umX5Lwk5yU5XzT5M2ozcEvwdgl+nwTPluCPSPBn Jfg9knuJdKakMyWdKelMSWdKOlPSmZLOlHSmpDMlnSnpTElm3kS3m+iEiU6Y6ISJTpjoyd+56THN Paa5xzT3mOYe03qZab3MpLYHn3PSKSedctIpJ51y0iknnXLSLzvpl530y076ZSf9spO+wklf4aQz TjrjpDNOOuOkM04646QzTjrjpDNOOuOkM04646QzdtIpO+mUnXTKTjplJ52ykya/1/GECXjCBDxh AnpMQI8J6DEBPSagxwT0mIAeE9BjAnpMQI8J6DEBW0zAFhOwxQRsMQFbTMCWyZ/nNgWLTcFiU7DY FCw2BYtjX/bEf13wljO/afQVt6adsW9EX4/dHDXGbvHPnBor8c8z/fPc6LXgajeSjBtJxo0k40aS cSPJuJFk3EgybiQZN5KMG0lGBzM6mNHBjA5mdDCjgxkdzOlgTgdzOpjTwdzv9b24Xn/vCPpwFP1I ns5ATgdGdWBUB0Z1YFQHRk//DPirblS/wgmcxGv4zz8XfnPw5thMTP4GyFX/1Z+0VMGECiZUMKGC CRVMqGBCBRMqmFDBhAomVDChggkVTKggUkGkgkgFkQoiFUTOvsXZtzj7FtX0vM4z8wHVtKimRTUt qmlRTYtqQtWEqglVM/kToCnn+rIznfx505djk/fNy4Iyzz9LoyPO54jzOeJ8jjifI87nyFnPZ0fw ThP+TlXmVJlTZU6VOVXmVJlTZU6VOVXmVJlTZU6VOVXmglRwfjCAQYyY7InokHd+wjs/4Z2f8M5P eOcnfuu3Db4R+0YQcw4Xnvmtg2/ESvzzzODC4BLnkXIeKeeRch4p55FyHinnkXIeKeeRch6poMzp 7fDqOyffgaenAQzi14Y822/J7POuDnlXh7yrQ97VIe/qkH5m9DOjnxn9zHiXe8/81kBGT9N6mtHT dOy2KBn7ZpQMrvUOl3mHy7zDZd7hMu9wmXe4zDtc5h0u8w6XeYfLvMOfOYMBZzDgDAacwYAzGHAG A84gdAahMwidQegMwv/4GvFelbXgRexDK/bjANrwEtrRgYPoxuv9lOtI1KsbfbrRpxt9utGnG32n v377qgn9FU7gJF7DqWhEN0Z0Y0Q3RnSjWDeudW7nObf3Obc3O7cpzu085/Y+5zaZpSm6U6w7xW4C DbH9waXBn6p+8ncCT6n+lOpPqf6U6k+pftJ9Y85rzHmNnfma0dnS3He2rxn9Jr3Bm/zpXH869/R3 QXucSI8T6XEiPU6kx4n0OJEeJ9LjRHqcSI/39Pq/R/jrn5X6z79Bslv1PV7pHK90jipTscnfyyj2 ikmvmPSKSa+Y9IpJr5j0ikmvmPSKSa84+XMLFTpQoQMVOlChAxU6UOH8K5x/hfOvcP4Vzr9CBi+Q wQucf4Xzr3D+Fc6/wvlXOP8K51/h/Cucf4Xzr3D+Fc6/wvlXqOqYqo6p6piqjqnqmKqO2Sz9Nku/ zdJvs/TbLP02S7/N0m+z9Nss/TZLv83S7yQGnUTCSSScRMJJJJxE4sxmOeIkjjiJI07iiJM4YibO MRPvNRPn69AnzcQ5ZuK9ZuJ83fokvyaCLwULg3cH9+Be3If7sQgPYDEexEMoCz6tW6261apbrbrV qlututX6Orev3+zkHt3q0a0e3erRrR7d6tGtHt3q0a0e3erRrR7d6tGtHvNXaf4qzV/lG3weXKtD K3VopQ6t1KGVOrRSdxbpziLdWaQ7i3RnkZ17LodcY99+n0cus2+/xyXX2Lff55PL7Nvvxe6IdsXu jGpjB4JLY23Bu2LtwVQVLTSl9+Be3If7sQgPYDEexEMom/S2M9t5Ov+vd8vYo9I9Kt3j3ae9+5x3 n/Puc959zrvPOd89/8VN0yYN/Wd+SvBcVe0785OC56pon3QMxiZ/xmcyHWUqKFNBmQrKVFCmgjIV lKmgTAVlKihTwR3OPO/M884878zzzjzvzPNn31IcvhN75bQFL2IfWrEfB9CGl9CODhxEN3o55Qj6 cBT98LyiQwUdKuhQQYdGdGhChyZ0aEKHJnRo0g09OvSKDr2iQ6/o0Cs69IoOpXQopUMpHUrp0J/q 0J9LxkU6dKVUnCcVF+nQlRJxng59VIc+ypJ3S0fX5LYLpkjHFOmYIh1TpGOKdEyRjinSMUU6pkjH FOn4sIl/j4l/z//11YwRuX2FRUcxhuMYx0TwR97xoHc86B0PeseD3vGgqfxi7Hrv5ibn+I2oz/n1 O7u+2G1y+018J7gndlfw7lgpFgb/Pfiksxx0loPOctBZDjrLQWc56CwHneWgsxx0loPOccg5DjnH Iec45ByHnOOQcxxyjkPOccg5DjnHIec35PyGnN+Q8xtyfkPOb8j5DTm/Iec35PyGnN+Q8xtyfkO/ 4yuzWd3I6kb2zO9fne0nspI6kdSJpE4kdSLp7Ead3aizG3V2o87rvNN3qFt9nLxDXaPyYyo/pvJj Kj+m8mMqP6byYyo/pvJjKj9mikdUn1N9TvU51edUn1N9TvVjqh9T/Zjqx1Q/ZoonTPGELozpwpgu jOnCmC6M6cKYLozpwpgujOnCmC6M6cKYLoz9jpwf04VjunBMF4Z1YUQXRnRhRBdGdGHEFB8960a9 Kcqx1IRZyLHThMkcOV19uerLVV+u+nLVl6u+XPXlqi9Xfbnqy1V/r+p3q3636nerfrfqd6t+t+rr VV+v+nrV16u+XvUdqu9QfaPqG1XfqPpG1TeqvlH1japvVH2j6htV36j6RtU3qv6k6k+q/qTqT6r+ pOonf6bhC7HrTfIN3HqjP98UXOw8bzizmabL4MXO9YYzm2m6HD4ohw/KYYVqH3Jj+Wzspag61hGd ih0MbgvervrDqj+s+sOqP6z6w6o/rPrDqj+s+sOqP6z6nt/8dIV3kfDq3T57wmdPnM7ONp9lm8+y zWfZ5rNs81m2+SzbfJZtPss2n2Wbz/IjPezVw1497NXDXj3s1cNePUzoYUIPE3qY0MOEV3zOKz73 e94UT+jhCT08oYcn9PCEHk7ezm/Tw5f0sF0Vn9LDN+vhtXp4kR6W6OGb9fBaPbxID0tU+bAqH9bD Mj1s0sNiPezQvxmnnyGrVF6l8iqVV6m8SuVVKq9SeZXKq1RedeaO/HpP4mf52U5beCd+v/+DxFmn Ry4m77k3qP6g6jtUX3ym+mmqP0/1c89UP03156l+ruofV/3jp38e+AP/5Z/LXxpVq7RapdUqrVZp tUqrVbpFpVtUukWlW1S65bd+irVOpXUqrVNpnUrrVFqn0jqV1qm0TqV1Kq1TaZ1K6/43c3ceH3V9 73v8NzMx4pBoXdHaW9u6a60i2FrX1lqrx2pFq9V6jrfnHKsXIUXF3YILiHWh7ktbW7VaxA3UuBRB VBaBECAEQsYQQGbIyiwQmBlA7e8+Zxi9tNV7rv+cx334eDkh8/tu78/78/l+f8nM5PNOg1b0NSva zooutZqvWU3pXHupVTwTnGQV461ivFWMt4rxVjHeKsZbxXirGG8V461ivJj98nPfWTwhnGMlc6xk jpXMsZI5YrZIzBZZSYOVNFhJg5U0WEmDlTRYSYOVNFhJg5U0WEmDlTRYSYOVbLGSLVayxUq2WMkW K9nyT9X7XCer88KF4rdM/I6tnE3PsNq9rPbOytn0DCvey4rvFL87xe9O7r3D6l/i3pO4t4F7jwgG UaKPEn2U6KNEHyX6KNFHiT5K9FGijxKlqt9KhVYqtFKhlQqtVGj9nPNqP/HsR4VWKrRSoZUKrVRo pUIrFVqp0EqFViq0UqGVCq1UaFXNi6p5UTUvquZF1bz4WT/psOKBVnu0lQ60yqOt7P3grMhBNDoY h+BQfBOH4Vs4HEdgII7EIAzGUfg2voOj8V0cg2NxHI7HCTgR38P3cRJ+gJPxQ5yCH+FUnIZ/wen4 Mc7AmfgJfh9mIn/AY/gTHscTeBJ/xlN4Gn/BBDyDiXgWz+F5vIAXMan015PwEl7GK6jHqyj9lvtd 97UzMBOzMBvveW5O2BaZi3lowHw1/Ofu/C5S339KwSwFsxTMUjBLwSwFsxTMUjBLwSwFsxTMUjBL wSwFsxTMUjBLwSwFsxTMUjBLwSwFsxTMUjBLwSwFsxTMUjBLwSwFsxTMUjBLwSwFsxTMUjBLwSwF sxTMUrD0XsQ8BfMUzFMwT8E8BfMUzFMwT8E8BfMUzFMwT8E8BfMUzFMwT8E8BfMUzFMwT8E8BfMU zFMwT8E8BfMULFCwQMECBQsULFCwQMHVFNxAwQ0U3EDBDRTcEGl057AAC7HIDlm6cyi9n/hfKZqj aI6iOYrmKJqjaI6iOYrmKJqjaI6iOYrmKJqjaI6iOYrmKJqjaI6iOYrmKJqjaI6iOYrmKJqjaI6i OYrmKJqjaI6iOYrmKJqjaI6iOYrmKJqjaI6iOYrmIvda1X24Hw/gQTyEh/EIfh8WKV6keJHiRYoX KV6keJHiRYoXKV6keJHiRYoXKV6keJHiRYoXKV6keJHiRYoXKV6keJHiRYoXKV78vyjeSvECxQsU L1C8QPECxddQfA3F11B8Tflsd1HpFVmRqFXFUIXtUI3t0Q87II7+qMUojMZNuBm34FbY5yL2uYh9 LmKfi9jnIqV9Lh7ZKdgn8nMMRx1G4HJcgStxFUp3+3eaR8I8EuaRMI+EeSTMI2EeCfNImEfCPBLm kYh8KVwS2Rm7YFfsht2xBwZgT+yFL4fzI18NF0T2wdfwdXwD+2I/7I8DcCD+f/9UnLPCWZEhOBvn 4Kc41/rOw89wPi7AqLBFjFrEqEWMWsSoRYxaxKhFjFrEqEWMWsSoRYxaIndpc2/YwdUdXN3B1R1c 3cHVHVzdwdUdkXeC2si7QXVkBmZiFmZjjgjPxTw0YD7+MbfPdU97fnhd5exdVzlz19mD5pXfc/RE MCA2NTgq9q67z2SwbywVnBNbE+wS6wi+HOvy7+5gt1iPXbjX99YGRwXncEoXp3RxShendHFKF6d0 cUoXp3RxShendHFKF6d0cUoXp3RxShendHFKF6d0cUoXp3RxShen9HBKL6f0ckovp/RySi+n9HJK L6f0ckovp/RSvYfqPVTvoXoP1XuonqZ6muppqqepnqZ6muppqqepnqZ6muppqqepXnofbEqtSKkV KbUipVak1IqUWpFSK1JqRUqtSKkVKbUipVak1IqUWpFSK1JqRUqtSKkVKbUipVak1IqUWpFSK1Jq RUqtSFG+P+V/RPn+lP8R5d+l+B6x6cE3gp9Rs42abdRso2YbNduo2UbNNmq2UbONmm3UbPsCvw3M UDNHzRw1c9TMUTNHzRw1c9TMUTNHzVzkrGDXyBCcjXPwU5yr/Xn4Gc7HBRhlRx6Nm3AzbsGtcCaj cB+F+yjcR+E+CvdROPPf9Qql2Lk8vPVdgedU3hV4Tmx4cFoQ9Z3S6/z3CKo8369833RR+T13pwU7 qo01amON2lijNtaojTVqY43aWKM21qiNNWpjjZYHanm2lgdqeXa55d5a7q3l3lrureXeWu6t5d5a 7q3l3lrureVuWv5Ky920/FW5Za2WtVrWalmrZa2WtVrWalmrZa2WtVoeUD41XuTRqfELzfaA8s+4 trYcXNbgkNLvBILzeG0Fr63gtRW8toLXVvDaCl5bwWsreG0Fr63gtRW81sRrTbzWxGtNvNbEa028 1sRrTbzWxGtNvDaX16bz2nRem85r03ltOq9N57XpvDad16bz2nS+mstXc/lqLl/N5au5fDWVr6by 1VS+mspXU/lqKl9N5aupfDWVr6by1VS+mspXc9XLjHqZUS8z6mVGvcyolxn1MqNelnxX4LsC3xX4 rsB3Bb4r8F2B7wp8V+C7At8V+K7AdwW+K/Bdge8KfFfguwLfFfiuwHcFvivwXYHvCnxX4LtC5LWw UzbXBzs7DxSdBzY5D2xyHtjkPLDJeWCT80DCeSDvPJB3Hsg7D+SdB/KqdIcq3aFKd6jSHar08mA7 uRiXi3G5GJeLcbkYD4aI2jJRWyZqy0RtmagtE7VlorZM1JaJ2jJRWyZqy0QtKWpJUUuKWlLUkqKW FLWkqCVFLSlqSVFbI2odotYhah2i1iFqHaLWIWodotYhah2i1mHnW2PnW2PnW2PnW2PnWyOSa0Ry jUiuEck1IrlGJFeJ5CqRXCWSq0RylUiuEslVIrlKJFeJ5CqRXCWSq0RyzX/1yUN2vl3tfP3tfP3t fP3tfP3tfP0/a+ej4VnlV8T+PPgKz18oA77C9xeK0KzyvULG+SLjfJFxvsg4X2ScLzLOFxnni4zz Rcb5IuN8kXG+yDhfZJwvMs4XGeeLjPNFxvki43yRcb7IOF9knC8yzhcZ54uM80XG+SLjfJFxvsg4 X2ScLzLOFxnni4zzRcb5IuN8kXG+yDhfZJwvMs4XGeeLkmd7eLaHZ3t4todne3i2h2d7eLaHZ3t4 todne3i2h2d7eLaHZ3t4todne3i2h2d7eLaHZ3t4todne3i2h2d7eLaHU1d/zsm197NencGpWU7N cmqWU7NOrh2x0ruIz6VokqJJiiYpmqRokqJJiiYpmqRokqJJiiYpmqRokqJJiiYpmqRokqJJiiYp mqRokqJJiiYpmqRokqJJiiYpmqRokqJJiiYpmqRokqJJiiYpmqRokqJJiiYpWvp0yyRFkxRNUjRJ 0SRFkxRNUjRJ0SRFkxRNUjRJ0SRFkxRNUjRJ0SRFkxRNUjRJ0SRFkxRNUjRJ0SRFk6pAjqrJz3y9 y3u+/xmvkaVqJ1U7qdpJ1U6qNlG1KXhEtidle1K2J2V7UrYnZXtStidle1K2J2V7UrYnv8DpqvRO 57RsT8v2tGxPy/a0bE/L9rRsT8v2tGxPRw6SXQfjEByKb+IwfAuH4wgMxJEYhME4Ct/Gd3A0votj cCyOw/E4ASfie/g+TsIPcDJ+iFPwI5yK0/AvOB0/xhk4Ez/BZ1ejf/58tFFyajRuws24BbdiDMbi NozD7fgNtn4OWlE1KqpGRdWoqBoVVaOialRUjYqR36s0f8Bj+BMexxN4En/GU3gaf8EEPIOJeBbP 4Xm8gBcxCZPxEl7GK6jHq3jHXv4uZmAmZmH2Z38qwj856dzw31XB8yu/6zqu8nuu41TBxWV39XBX D3f1cFcPd/VwVw939XBXD3f1cFcPd/VwV5q70tyV5q40d6W5K81dae5Kc1eau9KV155luSvLXVnu ynJXlruy3JXlrix3Zbkry13V3FXNXdXcVc1d1dxVzV3V3FXNXdXcVc1d1dxVzV3V3FXNXdXcVc1d 1dxVzV3V3FXNXdXcVc1d1dxVzV3V3FXNXdXcVc1d1dxVzV3V3FXNXdXcVc1d1dxVzV3V3FXNXdXc Vc1dWe7KcleWu7Lclf3M18t9cXdl/+tPrgqquKuKu6q4q4q7qririruquKuKu6q4q4q7qririruq uKuKu6q4q4q7qririruquKuKu6q4q4q7qririruquKuq4q5+3NWPu/pxVz/u6vc57spxV467ctyV q+yxoz7DXS3B+dy1nLuWc9dy7lrOXcu5azl3Leeu5dy1nLuWc9dy7mrmrmbuauauZu5q5q5m7mrm rmbuauau5sq7LRq4q4G7GrirgbsauKuBuxq4q4G7Grir4XPeWTFPpOaJ1DyRmidS80RqnkjNE6l5 IjVPpOaJ1DyRmld+Z8W97qHuw/14AA/iITyMR0o/GeWUP+Ax/AmP4wk8iT/jKTyNv2ACnsFEPIvn 8DxewIuYhMl4CS/jFdTjVbxW+jyEYBCFB1F4Rjl/V1N4NYVXU3g1hVdTeDWFV1N4NYVXU3g1hVdT uJPCnRTupHAnhTsp3EnhTgp3UriTwp0U7qZwF4W7KNxF4S4Kd1G4i8JdFO6icBeFu+RvXP7G5W9c /sblb1z+xuVvXP7G5W9c/sblb1z+xuVvXP7G5W9c/sblb1z+xuVvXP7G5W9c/sblb1z+xuVvXP7G 5W9c/sblb1z+xuVvXP7G5W9c/sblb1z+xuVvXP7G5W9c/sblb6f87ZS/nfK3U/52ckU3V3RzRTdX dHNFN1d0c0U3V3RzRTdXdHNFN1d0c0U3V3RzRTdXdHNFN1d0/9d3Hf+tu8Nn5e9n/TToH/P3V/L3 +kr+nlDJ3xPKr729+gt+JuL/688Am7mrmbuauauZu5q5q5m7mrmrmbuauauZu5qdKAtOlAUnyoIT ZcGJsuBEWXCiLDhRFpwoC06UBSfKghNlwYmy4ERZcKIsOFEWnCgLTpQFJ8qCE2XBibLgRFlwoiw4 URacKAtOlAUnyoITZcGJsuBEWXCiLDhRFpwoC06UBSfKghNlwYmy4ERZcKIsOFEWuCvHXTnuynFX jrty3NXMXc3c1cxdzdzVzF1LuGsJdy3hriXctYS7lnDXEu5awl1LuGsJdy3hriXc1cxdvdzVy129 3NXLXb3c1ctdvdzVqxYUnDKzn/npp3N8fy7moQHzy68EKt39fCWojR4TpqI/wKnhv0ZPCy+Pnh5e HjsjnBk71z3T+eVPRC39nYPJlb9zMJkXMkH/6BFhb3QwvoMTcWq4WOv5Ws+PnhEu5aSVWrZr1R7s 6Oq0q9OuLhhvlRZpY66KDvF4vu9d6OuLUYc7wuXRO8PlxukK4lrmtcxr1aFVXqsOV6x2xWprOMwa DnPl/PIYna7sNEarKzvNqNGMFpjRgmh5PeHc0icoVD5XurbyudK1QT99T9TvRLOYZBaTzGKSMd4x xjvlV8Ptou+h+h6q75S+h+q7qO+N+t6o79KcE65OxM7928bY+X/LV37adHjlp02HV145NKvc0y/0 9AtjztPTL4w7L3pq8D/0cKYezqy8d/OuymsiDql8IsWgyidSDKp8IsUFwZf0dIWerjCnjXqbq7cr 9DZXT5fo6RI91ejpPj1do6dd9LKPHvbRw2g9XBtsr9UsLWZpsUyLZa7YxRW7ePaBYCdqbKDGhujQ 8JnoZeGD0WEYjrpwwz/440b+eIueN/LHW1pvFLchPHE+hvLFZTwxDMPxK+OcG37wqTciru81lyFi e6HYXow695AXln8+dYBnm3l0iO+eH76vt0a9NeqtUW+Nenv3H+K6YyWuO5Z7XmUdQ8J6bZPaFrX9 SNuPtP1I21Xa9tO2P5Xj5fcZXOSx9F6Drb9ffq/ceox5zTWvudGhwVfMba5W/0nZzZQtaD1W6wGV n8YNKP8Od3j4SOm30+V5X2HsjZ/2sLX10Vovqryn/5Ryy62tHtDK/u7qBa5e4OoFnt3ds7t75iFO vdq8rwk3R6/l77HBdtHxYTb6kBx6NMxEfycvo57dEh0bFoKI/28Wh2tl13VWfj3Ghi3RcXq5XS93 h93Rh0t/Rzv8UMsPffdKfY3E1Xq4ls9HhV36XxN9MMxF3d3w7pUUH4mrffc6V16Pm8Km6M24Bbdi bLB7dFw4OXqP6+4NP4jeh/vxAB4NpxhrSlBllitdtcRVq6MPh+vNe2zYZ05FM74y3GSUTUbYYoTS alZzaIFDC64o6GWTXjaZ8TVmWVrfKG1Hm+VYVWCc790j2g+HueDL+pqur+lm3O3KufpM6TMVvcG/ R4U9WvVZQdoK0laQtoK08T423nTjTTfe+uhvwzlW0molrVbSaiWtNGmk+3vm0mIuLcHeRuowUoeR NpjXDKPljNBmhLVGyBoha4SsEbLmWWOerxglbZR01Omf0t3m/aKRuo3UbaRuI3UbKWOk9dbzltFW GW1VsIPRCkYrlFe/tbeNeluvt/V6Kuhpoxp9nThfj7HGGEfZu1x5tyvLV/j6YTzKF7+rRLdbn91a pbVKm3WvWfeada9Z95bH+WTG+v+nmT7qmt/J5VIs15V/Ylmtz7Q+01aRtooO16Rdky7HLv/389Pj XeWZF6y1oCJco/1YfY4z7l2+vpsP7uGuh4O46veJAleL1iiMDvZy9UdmuM4M17l6k3WuE72NWn3L DApmsPFT95Q8WPLYejNYr+WcT3NnYxArPzcW42TGTsZqMFaDqzOuzhirlF1tZrad8bqM11XW9h7/ flBuPMRZj/re7+xgsXK+bl3hpmBwdJIYvhbsEX0rXBSdjne5coa5zQxvjs4Kn4zOxhx70fzw19GF 4dhos2taPC5DjsrrsEEf+fCeaCF8M1rEZnn3cfjHWKDuVIXdse099kOtr/cI87EB2BMH4WAcFm6M HW4nHxhOjx2JQRis5h5t1z02fDVmn/30Lx2dF3wp9rOgpvI+pCNU+pdU2CNU+pfUpG4719PWNgkz qD8zXGoVG61io1Vsjs71ON9+vlA1W2qVLR6XoZuHe0QxL/8K3F/ElnC9FXxg9h+Y/QexvVTYw8OU WW4wyw1muSHmNGeGyWDPyqht9Ntk1FajZoyaMepHRl1j1IRRW426waitRm01WsFofUbrM1KfkfqM 1GeUzUbJGyVvlLwRMsEII1wSfS680Siboq+FL0X/Go6KTsFb6sJ0vIsZqueccEJ0Pvc0+/dS2Z4I fxl9P5wWbcNytGMFVoaXRld5TLouFb4RXePrDnShO7g62hM+Hu319Vqkw2uiGY9Z5JwS1mG9r/uw ITwvulGlKFhhEZvDE2j3XvRDz32Ej8PXo3/zGIpgBFHEwlmc8YvYdr6uDn8bizsT9Pd1jfN+bdgS 2ym8IvYl7IxdsFv4dc4ZzDmDOWewWAyNfTm8Kra3576CfYJLYl/3+A3sG343th/29/wB/n0gDgr3 5bR9Y4f4+ps4LPxG7FvhSZR+itLXUvpaSl/LdaeI6R9i33bNd3B0eHfsux6PwbHhm7HjPB6PE5xZ TjSP7/n6++GFlVc9rrKHPmEPvcwO/DW779diQ8vnj3eDQ0VptSitFqXV/LF6G3+s4I1O3kiI2Gre SPBGgsqdVO6kbiefrKTuCuquoG4HRVP8spKCnTyzkmdWUq2HQusotI5C66x4nRWvs9J1Vpm0ypRV pqwyZZU5K8ta0QqrUBuDY+XV8fJppVxaGRzIZwX+6uavbjNvMfMWM19s5qU8aqy4eZkZt1TyaJlZ L+Obr5p5m5m3mXmz2c4z204zbTPDNeLYYZbNZtlsls3i1l+8OsWr04wTZpww46WVPHvfjN834/fN eGkpz8y2OTjIjBaY0QIzmmdGnWb0eiWrU2a0wGxSZpMym13NZq3ZrDWb1XRcRcdOOnZWalSCjq1m t5aOrXRs5cBNlTqVMsuUWabMssbsUmaXMrsms1tpdovNbrHZLTa7D+jZboZzzDBlZ3talpdmNkuu zsZcWT7fDBaqBEvtcC0el4VrZGm3E+I+pb+zqk0f3TfRvUD3gjZb+Kqdnzqci56m/HOYhE+umBle +WmNnuuMMT98rFRfxPFpcXzaeeNpJ9znKDKJcyZz22vm9Ff/noKZFJhFkdmYS735dqeF4dvRxWrf 1pi+bY5vqx85taJXDcjJ05wYLhazNjFrM79W82sN9jXSPUa62Uipv6tOM+1ms+xjszHXc/PD0Cgb K3VwoxE2GmGSEepVnCajvGeU94zyy7+Lwb7hSCOOlNVrxSIpFkmxWFPWnuaysPTakYFmM5CW79Jy DkW63aEE4cei+7Hofkzp79jrS1rOtMJZVjwb3UG1eK4Xz/Xiub5ca2+xmoet5B0rud9K7ue6Jq5r 0vec6Cw75mzMCZ+yog+5rsmKOq3k6s+ptbdXau00tfadf6i1t1h5/Ta19uZtau1I7h25Ta0dqtY2 bVNrz1NrF25Ta9/6nFo7slJrn6LuzZVaW1eptXVqbZ1aW6fW1lH+WMqfSvlTKX+qWjtOrb1Wra1T a+toeIFaW6fW1onKKaJyiqj8q1pbp9bWic4ponOKWlun1taJ0g/U2n+XNS9S+RYq30LlW0TuDLV2 vFpbp9bWyaBb1do6tbZOJt2k1taptXVq7b+J8KlqbZ0olz4j8bzKq/RfFO1r1do91do91dpFau0L waWi90vRu1L0Xha9kaI3UvSWit7SchWbIRPnhLNFbq3ILRW5LpG7SuQaRa5R5BpFrlHkGkXuHpFr FLW3Ra1R1BpFrVHU/k3UXhO1RlFrFLVHRa1R1BpF7XVRe13UGkWtUdQmi9o89ScvYm+LWErEGkWs UbQaRatRtBpFq1G0FovW66LVKFoNovWoaDWK1luitUS0pojWFNGaIlpTROuHonWPaN0jWveI1tui NUe0pojWFNG6SLSmiNYU0bpQtC4UrcmiNUW0pojWHaJ1h2hNEa0pojVetGaLVpdotYtWu2i1i9ZD orVEtKaI1pTy2ey7Ho/BcTgeJzi3nWgO3/P198O/iNRPROodkSq9//HborMoOEB0nhWdF1SKZjVp vSgtFKVnRelZkcnKzBdk5jKZuUzFeEeUMirGa+pSRqR6VI3XVI3XROxp0Zktp3pEYqEIzKJwQm4k 5UaSyl1yfykVc/J/qfxfSs1ZFHuREi9S4kWzLL1j4ezSnh3szyOLeWQxjzTyx1+NvIY/Fov1SWLa LqbtYjnfKB8YpckoTeL5RrT0LsbAnXQVnbb32A816lStXW0Pmg3Antgn+CbtizRvo3kbrd+ncwed F9B5AZ0X0LmFtu/LgAQtlzivd9t9Svvk4PAjZ/9J5fPlMAo9SqFHKTTDPG+mwmbzmmBe9eZVb/W9 lXPCJHOaZE6T3BHMDMdrOUvLWVZY1PK3Wr316cl964648pNThRY5dXodNugvHz7nyvdc+Z51r3T1 C66eaN0btJioxUTn6KSr804pBXEpYosTRmBl1WGvqxa4aoEdMikX8uH7rupwVYeruvVXOgc3uXKj K5tc2WQHT/DFSqSR44l12OAuZDO2qOQf262rwmVatYvvs+I5hetaua60N71RfiVV6VVUJfftrIeN etioh42V88Aq46/SW2/5pBJwTVV5/C7jd1Xe6Xa4+40j7ast9tWWsiq9eunVywd6addLWi9pvXyg l5xe3tRLab1v6uVNquQ8uw5bz3MflvQrn/mr7FuVc7/oJjxb0i/ninXYOsu+bU4taWtepuVyLT+0 5vVaL9d6eRC10tLP5Qa5l0zY1dL62aLneLgh2PHTXTwpw9LlWC7W60q9rnTVcj2+qvZsrGj/qh5f jZX+Pmyp5Wwt/6pln5Zvatn5yV1LqZJt6xct3qT/ELr/p3vS0nvodtB+vTbrtVmrzdrKfVXOSD3a 5bTLlVc+1SjvGWHuNrm21Ipf1KJQzq14+adVt1Wi+75RhpZ/Hldq/VK5FqTdVeXUiXXYoKpvLnsj Y6ySDq1aX175WdcirS8o/x5hF61Xav2GFS5Q55fp5W0znrxNLr1RyYw/0qhUUUrn7j+a+R/1+rZe 79LbpHKUlxt7efnsm5dfm8OZWmXMYbkWGS0y3JOgXJLf8/K3YJ8oYot6ENhpt6oyzpXj+O0/+O0/ xDNvRgV9FmGPd17Zy+nwcAwUryMxCEeFm9WJ3VT/vYz1yRntcHoPtP4jMQhHld+r1136RIIg7uqs qze5OuvqrCuLriy6sli5u+1VJdcFX41EwzmRGKqwHaqxPfphB8TRH7XGr3EHu1v4mOq3VvVbq/qt NcJkI0xWAbMqYI8K2KMCdqlrnSrdWqNkKfkUJZ8qv/q39MrfUs7uro5ujO0mB/ewqgHYEwfJm4Nx GA7X00BOOhKDMNj3jgp2UkdL984des/IY6eGYKCVt1p5q5q6m9PjXk6R+/Ltfti//FOITf90f/9z c7soXEurGlfvQbkB2BP/556gtzzmsa4+kao76DtX/nnBvs4p+2GgZ47EIBxljNLfueznir7Kzz0W eXaRZxdVRrzPiPcF23s2+3cRLkXjkypUGmWhPvJGaTVK67ZnWP2U5tMRRMwuH+waq/XVbuHj5p81 /6z5Z7V7XbvXrTy/TUQy1rLWOrIiUnpP5PMi8ryI7CIipZ/FJ4Kd9fTyP8R2up6m62mDnjbqaaOe NulpQyW2m/U0X0/zP+mpHIHV5t+l9ftav691oXLnt62nO6xjix7yFNvDaX8A9sRBOBiHue/eehfw QVmTFfpbob8V+svpb6n+luhvif6W8ERv+TWm+8b+Z7BvcEpwcfi74Je4BCPDJ4Ib6H4jfo1RGI1U +GiwBh3oK39m273BFnyIj/BxeG/koLApcjAOwaH4JtwrRr6Fw3EEBuJIDMJgHIVv4zs4Gt/FMTgW x+F4nIAT8T18HyfhBzgZP8Qp+BFOxWn4F5yOH+MMnImfYGgwIPJO+Hbk3fCNyAzMxCzMxpzwrchc zEMD5qsw+wW7hAuDXcFlwe7YAwNwIA7CwTgEh+J0/Bhn4Ez8BGdhCM7GOTgPF+Di8DGKP0bxxyg+ Orgq/GNwNa7BtbgONzhJ3IhfYxRG44DgPueB+/EAHsRDeBgT8Awm4lk8hwbMRyMWYCEWoQmL4Y4t WIKlaEECqfAVcX5FnF+pfOLmvMC5PcijgCI2h5PFfrLYTxb7yWI/ORgRVAU7B9uhGtujH3ZAHP1R g1rsiGOCPYJjcXF4Ix1upMONdLiaDpfR4TI6XEaHy+hwWXC9Hm4I62hRR4s6WtTRoi4YE+wUjMVt GIfb8RvcgTtxF+7GlOCrwZtIhTdY2Q1WdoOVPWhlE61sopVNtLKJVjYx2GTGm8NRVjfK6kZZ3Sir GxX5fdgS+QMew5/wOJ7Ak/gznsLT+Asm4BlMxLN4Ds/jBbyISZiMl/AyXkE9Xg1bokfYxwe6px7s 8UScGt4YPc2d2+kY4t9D3ZNfFg6PDsPwcHjl98BXVX4PfFXsKndLV7t7agq2iy0OdostCb4ea3He XKZyp5xO16inHcFBsU6PXaVPlfO4Vh2Kxha5OiUipa9K7ygZEORFtEZEa0S0RkRrRLSGPjXiUSOi NeX/arEjdgnbZEqbTGmTKW0ypU2mtMmUNpnSJlPaZEqbTGkT/V1Ff9cv9NnVF4eXcsqlnHJp8L+c qYbiMgzDcNThVxiBy3EFrsTIcChXXc5Vl3PV5Vx1OVddzlEnc9TJHHUyR53MUSdzVJyj4hwV56g4 R8U5Ks5RcY6Kc1Sco0p/g7pdDrbLwXY52C4H2+Vguxxsl4PtcrBdDrbLwXbu24v79pKLWbmYlYtZ uZiVi1m5mJWLWbmYlYtZuZiVi1m5mJWLpb+dewXHXsGxV3zBz45+hLsncPcE7p7A3RO4ewJnX8/Z 13P29Zx9PWdfr2Yn1OyEmp1QsxNqdkLNTqjZCTU7oWYn1OyEmp1QsxNqdkLNTqjZCTU7oWYn1OyE mp1QsxNqdkLNTqjZCTU7oWYn1OyEmp1QsxNqdkLNTqjZCTU7oWYn1OyEmp1QsxNqdkLNTqjZCTU7 ETkr2CMyBGfjHPwU/12fB/lOWG+vmGavmGavmGavmGavmGavqLdX1Nsr6u0V9faK+khjEI+4p4ss xKLSaySccQdiMEqv5jjR49ZXdNwko8+U0WeWM/pCdzMXY6gM3yazo3Xl93geL7svk93Hy+7LnDvu iY10xz41nBGbHuwYe1cFWOTssthpYkkwQKb3yvRYrNVZZmu2byfb9yv/9b1e31+rGs4IqsKfBtuh GtujH3ZAHP1Rg1rsiJ3CY2Vwuwxul8HtMrhdBrcHx3DTsfhCGRxcGPwSl2BkcHRwlUy6GtfgWlxX qvPBocGN+DVGYTTGhD8MxuI2jMPt+A3uwJ24C3fjt+Fx/5f30n/G36QMnwreRIP7n/loxAIsxCI0 YTGasQRL0YIEUsHZwRp0oC84MtigPm5EHgUUsTnYP9iCD/ERPg72d/+w0P3DQvcPC90/LHT/sND9 w0L3DwvdPyx0/7DQ/cNC9w8LI18Kn4zsjF2wK3bD7tgDA7An9sKXw6ciXw2fjeyDr+Hr+Ab2xX7Y HwfgQJwVTooMwdk4Bz+F+43IefgZ3HdELsBFwRmRXwTnRP49uC7yH8EPI/8ZHBe5OPhZZFT4ZmQ0 bsLNuAW3YgzG4jaMw+34De7S173h4sh9uB8P4EE8hIfxiDvwI8Jzo4NxTLg6eqLHH3g8NTg/elpw aPR0DAnPlyUpWZKKDg3Oi14WHBQdhuGo873K6wKcrU9ytv5+7M1wQmx6eEYsGc6zj+0WW+MU3+lu ots9WU+wd6zX/rg2LET2Cqr+tinYDtXYHv2wA+LojxrUYkfs9Ldme9w0e9w0e9w0e9w0e9w0e9w0 GVIvQ+plSL0MqZch9TJktAwZLUPqZUi9DKmXIfUypF6G1MuQehlSL0PqZUi9DKmXITvJkJ1kyE4y oVYm1MqEWplQKxNqZYL9CbdhHG7Hb3AH7sRduBu//dvM4N6wWTYMkw3DZMMw2TBMNgyTDcOCRzz3 KP6Ax/BH/AmP4wk8iT/jKTyNv2CCk9gzmIhn8Rye9/0XMAmT8RJexiuox6t4Da/jDfwVU8Ixsm5M MNXX0/AWpuNtvIMZmIlZmI33MAdzMQ8Nxp2PRizAQixCExajGUuwFC1Ypk0rEr5+32MblqMdK8I3 gpVYhQ+wGklsdtLZgg/xET4O+sncYTJ3mMwdJnOHydxhMneYzB0mc4fJ3GEyd5jMHSZzh8vc4TJ3 uMwdLnOHy9zhMne4zB0uc4fL3OEyd4TMHSFzR8jcETJ3hMwdIXNHyNwRMneEzB0hc0fI3JEyd6TM HSlzR8rckTJ3hMwdIXNHyNwRMndE5N/M9aLghMrfVPi27D1U9h4qe78XuSRcEhnK+Vd7vAbX4jpc jxvwa4wyr9G4CTfjFtyKMRiL2zAOt+M3uKP8WsgRkbs9jsdvcQ/uDcfI+jGyfoysHyPrx8j6MbJ+ jKwfE3nNNa/jDfwVU/AmpmIa3sJ0vI13wg77cId9uMM+3GEf7rAPd0T+N3PfARfVsbb/zsyhgyhN KSIiKvYFO6LYYhcUa6wgRVEEAlhC1CgxsaTojbEnamyxoUSjxoLdNRqxgkHIYlQEC4oaFeue/3Nm 11xvymeSe+/3/d3fvMM5Z+o7b3melV30iCC//0mdEpaNcgrltFqCCGOHCGOHCLMbEcYOEWY3Iowj 720sR2SZjcgyG5HFFtFkNqJJf0ST/ogmQYgmrRFNxom96h6RhbLPWCoOqNuRd38Qh9Sj4rD6CaLM dESYx+IaOHwx+lxHjr6BXHtTXYYoo/2Fy/fUEHhtCLw2BF4bAq8NgdeGwGtD4LUh8NoQeG0IvDUL 3poFb82Ct2bBW7PgrVnwvF3wvF3wvF3wvF3wvF3womPwomPwhgx4Qwa8IQPekAFvyIA3ZMAbMuAN GfCGDHhDBrwhA96QAS/IgNUXweqLYPVFsPoiWH0RrL5InFJXizOIkWCG4pwaJc6ru0QOdndBLQCi MCBPv2d8SNNR3kf5AGUGykyUWSizUT5E+QhlrqrHbnpjN72xm97YTW/spjd20xuxR4/Yo0fs0SP2 6BF79Ig9esQePWKPHrFHj9ijR+zRI/boEXv00EAoNBAKDYRCA6HQQChijx6xR4/Yo0fs0SP26BF7 9Ig9esQePWKPHrFHj9ijR+zRI/boobVoaC0asUeP2KNH7NEj9ugRe/SIPXrEHj1ijx6xR4/Yo0fs 0SP26BF79Ig9emg7DNoOg7bDoO0waDsM2g6DtsOg7TBoOwzaDoO2w6DtMMQePWKPHloPQ+zRI/bo EXv0iD16nEI6TiEdp5COU0jHKaTjFNKB+XcA8+8A5t8BHL8GOD4DOD4DOD4DOD4DOD7D/H22OcDy OcDyOcDyOcDyOWRUl5OqLmeEwtTlONE3gQ9P4VQX4lTfEeeMRpzqlzjVrsCK23GyE3CyS+gumJ47 mJ47mJ47kIs7Yp47mJ47EJk7mJ47+J078o87mJ47clMTZMJryITXkAmvIRNeQya8hkx4DZkQ7BKl DkpdlHooQeQJtueJTJiLTJiLTJiLTJiLTJiLTJiLTJiLTJiLTJiLTJiLTJgLttcObK8d2F47sD0D 2J4BbM8AtmcA2zOA7RnA9gxgewawPQPYngFszwC21w5sbyTY3kiwvZFgeyPB9kaa/2psHTC+OmB8 dcD46oDx1QHj8wLj8wLj8wLj8wLj8wLj8wLj8wLj8wLj8wLj86JPqBEs+jIs+jIs+jIs+jIs+jIs +vIffMt1Y7C+xrCYPFhMHiwmDxaTB4vJg8XkwWLyYDF5sJg8WEweLCYPFpMHS8mDBQyHBQyHBQwH 6ysE6ysE6ysE6ysE6ysE6ysE6ysE6ysE6ysE6ysE6yuEtXSHtcTCWmJhLbGwllhYSyw9BtN+ojaG tTSGtTSGtTSGtTRmnCyZQFFQLFAsUaxQrFFsUGxR7FActM9YIav0RglH6YMC1gAWlg0Wlg0Wlg0W lg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0Wlg0W lg0Wlg0Wlg0Wlo3oPxnRfzKi/2RE/8mI/pMR/Scj8qch8qch8qch8qch8qf9DgtzBwurChbmjuif BxbmjuifBxbWFSysJVhYS94TzKw3+SAT5CET5IGJxYGJhYGJhYGJhSEr5PEEEnwDVeabifNvUe9C OayO4EfUrfwoyjF1Ef9edeOF1JQ/BHt7BFxbjvJCHSpcyFE0UteIAHWTCERpjNJC3Sz2kj1YXCNk k6/hpcfEGWSNc2QFz/wGLM4CnmlEdskBk3vHzOSE+X0bgSxTIm4gw9zE/VvqbXApBVnBAsUSxQrF GsUGxRbFDsUexQGlAoqjugf4tAD4tADZKRPZKRPZKRPZKRPZKRPZKRPZKRPZKRPZKRPZKRPs6vDL b4z7i58ZKwAWKgAWKgAWKgAWKgAWKgAWKgAWKgAWKgAWKgAOKgAOKgAOKgAOKgAOKgAOKgAOKgAO KgAOKgAOKgAOMgAHGYCDDMBBBuAgAzCLAZjFAMxiAGYxALMYgFkMwCwGYBYDMIsBmMUAzGIAZjEA m1wENrkIbHIR2OQisMlFYJOLwCYXgU0uAi9kAi9kAitkgn18C0yQD0yQD1bRDydSinz/HLk+E6dQ ilwfhlz/XDwyXhflYCCPVSvxxFgunhoLxDPVUjw3logXaogw4r6quisWxuuKpdpesVKtFGtjuWJj LFBsVUvFzlii2KshigPuV1DBTZCDMxGpb4pcaii0vz/YBRFsKSLYUkSwpYhgSxHBlsKz8+HZ+fDs fHh2Pjw7///779jSPhOjl39ZoBQeXAoPLoUHl8KDS+GVi+CVi+CB5+GB5+GB5/lq9br8jQjT/5Vf hmddhkflwXOWitNUDfntJ3jNR8RxMpvgF7PhcbuppdhDQ8V+aiIOUBW03SkOgf0dptriFIWiX6g4 C+85R23EeXISORSIMS7B87zJWlzB3atUF/4WCn+rJa5TJ4x7yPx+aT3MdFDdiPbz5JyZeDYaXrmH KuDecVydljHzN98MweIoBCd7mgJwqsGYoQfspyvmM90JgHWV4257WNceWNdN+S0+t4hhlqvkhas2 8v3ZymhbE/Npf/20mBqgRUNcnaYQ7MYFz7yxL+2zPgPVbJFKQVjrIaU1MiDHne9w9T1aZ6kGYNky XBlwFU8OuHqKq+/ICWggBGggBGggBGggBGggBGggBGggBGggBCOFAA2EAA2EiH7kKgYBSwxDicee 9gBvHAA+PohYYS3H3a0+wF0DZiwW+6HhA/Ckg+oOIOhbWGcq1r8bY2ShFVaGdTqQEztDNdhZ0mEX w7DmDmIQWpm+H6KB/H6IePWg9lkQMV69IhZQM7GQmmOeOziBmvDSzUpLClSCSIedDSZv9PDGPE2g +VTywUy3tfnlTA6Y4RpmOCaGoPdQtI9AHYk6FSd/Rr0I3FQKzPREnusFskYv5Ez00Fq7oaUbWtqg 5R20KINGrsJTER+QvZ9rn8qS+gfXAhYrxQk5wqvPyvFyoO1c9MKYWqTHmP3U69rvOaJHXViolWyd qz4A3np1zCGw+wiUsVh7KjLIafUeZi/DOu/g9F0x9kP0Oopx7TDuY8h+0NFAlFRY+Slo/DRanMFq zkLj57D2XIxgWsVz2G8/3B2oPpLf1699V38ynqSSO3raYEWW6PkIPZ+jpwPmMmq7Rs9n2v+vUGcq QrmG8oRqg0HXBoOuDQZdGwy6NkZ+EyPrxBB44VAaLiJQR6IeC96RjPWMV1eJSTjXBdQC5xkMjZ3B jEFSt+fUL+RsOeoF2LcLkOtT8xkHQgf9sIaB0OkQlKHaN+mjjkSdSh5Yt+Zd1livLdZaIn6givLU 96LHIfQoQg8P9ChCDw/0aIHWFTFnsTz5c+ozzPsYPYtkrxz5HfamTzX5mD/V5CPGIVpcIV9EgjL4 oy0ihjsiRiXEgb2wOZP+89FK4E4Z9NgPPw2Utim/6Uik4NQnIKYVY93XMeMN9Y60h5/Qrwj9bDG6 NUbmeJKP9Uer94CO7wEd3wPivYeWz19+wyJaW8nWV3HKxdBUCdZ0A5j/Jka5pZbCfivLUz4jv193 ENY1DCUFKx6HOHcFOr6KEy6CdcqdIB5dx/5vqCe198zk3M8w9zPM/cy8s9KXvzONUThGqYv5K2KU coxixCjad5JZY4TLWAOHnURTD4pBiUVJo470DsoklMkoU6gjRnXEqPXN3zva2/x9o73h819BU1uh qSzYyTHYSVfYSQ+xQf0H1v09omEt04yIx9qM19V82EgQbCRIaQ1cbY2RH5nPjpvPjkt9aTu9oX2y ES02Y+615lZu5lZumPsOWgZKpn9D++vSIt54GLn+NnL7T8jlt5G7f1L8jddw3vHGO7hbhjtlir/a BqPGGwvFI+jjGXo/h3+9UE8pFmo58v5jxU59gJan0LKT7HsQT8/izlncsZV974inmO8ZdvZCzQWG MCpA5+hrRKtcYAUjWobAt+ONxZjFCBTyACsrFU9QP8Osz2Edpp7PMasR6OMBVlyqWKO2xSrscN80 0nPs4CGsIx64pZwYRinDKEaMogrtN8y0uS2JoXcZehvRW0XP6+Y11NH0ZJyLNVxB7xroXYDejwRY qlz9c9jbC1iGEXlNVV9gLVcwWg2MVoDRHik2ao7clZ2ap9hTRSChmxj5BdaUoWUSlWPEx1iHQRiJ o9djzG1QHPCzv1pda2E8jRYlmE/TVD5alGBMTUv5GAMc99fnhdM3nxN6v+Z8ZFt5Lmj7mvPAHv/N c0BM+4v6h6f/h/WOPf6BvuWT39UzVVBcyEZxxfqqkK3igdE80ccLebMqfvbGs2p45otnfriuiWe1 8Kw24oqiuGEGTzz1QV0TZ2KvuODKVb2jVMb8HpjBEzNpY3njfjXcr477frhfE/cxDk5Ba63N7Glu oc2kjeWEdXE8vaa44U5llCrkjfU5oeU1jOmN9XGsj6PXNcUHz6uj+OK+H9rUxL1a+Lk29l4Boxiw Vm2HXHHHWj3IwjyK1tuA9Ws75EoNPPPDM1Nvjv26oLjC9tyw5ioY1wN78cTpe2Guqtq+8Lwanvvg uS+e++FeTTyvhee1sT/sAmfjinHdcLcyShX1AtZghHauKF44y6rYszfaVEMbHzyvjuKLNjXQxg9t aqFNbWQX7ZzspV6rkAvWoWnsMdbhgnXYYR32Ure+uPaTGnyMNbhgDXbaqZCQe/cw69m0ek17Qu7b 1KPMvGpOjn/XJuC1d6C/X9kFvL0ROfxV20AvHVn9kX3gaU1y/k/ZCEarj13/TTtBb3+q9O/aCkZp qe3oP2MvOIkT8hz/ls3I3ODwV+1GRnV/8OobiKQRiDheiGo9wavLENXeAK++iegTjajmg6gWBF59 AxE1AtHIC1GtJ3h1GaLaG+DVNxGZohHVfBDVghQX4yNopAE0UgcaqaNUwbW7Wh8aqYBVBUArtaCV moo37ldDOx+0qY7ii+saaOeHdjXRrhba1YbV2IC92IN3hIBlOoBdOgNxugBt+gFVtABWOArE5Qgv GApW1YCIgsCb6lI7vHTUnfpQAPWnAbj7JvBQMI2ij6gbfUKbKJE20078tJv20SI6gNcXdJgu0DLK A8LeSiXMlQ4wT+ZJZcybNaC7rAfryYiFsb6Ms0FsKLNmw1k0s2dxeDmxeJbAnNk4toi5sSV4BbHP 8WrFluEVzNazDaw1O8BOsxCu44EsjDfhzVk4D+JBrD9vw0PYAN6Bd2Rv8k68ExvMu/DubAjvyXuy CN6b92GRvD8fyKL5YD6YjeTD+XA2ikfzGBbHR/KRbAyP4wksnifz8SyZT+Qz2AQ+i3/MZvA5fAH7 iC/ii9lnfDX/mi3g2/hRtpof4xfYTp7Hr7Jj/Dq/xc7zMn6X/cDv83J2kT/hz9glrgpiVwQXghUJ K+HAioWjcGK3hYtwYfeEm/Bg90U1UY2Vi+rClz0WfqImeypqizrsuagvGjBVNBKNOBMBIpBz0UQ0 44oIEq24lWgt2nAb0Va05XaivWjP7UVH0ZE7iJ4ijFcQfcVAXkkMElEceEeM5T4iWUzgvmKSmMT9 xRQxhdcRC8RCXldsFpt5ffGN+IY3EDvFTt5Q7BKHeSNxSvzAg8QVcYt3FI+EykMVC6UCH6i4KP58 hNJaac0nwFIYii0LsjxBIurt5HhyGZkcM4YS4iNTE2gJuDjrE97eB/yHVFX+dp0leVJ1sPe6sKwm sKgOFEb9MEZXGkyRNNLczgGM3ot8yZnqwfaaUiug7l6wQQa7G0IjYIEK+pjaVkDOqUo1yIXqY55m sM83qDeslcNyh1IUxSFv8/Cwnj4U3De8uw+Nlv2cYe82wPlVyI9cYfPNqTW1pU4UTuA84II9aBg4 gKktohx2Uo3cqSa5UUNqTC2oDXyjMzzjTazEn3rScLCFMeaRtd8k9CEPqgUW04hawpfaUxfqS+AK VIdCKQJeFE9jowJTovhcKZdIuVrKzVJ+K+WhqMj4VH5Syhwpf5SySMpSKR9ERabE8OeaFFxKaykr SOkipUdU1Ngk4SNlLSnrSxkoZQsp20THx40UHaXsJmWv6ITEsaK/lEOkHCHlKCkTpEyNTY6MEmlS TpfyEykXSblSyk0YLFLskHKvlIfiE8aNFd9JeUrKHCnzpfxJyuL4xKh4USrlfSmfalIhPExWLKW0 l9JJyipSekvpl4hKqSulTspmUgZL2V7KLonJ0QlKqJR9pRyUpN2PkDJWyngpk6WcKOWUFOhcmS7l bCk/lXKRlMukXJsSlxCrbJJyq5TfSrlPyiNSnkgZG5WknJGyUMpSKZ9q0sJaSreUcSNSLPykrCul TspmUgZL2T5lXFKKRRcpQ6XsK+UgKSOkjE3Fyi3ipUyWcqKUU6ScLuVsuJOAX1aGR/ydn7j2ydi/ UDP4wuul8iek12+k3WulQMywgU//nZ8YItivZcU/IbncPcdI2hUzx05NWv8J6fgnpMdvZIU/ISvJ dQlZs1ektt5X79m/Vlog9rkgmpos4t+7cjNf/Zl5GSLz66XDa6Qvon8ocswwROcEGk9T6AMgmwXA MmuBcnYA4ejpFLBNIRXTHXpERmbJKgCneLNarCFrxtqwTizUdK6sorn2MNc+5roZrF+rg03X3Md0 zeear8+YauFhui/M7UUv8/00c73AXJ8y1UClptr8XNlgrvNNtUUTU221Wp4qs/nRdG3bzFy3Nc1j 2818PdtcPzfV9v4mX7P/0VQ7WpruO44y1yfMdY65Ns/r+Ajz2aJEsfnSA0awzyCtsdOlmg+whxpX JUW8ITqLLqKr5h/ciTvB+Fy4m+yBtqKC1lY4wEYZToch5ph8B7ic7NlddheXDzEWY0/ZU+JMZSoJ bsEtSOF23I4seEVekSy5K3clK+7BwVK4L/clG+7P/clWdMXMdhirMnaXri2bOdK7zINVpanMn/nT dCDVIfQ+0OlYmskSWSLNZm+xVPqQzWazaQ7Q6mKaC0Taiz7lqXwcbeMTgI228zSeRjv4ZD6FdvLp fDrt4jP4DNrNP+Of0R6+kC+kvcCTP1CWcMAe7wHdNaGfgeU60gOspj458+WihwgTsWKkGC3GiBQx TkwQb4vJYqaYJWaLD8VH4mPxhaYFvowvQ5DqLrpDU6EilLiIFjEkxCgRRxbAfslkJVJFKlmL8WI8 +MBEMRE7BxokO6DB98AOloql0KyQseOfOvbWToG34trZWPEAHoCzacZhN7wlb4knwTwYuu7IO0LX 3Xg36LoX9GCJ1lWgXx1vylugdwfelYfx1rw77tv8+VF4Ok/HrPP4PNgBJ42TeSvVFB+luuKr1FD8 lJpKLcnemdgNVkNy9VVeWX01aTnxWgtFY72mFl6vtPB55RnX/o8JrUnR2CJT/BV/aRfavC6Kq+Km VFaqKO6Kh+KpeGms8Jd5OVCko+KkOAMjWypWirVio9gqdoq94qBUUByVikoltFGg6XexBK0PB4Ju AzbaTmkHD+DArVXEWrFObBJbxBFxVOjFMfGdOC5OiO/FSZEtSsVtcUeUibvinrgvfhYPxEP5Htca sQYjfiW+wlo2io04d+B57EObQ9HQ+y+jr0GrjXi6W+wRe0WW2Cf2iwPioDgkDqPdVVEkroliUSKu ixviJvppo68VazH6OrEOo28SmzD6FrEFox8R2Ri9FGvQRm8ILvl7o/7OPqTOrqAfmfv9zsx/sFdN 19myny9VYP3YAPYmG8j6s1HsHB/Hp/CZfL5YItaLrVrMYb1YXxzwSDaSLNgZdga2lMpTYUuT+WTt e8zghzbSD23FIrEIPqBp0F58Lb5GJuDsET2m92g6vY8cMINm0iyaTR+C9X6MjDCH5tI/6FOaR5/R fOSHhWC+i8F1ltLnYL/LaDmtoC9pJa2i1bQGueMrWkfraQNtBF/OQCbZQpn0NbjxNvqGtiOv7KRv aRcY9B7aS1nIMvvBog/SIfDoI3QUOecYfUfH6QR9TycpGxnoNJ2hs3SOzlMO5SIf/QCufZHyqYB+ JAOy0yX6iS7TFbpKReDgxVRC1+kG3aRbVEq3kbnK6C7do/v0M6LMQ+Sxcuz1CT2lZ/ScXpCRVC0w gy+H8z68L+8HzjyAD+Rv8kHgzUP4UD4MzDmCR/IRPEpjzzwW7HkUuPNoPobH87E8gSfyJP4WePFF ns8L+I/cwAv5Jf4Tv8yv8Ku8iF/jxbwEjPkGv8lv8VJhy2/zO8JOY8/8Htjzz/wBf8gf8XL+GCz6 KX/Gn/MX3KhxacE0Li0UYSEswaethY3oLcJFH/DdIWKoiBCRYqx4S0wX74sPxAwxTywWn4tMnOtW sQ0c91tw21PitDgjzopz4rzIEbnigvhBaaUEw2pcTfFfRvJ3ZWReIbohouaAU4fSBbDpwZQnhonh lC/jxI8iSSSRAV49jQrFp+JTuiKt6aqMpUXSN69JyyqGXa6nEumh16WH3hA7xE66Kf20VGmpBOEk ONuHM/zv2N2/Wt1/y+YM/xGr+63dvbS837e9f1qfZn//tMAV0gb/d6xwsWY/jDNXRB0PYAYXGYFq SOTgz4axGKono1Fj7Z0uasLGAEs0BZZIoxZsEtBRR7aYfUHD2HZ2mqJ4MuLTFD6LL6bPZGZfI+yF E63V3jWiDOEm6tJmUV80osMiAGjhmLS6AuSzIGReJ2RAb6oF/NAEa1qDlyaRE+TPm+VVlvkqC1cG vLTfsqvH6mHtDVlDHEQL1gLW2Jl1xla7s+6kAOMsAjI3obnNeAEVsKEs1nxnxyt3fo0gqksEMYSP lgginIfDwwbwAcj9g/ggPBnKhyL3x/AY5P4xfAxy/1v8LYkgfLXvZv0XBNEbVvEmxorGeSdp2PEv YAltZis5s7Wc2UbObCtntpMz28uZtf87+ow6s/Msh+WyC+wHlscusnxWwH5kBlbILrGf2GV2hV1l RewaK2Yl7Dq7wW6yW6xUEYoiHoly8Vg8EU/FM/FcvBBGof479xQoX9F4owesi0t0WlFjFuAWAtzD G481jGoBe8MuYW+DyArnoP2GvWZpNkCt8ciHGmq1Y+PYeCDmyWwyMugsNosc2YfsI6rI5rK55KS9 40rOsMDtsN4D7CDsWc+OUWV2kp0kd4ldPGQO9pIZXCcRTEeJYDphfUFY4d/Qmdlv/g93BsupKzHD IHjN6xjgSUTBPES8IsS2u4hjz7F2a/BAF6zbB0ywPguE97RhHVk3Vhf78MeuGsh6EHxKq4eylrIe xoJkPZy1knUEWKFWR7LWsh7B2sg6ioXIOvqXup2sY1lHWcexTrKOh59qdSKrA090hDdzXNUn7X32 htI3G0EOYzrI4SwAMoIFQkayxpAjGKIF5moKGQ2eylkMaw4Zy9pDxrEOkGPYG5DxiAocs3SBTGLg BeBC3SCTWQ/IJeDAnC1lPSE/B6PSUQtqS12oFw2kCBpFSTSRpiKzfQIfW4KMtRbZaSuy0T5knhNs A3awBKveKOuhbJOsh7EMWQ9nm2Udwb6WdSTbIusRLFPWUWyrrKPZNlnHsG9kHcuWSV0sl1pYIbXw pdTCSqmFNVILq6QWVkstrJVa+EpqYZ3UwnptbzLG+cs6FFihAvlTIAXL94YqwLLcpK4rSx1VMbdX mPsvP43SNCnfAbNnC6SupNSYAasI2yfmivzBpI1zablC/i6KPbvHHrFnCAKW3J5X4m7ck9fgdSRf /k/yX0RyydH+yfisNRb0C4f6H3jQLwxKG2MYj/8l5msZQHuPxk0+xZUSQS/fuSPz+1+/vBvm2RG1 i+m2Z7Au3bOFpU3dD7p8UO7ArPiKdM86uFWTMxZgp7OxtKhXQXAPC9JFWtrWs2QKS2/OmbKij663 rv4rd7xWek/1wiFprzAaQSmUSPEUQ6kobbSXrvorgykujuFLmNucusOaDO5ecU1IZPDZCR97r0h3 vaRLF0dQGqwQCFa8Yuf97vMvfRzeqUN5wdguDgGrdQ6/LJVZYFHTPpSLFP0US2c+qF2Aq85Zu7B2 th8Qk5Iak5zg0yEyKSbAReek3bZytus4LnlEZML4uPj4mABHjIa7ts6WfUdFTkiNCaiq89Ru2Dm7 mG74dIhJTo2LjYuKTI1LTAiopquqPRbObubHfePGYpbIsUlxCSN9OrTTeVd20DUOCNQ10cl/gyo7 BGiXjQMbN23ZtOUgXZ9XFtuvT0Blnatp/gr9Y5Lj+sSNTKjv0zUhqmFAPV0d00S+Lx/IqXz6vJyr T0zy+LiomBRt0nTm+6pWmAWJdOZIuG/L0xmj9Se2rj6Z7bPFdvKsTTPG3f0m9N6lg477R0ZmrYr2 yt/z5ETjjdN1swZO+ahgjKHZMsf9Z0sn3p+wdkpi8P55Wxx2j3oQ/9mJrPAGG7u0frgjd+hwT778 aaMx3qvLVy1Z6/Edv/xuj/CrFSJK23pN2eVQGHLsm0szsoanjQ5oKBZPc17X2edUQIrDgAbZE5s0 nu+02GlX4ahGG4qvHpr9Ud3DH1afEZv13sABieP2B2+oNWPoiYquwcun3+x70DbhiPFoN8Muq0oL fScVtKl91nti6fKA4/eKfd0Ljmzr3GGJx/AV3nOLhj28M+ne5I0j2JyHPe0Kz/j2Xzc/e/PM8Zvv 7Hb4uajnxRXPRq3Y7NJq24yDe7iA4a+aVqCblqdrYmkNi7WwsGJwOF0tnd/Lax37oMqo1NSkoEaN EqNSkhqOh95ToPeGUYljpe1UdWZMVax1lqg4I1077V41JUjXQtdsRZMVgR/ozN2jkuP/pXcjk628 aiod2jVEK2mpVWsq9jrbl6sQ1roK2k1HbS4FHmCJFeK6kgLLXO2uq/zSvoWzfd8+7WBoLRoENGja +FdeIaZNo25jntwceKijV8CstxfXW7A/fRO74NUjO3P2wIRL1nVWDfvuxDznEiXcoaxz7UbUIrPo +LzQJTm+I1zLQ5pXD0sKmHrvwxYztl2/vpCMp/stCPU7t752aNrmnZHtfq57quT4xWGGPfXeb7P9 i+0XLw9Q931zdMrD0/bL7i401jvfKtzTs0Xt8pBu8GFVl85LzH7scKPe3Zy8OjOrBFrYDFsyfuav /fi/4hm/dUddi1fdccCfnLSRroFp0lqvm1R7FpP8Wpfc2su/i+H8qLTpVTrGjhs65ci3y6Nqqa07 fD6pUouKNfulXBxXO+5F6C6fIedtn6zwrHu7X//qkXneBUV7G485VmZY1TzmE8959jv6eA+ZFNt0 uMXsN4zjQy/1mbpyms8Xm2cOWWldfk335I5v8x7tbU9d0lc7cqHfjWkh28NX1d/A0u6v3PBxU+Py 4qGjLZa3HnN1/4IDxpMRT9qWWK3oeGta74Q1de/vmF3R//acHy1XfNBryTvdrB10VU9UXDam/MbA zcr6tou3+l+f47Yp+GqfxO7nm36xPTG66rYF9fe0Lnn71ti0J27FtTK2lC3us7Nt/fnfvr3BmBO+ sU7qlPalLb1XjnYrfnOP36g8mtqh4oypY8wueUI37djfdEn7X1yS60jX2OSM9XV1df4raq3w+8D3 j5wxNSWlQVSkdD836X7aEP+DB1oe+FMe2OTXHqid8oyJSfmh4cxn8E9vH0/XHXmxy31B1j/ocFZ2 tv5BhTz1Sc8DjUfoKh19mOqZ82nh8M99nL+e9Ma+XtnvlUyt/N5XteeNdO707MS3i9qJk0t7D7b4 8N11iT979vL0a3g/7uN43/I9J9zm37ZPPTBqwsVbi0fMOJgy9/Gs1LQaG1ctemfh1+Vz6rzVs+E4 zy7t8u9ud/Dpe2HCioXpUXEvbE7Pvjtuj83Si08q9au1JDJwXxrPfOeDfSsPf+hbf+LZpuP3fpoy 5Mmu4h6utjVOFp3LadKwa1vXYMeIND/9mtiyBaeTbrUpeeAw5cezk1aNfyvu4OdhnXVNq3+9covH iOB6Fz/ZUNfqnbwq24a8c+WLNYnG4FkZunTFCSHgqSkEONJB+jA4eGals20eRZVeavuqxhREgKSX vm3n7NshMent5LiRo1J9/KPq+AS0bNncp2dcVHJiSmJsqk+HxOSkhgHeOi9TY9d/fZKYbMrV1XXV TMdU5Z/PwxMTU33ajUsdlZgcl/q2Fh5aNtcFBOh0zc3hIVAXENg4wHz5f7Ci16ZynnUwqbjV/VBP /+ULJw7T3Vy5/uOawx8b5/dYtdP4xUqfNpN6r1y6ck5E4Jiz7aPfvrNp/PG++fdvff6B15zl02O3 HR2TNqLGharBhY7s0+sLjuxvELtkyahai88E1d9vv31grYOdSmzbtFhQf71/y3WlXd9rf3W6454l 8f0iN6VP+jKiwYQeNxZ/E91qSS+vAGs/l+XrS/5Rr0px60VRLhEDLWKWV20ePqP8q7LPuN7z/P5+ b2ybNXV/UGnfz0I3v/gqbWxq6JYqJxfY+FenAXMj4prv6e5kFdxfHfxsdayt9dpz0/oPKNvRapjb tAlK/qN9m6fON2Zmv3vhK4/kIcEn9t61XuWr22b5/vFtPhOc379kjhvrdNPW6Kat1PySKdOW6KYt nFpx8JmksrjkZTV6T3HZ2vMT9fsvk//3zy/9NTYuo8L863YHPv55YZWmt79lfnkTKv08JCJw+TK7 79tY/GPmnONBxdXv3x0wr/72FZ2/G1H2/IeTrVoNWt+sb5zRb2zI8ZMbCi0mGQI+br28YtLoPUan sCpxB56f6XC10iCfsJsj3tmywf27es1rNtgX86XT7JqOUavK+3o9qX78guvP4ZsSOgRavUiv/Pja yHiH3o+y7oUfyyo5onvuE2Azs+r8Oh49c6vyNfem/iS+Gfzga8N3A+7EdD0W3nfHN8LfSZ174a71 nCnfLjy6sXn9orSidROujl9BZ0aHHDzXbPZP7ZzWNR3tObqg6eUcL6Vo3RvKd4Mat0jo6eUwYqft yo/O5/YN6ZTt1W9tUoFT0Ix545Z/dW4FosJhgIMtZmAw2m5x2AGqurFS/hH+ZWzt3S9JQtX/q5Cg awa80CSgeZMmAU00AI8QH9jsZUiYtvZfIYOzrpKJbtgOiEwZBSiQinkqyhQCsmEVHhM9NjEh+uXK bP9oZX+0zUBM+ptt1tBVN23D49Un0TESfGhopJckBT6/jSQOWiSxlpHk8Emfj/deUtv0upN2KMev 5qPxp6qr2XX7h574fGf6/6vWysOh7PrwM4stJGsmu2oq3nimIVNkJxKNJU0xU4yxpAZDMSRmkqXE ayvLq4wxls9OJOW9KMla2rjIS8VkaSJZwrR8Q73xfen6/nqv7+qv55zze865znOe+9znvn/PU6FN 3Q405gs+I7bcYM2ONjR0lcdezhZYEKum26W/oTfVrbuXXz/uHRFnL3cLu+AGiWmQeUr3BAyDTGck MDZcou2LhT032TrlA0SBjbp+hlp7p71LzGe2+CuqthkjFG2r7dKfMDslmxAGfvwn36eomB41flvf kuamXNOg9THb9HVIhYJmTW7/NGMgQ0XsMw5ldBBzthQ3PMQ5TN1c+EFNU9wAE6RvHJbnOXRW1XP9 632JjUGmdnsZByJikjLqPULGhLiRsNDZND899Tz31PaB7a/UoRvEtCxIM3oSpZNR8gpIO592HvZg TDpEjbceyNV0OOzXoBcJfqFvBlyaxy9QGAyAL1lUhbVwGbjU5jl1K3wzxaGYPZultl6G2zBvTwMR 37tIQeEiimsAe+AUz66bAEag8JLwWfId5qDYd4HFB8J4lxX7conGiIMvpvhqysaEhbUe0VH6Ma5m zwTz5l1IzRqwBYyF0cOq91vOPRm852ifX4V40P56Mmvesdoiee8mdoFSX/DTWZlgiedTv8txBPGV 53+/GYu7Jd+e8iQlGT2d0P8lOoNgZYndhdytLOeg8zHUWTrpbp983DsXOz22wFv3CSon/sEhIilF 1jIreIB0YwBZ8rlZoropu73p6EXfqdbnhXSyQB8JcTN/NvKOkHHqJLLIK7i8QT2vzF2JVRol6H1F sqZsZ5oiH1MSw6wvAvVrVbrB3FZXCfnSQ5fYk8HitQQ9EZ3JpIbEaBv4ET7n+w+7CnpehiYEbeFe J7Pi+dG4coKauBhI50PzqEzuK42tcTG/2raUbiH9kKH4VShjmft2aaG1di66JR2eNuJVtRerYMA/ 8hzf4rCfxP+nJOqgXcaUOGe/bxjo7yxMudSll6l08S4+UgP/rpwyU1gUfbyqt1w1RLi5mWWVQFCV HJ2f2ZhZNU0+XTIxnqN3v7H+sLNBYaU/GpnrSnOhMlynydEpneS/7l97nGMrftql1vcCiXFZJiYP T+s0dWc/d7xq2Pqx7/QmDVMQYHeFhqSIP8MpMEcOCLdE92V32aedaCW2ph1PTyTstxYf0Xzi5EQ4 asf03866FWEmGouQPt0m2Jue6ys9Ys3x+oSv8I5/u81WB3OxydxSOhmbWjbtmdPdL+TnEXA1MFbh vPeVseGjZu0vXvuJPiICSSGo1Djh65J1lZ3jkwMq4wXHXMZ1TPbc/SqJ6JBE3orE/eBdlslgvMe7 4JR9x4FxORsEvyLzj8KHyZ9+wnwFi60b4TQGSLsaviqLMAJy/h/896NYsPpq/ExBY9AwSz9LL3L3 CuN38u9xlpyfr7fXYqumL8XH7RQxwF9zcQMs4p+H/R1LhvDACidqAhqBBt+dKDQS/W3cwMDA1cYl UX4cMGA1T4jpmUjBZDinSuEdyF4D0ObhSu6TO9bFmoVhDqK9O6rnjr8W5apsCNRneQZfTzl7wfm9 SeO5DFJoNNb2DF1q5px/d/afzq1Q3wfIE+tv20mxYupvDDHaGacyE/z2yNU7Ao5VcxHIXgKa27U5 mJDem8udfm+0oeigebFFXwJGEidkOTmFilK6DY9zkiDBRoVtOxkiF9LqehryOwWlN6tUVR+KkX/k FKnNav30ryhOgY7BDRPvQeVJs9tnS0YnD1YwLG6T/rTX6mkZ4SfC+YPI2C8WtzLGTI5EPS9eEz5z +N5vQ+wwp33sHdRx1fOJItsrsU5NdwxxuMLHHYOaDR2ck9d0qCg6vI1Hm/ehEAhIq/plyPE/CH45 jZ1FGwGlvh+oWyEoARjf0o+ni8fst1cvBEOJrMyc86a+XBNGrQVXRqXBjcsd4Sjevu1iXBvQFLGy tfBjuIs+XyM7pqP/EaSs6CKCcgNdszDhOwFrwAsgAhTAZyn57g4EAMqAOa9EXio5AiRezJ93z2KL MqANaAAgADKQ4Zt+iu0Aqq+PB8XF15P632oSTocAYUd6bY55fFE9evvxvp3O3KYQ3UH1g+ZFFP0Q m7Cb3eT0IqNGa/25Xr506GQVbsGzcr9V0piEc2aMhJna+isIZyt96YUYJ8pb2bwj/JZkdfk05m7t 5JarCcEDLmGk5NiRES1LRLzgEDiWQmWWK2whssscCmPxKXgYIt9T4+FTbKbSGZwZzPpMpPIhviBN NL9m8sttMqUfpGUR5OnA6qn9BG6WCKzLevZTqdloVERYm7Bv4yX4bERravBanDs1h7ph/4Iex+Az bdRx4tWeAHicBkuP+G5jX02Zo/kw5c0xWSIUcOxxYMbX08VOsX3nHZIx2Pvc8pFuxLvhgBf0YzNS DDpPFtEh3OU3xo+iQzi8ppFFeHv8I0nNVVKpIvyCXycA5bFM1mFQdiX2hJc/7UB40Pse4UOJLZ73 vAN+x2LKA6VzhMe/K6AnAV+H3VGnnqMieFoVOfdCxSPozCoQSGpJciIVyOY9m8BdShX5TaAuhJMr N2Egd97W5XrzroEMqq6CVULdK6jXTdoUJ0dMKb1c4USYMFNx3U6hBRv1g59Ntp7s0Id/KD5BGbQ7 IEP1SxLlaA+HHks2JyDqt5XELbjeSdhVWRhBQuf2z+JPVI5l/IEMzN7WMbKBpgthvaHYgbBZnEL7 g31fMl1fensOaT2qrQ3dvV317SFXCrrCx39InoEDx1/Zk5ouXtFrw11KZ3XLNRbFq7TpKpSjDbGg T8WwrkGxHHE2bJidqBE2Pxfwl7EcpK0/0S2xq6bpndO5MgL2LpUWcqHWxy2JbbTVi+UxVIIPDTcn TKupQYHgrH8D814hTA0KZW5kc3RyZWFtDQplbmRvYmoNCjU2MSAwIG9iag0KWyA1MDAgMCAwIDAg MCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA1MDAg MCA1MDBdIA0KZW5kb2JqDQo1NjIgMCBvYmoNCjw8L0ZpbHRlci9GbGF0ZURlY29kZS9MZW5ndGgg MjQ2Ni9MZW5ndGgxIDE3NzAwMD4+DQpzdHJlYW0NCnic7dVrcFxlGcDx5z1ns7nQpCmQNpRCF9KR VNrmUkIrRBrSFopMk9LAC23N0GWzTdImu8tmkzZVIHJRuVQQEUG8gPoFcYZOZaA6IyNjHblUjTdE CVAGL8hMlcFBUWnX5z17ErZYLuqHfuj/95/d857Lnvec3exGjIjM0KeIVJ/fdUn76/I3T7xdutH0 dXY1NK8Z37FZx3fpho2JwXjmg7UtDSIvNeq2tYmRXKx0vv+qyO9XiXiPbsr0Dn7kvttfFvnd9Xp8 ZW98KCNzpVzM+B26Xt07MLopdvdrS0ReLtPX275kvOeZN4du1PEc3X9mn27wxMzV9Yt1fV7fYG6b PyY5XX9D5MWlA+lEfPuK7br/TxtF9j08GN+WufKPckD3b9PjY6n4YPIPf33hJjFP1opEP5pJD+Xy +2Wazp9z+zPZZKZkonOvXp+7nl0jOp95Uec2499w843ofFFxtz7+uJtP3HtTInJL8/z6y6e3vi7H uA0ij9zVPuaWj7W/dlH+YP5Z3Tqhq9PEkwJ32ER+QuYZyR8MVo0cqt1tyayXE8PXuP0NMl8HcdkV bPFlzNyms5fJmLjZqsPlmM5zrr7bJiq+cdyx9bcGrwkufv26lculTWJyTeEaxD0i4RXk5EH3ToiZ uqCxqUeTHA3GpDlczjjCVwIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAOLp5YoLl8eK7kZmtj6gY 4xVMLg+hG/3I/zzjOdL2Pi7rvUTckx4m4cMLX1NYFJ3JP/Ru32PaqVFElupzhZTpNk9OkQ3SLdfk 87otNjnOvxR0XfgOhnbWL7hw7WUrV5x4yinrFur6ubPNDFMtzVJvqk2V1OtyericZirlPF1WhutV ul5b2P7t8+rXmN0mf8MOOWlns55w59hJ63ab6Mo+fapbsdtE3CjiRiXBaOVGHblVb2rVc6u+W/Xc qu9WZWqvuFXjVsWtmroV5vQCkTyOavKA/s1n9BHJH8y/oOtR/R5UyDSpkmo5Vn8rZurf6WyZIye7 Le+4X494H3OdrD2hX5Q5mpd/RS6Rxfrde0zP1yZL5MP6zWmVifxzcqmslmNkbvC4Xfds1ysckLR+ H2M608zgGtxjevA9btJv5Wp5SI+eLR0PVe2Lmuh3zdn64xZpm1uzs/b7teO1+2ojtZUPHmuO3ViV qbqt6t6qSFXVvnJTvtuc9Uinv8b/i+/7Dd37uz/U0L2n+7k93dKw7ED3802NS079QMsZZy5unllz fPS0mrqWM95aXRYtK4vqwysrLYmWRkpNsKaP5RUVJy6pLCuvKK1colfWnN8vKXlKSqX1UfHNCXrh nj6XmqVtJ5iS6f5cv8Ff5nf6l/tpv/QFvZK8Xst3TLlEG/ZfmZ1olWUHGg7oldTU1SzWK0g1N7c+ Vb63/Hm9P5mh515dfG79MQvPPUv8aj/mN/ptensb/dJxf5//qp55tynfpT/7Da0Tevbw3LPqWha3 6GN1q578OD35ob+UnUegq7QHiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI iIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiI iIiIiIiIiIiIiIiIiIiIjlDOySYlRgpO00dhbCSqa4WxJ6WyMBz7RdsjReMSmSZnhONo0fZSWSBt +ioTKde1DhkIx0aP/3M49qRK/hmO/aLtkaJxidSasnAcLdpeKpeZWDiu9L5ptoXjKlkbOdWNyyI6 77WFeXVsJBLJheOpeXXsF22PFI2n5i1zd/vW9ql5dVwm50S2hePyovExsjTycDie5sb3x5anM6PZ /t6+XGz9qs6O89ddEFs5kEzksulUf0J3Loo1NzY2dfUPdg2n1iZ7hwfiWZvMDvWnU7GWRY2NF2fj PcnBeHZLLL3pHU6wINae7N/cn+qV+yUmyyUtGRmVrPRLr/RJTretl1XSqZ/E+bJOLtD1lfreJCWh +7J6dEqPTISvXKTLZmnUmqRSKjZc2tmVzCRSw01dszq+1bFw03EdC/tKh1s2rOl8cWP6irHeht7y O9dcNND1RmK8855GT7r0XIP6PKxnXatz9OpoQOI6j9W1rAzpfjdjTFp0LjfPxbo1Lj26dzA4bovu S8um//KqF+ioXff2y2Z9pHTedbp9WLe6s47qcljnTuoyp+9Jv45jOoc7Sy7YltbnnmB7Jrhe94q4 7u3RZSZ4LwtHJsLXJMP1eHCmTHBvg3pULtjnXnVFcA43m5t1ILha96rJqyi8YvI6skXHZoL769Er TgRz9Afv19bguhP6fPh7KKy7YxM623DwjvYEn+fb3wn3ioFgVK/Hz9ele++vCK/78OdO/R/3/tbZ e8LPJqavSOqrc8E76+6y8FdxuDuYnP0/r+vsos/I3UnhXnLBfJngPY0H5y/ca49u2RrceTr4e3u3 v4T4IZ96Mvh00uFz4a4K42FdywTPseBqR8JPefI87sgBPeLd/oYWBd9Rd56zpEHbGrQoeEcTwV/C UPB9cEe6Vw7qMTm9I3eHvcE9ZvQMo7p18i6GNtzc2fW2b4P7NvUF+903o/8dvk1DU9+nw1/T9qlz jIaf29DUVbllSn/5AvlX9Nfv8Hz97fSkVkw+734ndctE/tnCv6B83pip/0aT2idXTdHjaGDetgQA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4Igw+qiQedIspi+e6pcyt235qo6YbpV8PthvRpLZXGFP 8Ijow1Umntwpq+yATdkRu9Vus6M2bWaaWabW1NibbY9N2qwdsjk7PLX/4/Yqe7XN2Cvtdvsxe4vd YT9jb7W32c/a2+3n7B328/ZO+wV7l73bftHeY79kv2y/Yr9q77X32U32Gjtme+0nbJ/tt5vt1+0W e629zl5vb7CftJ+yg/bT9kZ7k/2aXtkqeVMOyEHJ62Ua45ma8Kpi5gdmj/mRedw8YZ40T5m95sfm J+anZtz8zPzc/ML80vzKPG2eMb81E+Z584ZX68325nh13nzvdG+h1+A1eRd6W7xBL+2NeFd5V3vf 8/Z4P/Qe957wnvSe9n7t/cZ71vu79w/vX/4sv9Y/wZ/tn+TX+fP8vf8GIwGneg0KZW5kc3RyZWFt DQplbmRvYmoNCjU2MyAwIG9iag0KWyAyNzhdIA0KZW5kb2JqDQo1NjQgMCBvYmoNCjw8L1R5cGUv WFJlZi9TaXplIDU2NC9XWyAxIDQgMl0gL1Jvb3QgMSAwIFIvSW5mbyAxMTQgMCBSL0lEWzxBQUYw RUNGMTUwRjBFNjQ4OTJDRDEwQ0U2RTM2M0UxQj48QUFGMEVDRjE1MEYwRTY0ODkyQ0QxMENFNkUz NjNFMUI+XSAvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCAxMjAyPj4NCnN0cmVhbQ0KeJw113WU lGUYxuG511YQ7EaQVhG7KAFbsQNbsbsVFTuwW8HG7kSxsVtM7C7sAAMbl+da94+9zpx5z8w3Xzy/ 8zYazX9TpqT5/2yNxlSOKjK4aFqjmLktHilmGV206g0rW/1btF6zmLVP0Xa1YoEuuKxY0GcutCJu L9pZ0s6ShefEaUX7JhyGiUWH3fFpschWGF90HISnik6OpdM9ReceuLbo0g4jiq5+ZtdTim6+ttsR +KXovjcmFItuh7eLxTbE88XiA/FQ0WM53FYs0bXoOaro5QB7jSl698QNRZ8OuLjoOwdOL/pNB1es 3+Rilf3wddF/CN4rBmyCv4qBPxerflEMeqxYz7XdfKZisG/Y3qfsMA0+L4aMK/aYAT8VBx5eHLRX McwtNezP4sT9i5O2LM6cEa7mCJdqpNMz6o3iyrHFTa0xpRjdprg7xcPnFWOHF8/2LZ5zY76+fDF+ 2eL9d4oPHPWEjsWXzu4PGxQ/ulsnOpGTvi0mN98hzTdCY2guw+W4tPj/vSuaV/7eueVVI2jy3iiv HsE0mAnTYgZMh+kxI9pgZrTGLGiFWTEnZkdbzIY5MB/mwVyYG/OiHRbE/FgAC6EjOmBhtMci6IYu 6ITO6IoeWAzdsSgWx9JYEkugJ5bCClgOy2BZLI/eWBkrYiX0Qn/0Qx/0xSpYHatiAAZiNayDtbAG 1sTa2ADrYV0MwvrYFBtjQ2yETbAlBmMzbI4tsB22wVbYGttiJwzB9tgBO2J37IqdsQt2wz7YC3tg T+yNA7E/9sV+OABDcQgOwsE4FEfiCByGwzEMx+EYHIWjcSyG40QcjxNwEk7HqTgZp+A0nIOzcAbO xNm4EOfjXJyHC3AJLsIIjMTFaBkehk6jZeiYRI0rcC2uxpW4CtfgJtyA63A9bsTtuBU34xbchrtx F+7AnRiN+3Ev7sEY3IexeAgP4EE8XKRlWD2Jx/EoHrOk5Wc+gefwDJ7C03gWL+FFPI8XMA6v41W8 jFfwGt7GmxiPN/AWPsB7eAfv4n18io/xIT7CJ/gKn2ECPscX+BI/4Gt8h2/wLb7HL/gRk/ATJuJn /Ilf8Tt+w2T84Tq0FO8v/Iu/8Q+mWKlq0cYIX1oSKYrRv4hbJDLaGDWMDEbVon+RyGhj1DD6FzWM NkbxoniRwQhftDGKF8WLDMbjFP2LREb44sGL/kUUI4Px/EUwo4aRwYhi1DDCFxmMfEYbo4YRzHje o4ZRw0hkRDG6GTWMGsZjH6WMNkY+I4oRxShltDHyGVGMKMbwiGBGIqOi0cZoYwQzEhkVjUkUiYxE RjejlBHTSGRMqShl5DOCGU2NUkYpY+RFRaObkdaYbtHN6GbENPIZhY0BGPmMfEZTo6IR2hicUdGo aKQ1Yhq9jYpGRSOtEdPobQzciGnENAobTY3sRkxjekdTI7SR1qhvNDXGdqQ1ehuFjYpGWiPJ0dsI bUQ40hrDPwob2Y3QRlOjsFHmyG40NVoc2Y3CRl6ivtHbSHKENkIb9Y3eRoGizNHb6G1EOLIbZY7e Rm8jbtHiqG8ELJekkTYjp24H0ryjmcqY2mLk3tq9NHWrHVhT9xZqr9Y0bm7cUbzVvLP5D7do+HEN CmVuZHN0cmVhbQ0KZW5kb2JqDQp4cmVmDQowIDU2NQ0KMDAwMDAwMDExNSA2NTUzNSBmDQowMDAw MDAwMDE3IDAwMDAwIG4NCjAwMDAwMDAxMjYgMDAwMDAgbg0KMDAwMDAwMDM0NCAwMDAwMCBuDQow MDAwMDAwNTgzIDAwMDAwIG4NCjAwMDAwMDI1NzYgMDAwMDAgbg0KMDAwMDAwMjc1MSAwMDAwMCBu DQowMDAwMDAyOTk1IDAwMDAwIG4NCjAwMDAwMDMxMzIgMDAwMDAgbg0KMDAwMDAwMzE2MCAwMDAw MCBuDQowMDAwMDAzMzI2IDAwMDAwIG4NCjAwMDAwMDM0MDAgMDAwMDAgbg0KMDAwMDAwMzY0NSAw MDAwMCBuDQowMDAwMDA0MTY1IDAwMDAwIG4NCjAwMDAwMDY5NTAgMDAwMDAgbg0KMDAwMDAwNzA2 OSAwMDAwMCBuDQowMDAwMDA3MjM5IDAwMDAwIG4NCjAwMDAwMDc0ODAgMDAwMDAgbg0KMDAwMDAw NzU5OSAwMDAwMCBuDQowMDAwMDA3NzE4IDAwMDAwIG4NCjAwMDAwMDc4MzcgMDAwMDAgbg0KMDAw MDAwNzk1NiAwMDAwMCBuDQowMDAwMDA4MDc1IDAwMDAwIG4NCjAwMDAwMDgxOTQgMDAwMDAgbg0K MDAwMDAwODMxMyAwMDAwMCBuDQowMDAwMDA4NDMzIDAwMDAwIG4NCjAwMDAwMDg1NTMgMDAwMDAg bg0KMDAwMDAwODY3NCAwMDAwMCBuDQowMDAwMDA4Nzk1IDAwMDAwIG4NCjAwMDAwMDg5MTYgMDAw MDAgbg0KMDAwMDAwOTAzNyAwMDAwMCBuDQowMDAwMDA5MTU3IDAwMDAwIG4NCjAwMDAwMDkyNzcg MDAwMDAgbg0KMDAwMDAwOTM5NyAwMDAwMCBuDQowMDAwMDA5NTE3IDAwMDAwIG4NCjAwMDAwMDk2 MzcgMDAwMDAgbg0KMDAwMDAwOTc1OCAwMDAwMCBuDQowMDAwMDA5ODc5IDAwMDAwIG4NCjAwMDAw MTAwMDAgMDAwMDAgbg0KMDAwMDAxMDEyMSAwMDAwMCBuDQowMDAwMDEwMjQyIDAwMDAwIG4NCjAw MDAwMTAzNjMgMDAwMDAgbg0KMDAwMDAxMDQ4NCAwMDAwMCBuDQowMDAwMDEwNjA1IDAwMDAwIG4N CjAwMDAwMTA3MjYgMDAwMDAgbg0KMDAwMDAxMDg0NyAwMDAwMCBuDQowMDAwMDEwOTY4IDAwMDAw IG4NCjAwMDAwMTEwODkgMDAwMDAgbg0KMDAwMDAxMTIxMCAwMDAwMCBuDQowMDAwMDExMzMxIDAw MDAwIG4NCjAwMDAwMTE0NTIgMDAwMDAgbg0KMDAwMDAxMTU3MyAwMDAwMCBuDQowMDAwMDExNjk0 IDAwMDAwIG4NCjAwMDAwMTE4MTUgMDAwMDAgbg0KMDAwMDAxMjE5MiAwMDAwMCBuDQowMDAwMDE1 MTY1IDAwMDAwIG4NCjAwMDAwMTUyODYgMDAwMDAgbg0KMDAwMDAxNTQwNyAwMDAwMCBuDQowMDAw MDE1NTI4IDAwMDAwIG4NCjAwMDAwMTU2NDkgMDAwMDAgbg0KMDAwMDAxNTc3MCAwMDAwMCBuDQow MDAwMDE1ODkxIDAwMDAwIG4NCjAwMDAwMTYwMTIgMDAwMDAgbg0KMDAwMDAxNjEzMyAwMDAwMCBu DQowMDAwMDE2MjU0IDAwMDAwIG4NCjAwMDAwMTYzNzUgMDAwMDAgbg0KMDAwMDAxNjQ5NiAwMDAw MCBuDQowMDAwMDE2NjE3IDAwMDAwIG4NCjAwMDAwMTY3MzggMDAwMDAgbg0KMDAwMDAxNjg1OSAw MDAwMCBuDQowMDAwMDE2OTgwIDAwMDAwIG4NCjAwMDAwMTcxNDcgMDAwMDAgbg0KMDAwMDAxNzM5 NSAwMDAwMCBuDQowMDAwMDE3NjM3IDAwMDAwIG4NCjAwMDAwMTk5MDUgMDAwMDAgbg0KMDAwMDAy MDE0NyAwMDAwMCBuDQowMDAwMDIyMjgxIDAwMDAwIG4NCjAwMDAwMjI1MzMgMDAwMDAgbg0KMDAw MDAyNDY3NCAwMDAwMCBuDQowMDAwMDI0ODM1IDAwMDAwIG4NCjAwMDAwMjUwNjAgMDAwMDAgbg0K MDAwMDAyNTI5MyAwMDAwMCBuDQowMDAwMDI3MTQzIDAwMDAwIG4NCjAwMDAwMjczNzYgMDAwMDAg bg0KMDAwMDAyOTU2MiAwMDAwMCBuDQowMDAwMDI5ODA0IDAwMDAwIG4NCjAwMDAwMzE3NjEgMDAw MDAgbg0KMDAwMDAzMTk5NCAwMDAwMCBuDQowMDAwMDM0MTYxIDAwMDAwIG4NCjAwMDAwMzQzOTQg MDAwMDAgbg0KMDAwMDAzNjM2MCAwMDAwMCBuDQowMDAwMDM2NTkzIDAwMDAwIG4NCjAwMDAwMzg4 NTMgMDAwMDAgbg0KMDAwMDAzOTA4NiAwMDAwMCBuDQowMDAwMDQxMTczIDAwMDAwIG4NCjAwMDAw NDE0MDYgMDAwMDAgbg0KMDAwMDA0MzUzMyAwMDAwMCBuDQowMDAwMDQzNzc1IDAwMDAwIG4NCjAw MDAwNDU4MzkgMDAwMDAgbg0KMDAwMDA0NjA4MSAwMDAwMCBuDQowMDAwMDQ4NTMxIDAwMDAwIG4N CjAwMDAwNDg3NzUgMDAwMDAgbg0KMDAwMDA1MTI2MiAwMDAwMCBuDQowMDAwMDUxNTE2IDAwMDAw IG4NCjAwMDAwNTQwNzAgMDAwMDAgbg0KMDAwMDA1NDMyNCAwMDAwMCBuDQowMDAwMDU2NTM3IDAw MDAwIG4NCjAwMDAwNTY3ODEgMDAwMDAgbg0KMDAwMDA1ODkxNSAwMDAwMCBuDQowMDAwMDU5MTY5 IDAwMDAwIG4NCjAwMDAwNjEwMDggMDAwMDAgbg0KMDAwMDA2MTI1MyAwMDAwMCBuDQowMDAwMDYx OTQzIDAwMDAwIG4NCjAwMDAwNjIxODcgMDAwMDAgbg0KMDAwMDA2MzI2MiAwMDAwMCBuDQowMDAw MDAwMTE2IDY1NTM1IGYNCjAwMDAwMDAxMTcgNjU1MzUgZg0KMDAwMDAwMDExOCA2NTUzNSBmDQow MDAwMDAwMTE5IDY1NTM1IGYNCjAwMDAwMDAxMjAgNjU1MzUgZg0KMDAwMDAwMDEyMSA2NTUzNSBm DQowMDAwMDAwMTIyIDY1NTM1IGYNCjAwMDAwMDAxMjMgNjU1MzUgZg0KMDAwMDAwMDEyNCA2NTUz NSBmDQowMDAwMDAwMTI1IDY1NTM1IGYNCjAwMDAwMDAxMjYgNjU1MzUgZg0KMDAwMDAwMDEyNyA2 NTUzNSBmDQowMDAwMDAwMTI4IDY1NTM1IGYNCjAwMDAwMDAxMjkgNjU1MzUgZg0KMDAwMDAwMDEz MCA2NTUzNSBmDQowMDAwMDAwMTMxIDY1NTM1IGYNCjAwMDAwMDAxMzIgNjU1MzUgZg0KMDAwMDAw MDEzMyA2NTUzNSBmDQowMDAwMDAwMTM0IDY1NTM1IGYNCjAwMDAwMDAxMzUgNjU1MzUgZg0KMDAw MDAwMDEzNiA2NTUzNSBmDQowMDAwMDAwMTM3IDY1NTM1IGYNCjAwMDAwMDAxMzggNjU1MzUgZg0K MDAwMDAwMDEzOSA2NTUzNSBmDQowMDAwMDAwMTQwIDY1NTM1IGYNCjAwMDAwMDAxNDEgNjU1MzUg Zg0KMDAwMDAwMDE0MiA2NTUzNSBmDQowMDAwMDAwMTQzIDY1NTM1IGYNCjAwMDAwMDAxNDQgNjU1 MzUgZg0KMDAwMDAwMDE0NSA2NTUzNSBmDQowMDAwMDAwMTQ2IDY1NTM1IGYNCjAwMDAwMDAxNDcg NjU1MzUgZg0KMDAwMDAwMDE0OCA2NTUzNSBmDQowMDAwMDAwMTQ5IDY1NTM1IGYNCjAwMDAwMDAx NTAgNjU1MzUgZg0KMDAwMDAwMDE1MSA2NTUzNSBmDQowMDAwMDAwMTUyIDY1NTM1IGYNCjAwMDAw MDAxNTMgNjU1MzUgZg0KMDAwMDAwMDE1NCA2NTUzNSBmDQowMDAwMDAwMTU1IDY1NTM1IGYNCjAw MDAwMDAxNTYgNjU1MzUgZg0KMDAwMDAwMDE1NyA2NTUzNSBmDQowMDAwMDAwMTU4IDY1NTM1IGYN CjAwMDAwMDAxNTkgNjU1MzUgZg0KMDAwMDAwMDE2MCA2NTUzNSBmDQowMDAwMDAwMTYxIDY1NTM1 IGYNCjAwMDAwMDAxNjIgNjU1MzUgZg0KMDAwMDAwMDE2MyA2NTUzNSBmDQowMDAwMDAwMTY0IDY1 NTM1IGYNCjAwMDAwMDAxNjUgNjU1MzUgZg0KMDAwMDAwMDE2NiA2NTUzNSBmDQowMDAwMDAwMTY3 IDY1NTM1IGYNCjAwMDAwMDAxNjggNjU1MzUgZg0KMDAwMDAwMDE2OSA2NTUzNSBmDQowMDAwMDAw MTcwIDY1NTM1IGYNCjAwMDAwMDAxNzEgNjU1MzUgZg0KMDAwMDAwMDE3MiA2NTUzNSBmDQowMDAw MDAwMTczIDY1NTM1IGYNCjAwMDAwMDAxNzQgNjU1MzUgZg0KMDAwMDAwMDE3NSA2NTUzNSBmDQow MDAwMDAwMTc2IDY1NTM1IGYNCjAwMDAwMDAxNzcgNjU1MzUgZg0KMDAwMDAwMDE3OCA2NTUzNSBm DQowMDAwMDAwMTc5IDY1NTM1IGYNCjAwMDAwMDAxODAgNjU1MzUgZg0KMDAwMDAwMDE4MSA2NTUz NSBmDQowMDAwMDAwMTgyIDY1NTM1IGYNCjAwMDAwMDAxODMgNjU1MzUgZg0KMDAwMDAwMDE4NCA2 NTUzNSBmDQowMDAwMDAwMTg1IDY1NTM1IGYNCjAwMDAwMDAxODYgNjU1MzUgZg0KMDAwMDAwMDE4 NyA2NTUzNSBmDQowMDAwMDAwMTg4IDY1NTM1IGYNCjAwMDAwMDAxODkgNjU1MzUgZg0KMDAwMDAw MDE5MCA2NTUzNSBmDQowMDAwMDAwMTkxIDY1NTM1IGYNCjAwMDAwMDAxOTIgNjU1MzUgZg0KMDAw MDAwMDE5MyA2NTUzNSBmDQowMDAwMDAwMTk0IDY1NTM1IGYNCjAwMDAwMDAxOTUgNjU1MzUgZg0K MDAwMDAwMDE5NiA2NTUzNSBmDQowMDAwMDAwMTk3IDY1NTM1IGYNCjAwMDAwMDAxOTggNjU1MzUg Zg0KMDAwMDAwMDE5OSA2NTUzNSBmDQowMDAwMDAwMjAwIDY1NTM1IGYNCjAwMDAwMDAyMDEgNjU1 MzUgZg0KMDAwMDAwMDIwMiA2NTUzNSBmDQowMDAwMDAwMjAzIDY1NTM1IGYNCjAwMDAwMDAyMDQg NjU1MzUgZg0KMDAwMDAwMDIwNSA2NTUzNSBmDQowMDAwMDAwMjA2IDY1NTM1IGYNCjAwMDAwMDAy MDcgNjU1MzUgZg0KMDAwMDAwMDIwOCA2NTUzNSBmDQowMDAwMDAwMjA5IDY1NTM1IGYNCjAwMDAw MDAyMTAgNjU1MzUgZg0KMDAwMDAwMDIxMSA2NTUzNSBmDQowMDAwMDAwMjEyIDY1NTM1IGYNCjAw MDAwMDAyMTMgNjU1MzUgZg0KMDAwMDAwMDIxNCA2NTUzNSBmDQowMDAwMDAwMjE1IDY1NTM1IGYN CjAwMDAwMDAyMTYgNjU1MzUgZg0KMDAwMDAwMDIxNyA2NTUzNSBmDQowMDAwMDAwMjE4IDY1NTM1 IGYNCjAwMDAwMDAyMTkgNjU1MzUgZg0KMDAwMDAwMDIyMCA2NTUzNSBmDQowMDAwMDAwMjIxIDY1 NTM1IGYNCjAwMDAwMDAyMjIgNjU1MzUgZg0KMDAwMDAwMDIyMyA2NTUzNSBmDQowMDAwMDAwMjI0 IDY1NTM1IGYNCjAwMDAwMDAyMjUgNjU1MzUgZg0KMDAwMDAwMDIyNiA2NTUzNSBmDQowMDAwMDAw MjI3IDY1NTM1IGYNCjAwMDAwMDAyMjggNjU1MzUgZg0KMDAwMDAwMDIyOSA2NTUzNSBmDQowMDAw MDAwMjMwIDY1NTM1IGYNCjAwMDAwMDAyMzEgNjU1MzUgZg0KMDAwMDAwMDIzMiA2NTUzNSBmDQow MDAwMDAwMjMzIDY1NTM1IGYNCjAwMDAwMDAyMzQgNjU1MzUgZg0KMDAwMDAwMDIzNSA2NTUzNSBm DQowMDAwMDAwMjM2IDY1NTM1IGYNCjAwMDAwMDAyMzcgNjU1MzUgZg0KMDAwMDAwMDIzOCA2NTUz NSBmDQowMDAwMDAwMjM5IDY1NTM1IGYNCjAwMDAwMDAyNDAgNjU1MzUgZg0KMDAwMDAwMDI0MSA2 NTUzNSBmDQowMDAwMDAwMjQyIDY1NTM1IGYNCjAwMDAwMDAyNDMgNjU1MzUgZg0KMDAwMDAwMDI0 NCA2NTUzNSBmDQowMDAwMDAwMjQ1IDY1NTM1IGYNCjAwMDAwMDAyNDYgNjU1MzUgZg0KMDAwMDAw MDI0NyA2NTUzNSBmDQowMDAwMDAwMjQ4IDY1NTM1IGYNCjAwMDAwMDAyNDkgNjU1MzUgZg0KMDAw MDAwMDI1MCA2NTUzNSBmDQowMDAwMDAwMjUxIDY1NTM1IGYNCjAwMDAwMDAyNTIgNjU1MzUgZg0K MDAwMDAwMDI1MyA2NTUzNSBmDQowMDAwMDAwMjU0IDY1NTM1IGYNCjAwMDAwMDAyNTUgNjU1MzUg Zg0KMDAwMDAwMDI1NiA2NTUzNSBmDQowMDAwMDAwMjU3IDY1NTM1IGYNCjAwMDAwMDAyNTggNjU1 MzUgZg0KMDAwMDAwMDI1OSA2NTUzNSBmDQowMDAwMDAwMjYwIDY1NTM1IGYNCjAwMDAwMDAyNjEg NjU1MzUgZg0KMDAwMDAwMDI2MiA2NTUzNSBmDQowMDAwMDAwMjYzIDY1NTM1IGYNCjAwMDAwMDAy NjQgNjU1MzUgZg0KMDAwMDAwMDI2NSA2NTUzNSBmDQowMDAwMDAwMjY2IDY1NTM1IGYNCjAwMDAw MDAyNjcgNjU1MzUgZg0KMDAwMDAwMDI2OCA2NTUzNSBmDQowMDAwMDAwMjY5IDY1NTM1IGYNCjAw MDAwMDAyNzAgNjU1MzUgZg0KMDAwMDAwMDI3MSA2NTUzNSBmDQowMDAwMDAwMjcyIDY1NTM1IGYN CjAwMDAwMDAyNzMgNjU1MzUgZg0KMDAwMDAwMDI3NCA2NTUzNSBmDQowMDAwMDAwMjc1IDY1NTM1 IGYNCjAwMDAwMDAyNzYgNjU1MzUgZg0KMDAwMDAwMDI3NyA2NTUzNSBmDQowMDAwMDAwMjc4IDY1 NTM1IGYNCjAwMDAwMDAyNzkgNjU1MzUgZg0KMDAwMDAwMDI4MCA2NTUzNSBmDQowMDAwMDAwMjgx IDY1NTM1IGYNCjAwMDAwMDAyODIgNjU1MzUgZg0KMDAwMDAwMDI4MyA2NTUzNSBmDQowMDAwMDAw Mjg0IDY1NTM1IGYNCjAwMDAwMDAyODUgNjU1MzUgZg0KMDAwMDAwMDI4NiA2NTUzNSBmDQowMDAw MDAwMjg3IDY1NTM1IGYNCjAwMDAwMDAyODggNjU1MzUgZg0KMDAwMDAwMDI4OSA2NTUzNSBmDQow MDAwMDAwMjkwIDY1NTM1IGYNCjAwMDAwMDAyOTEgNjU1MzUgZg0KMDAwMDAwMDI5MiA2NTUzNSBm DQowMDAwMDAwMjkzIDY1NTM1IGYNCjAwMDAwMDAyOTQgNjU1MzUgZg0KMDAwMDAwMDI5NSA2NTUz NSBmDQowMDAwMDAwMjk2IDY1NTM1IGYNCjAwMDAwMDAyOTcgNjU1MzUgZg0KMDAwMDAwMDI5OCA2 NTUzNSBmDQowMDAwMDAwMjk5IDY1NTM1IGYNCjAwMDAwMDAzMDAgNjU1MzUgZg0KMDAwMDAwMDMw MSA2NTUzNSBmDQowMDAwMDAwMzAyIDY1NTM1IGYNCjAwMDAwMDAzMDMgNjU1MzUgZg0KMDAwMDAw MDMwNCA2NTUzNSBmDQowMDAwMDAwMzA1IDY1NTM1IGYNCjAwMDAwMDAzMDYgNjU1MzUgZg0KMDAw MDAwMDMwNyA2NTUzNSBmDQowMDAwMDAwMzA4IDY1NTM1IGYNCjAwMDAwMDAzMDkgNjU1MzUgZg0K MDAwMDAwMDMxMCA2NTUzNSBmDQowMDAwMDAwMzExIDY1NTM1IGYNCjAwMDAwMDAzMTIgNjU1MzUg Zg0KMDAwMDAwMDMxMyA2NTUzNSBmDQowMDAwMDAwMzE0IDY1NTM1IGYNCjAwMDAwMDAzMTUgNjU1 MzUgZg0KMDAwMDAwMDMxNiA2NTUzNSBmDQowMDAwMDAwMzE3IDY1NTM1IGYNCjAwMDAwMDAzMTgg NjU1MzUgZg0KMDAwMDAwMDMxOSA2NTUzNSBmDQowMDAwMDAwMzIwIDY1NTM1IGYNCjAwMDAwMDAz MjEgNjU1MzUgZg0KMDAwMDAwMDMyMiA2NTUzNSBmDQowMDAwMDAwMzIzIDY1NTM1IGYNCjAwMDAw MDAzMjQgNjU1MzUgZg0KMDAwMDAwMDMyNSA2NTUzNSBmDQowMDAwMDAwMzI2IDY1NTM1IGYNCjAw MDAwMDAzMjcgNjU1MzUgZg0KMDAwMDAwMDMyOCA2NTUzNSBmDQowMDAwMDAwMzI5IDY1NTM1IGYN CjAwMDAwMDAzMzAgNjU1MzUgZg0KMDAwMDAwMDMzMSA2NTUzNSBmDQowMDAwMDAwMzMyIDY1NTM1 IGYNCjAwMDAwMDAzMzMgNjU1MzUgZg0KMDAwMDAwMDMzNCA2NTUzNSBmDQowMDAwMDAwMzM1IDY1 NTM1IGYNCjAwMDAwMDAzMzYgNjU1MzUgZg0KMDAwMDAwMDMzNyA2NTUzNSBmDQowMDAwMDAwMzM4 IDY1NTM1IGYNCjAwMDAwMDAzMzkgNjU1MzUgZg0KMDAwMDAwMDM0MCA2NTUzNSBmDQowMDAwMDAw MzQxIDY1NTM1IGYNCjAwMDAwMDAzNDIgNjU1MzUgZg0KMDAwMDAwMDM0MyA2NTUzNSBmDQowMDAw MDAwMzQ0IDY1NTM1IGYNCjAwMDAwMDAzNDUgNjU1MzUgZg0KMDAwMDAwMDM0NiA2NTUzNSBmDQow MDAwMDAwMzQ3IDY1NTM1IGYNCjAwMDAwMDAzNDggNjU1MzUgZg0KMDAwMDAwMDM0OSA2NTUzNSBm DQowMDAwMDAwMzUwIDY1NTM1IGYNCjAwMDAwMDAzNTEgNjU1MzUgZg0KMDAwMDAwMDM1MiA2NTUz NSBmDQowMDAwMDAwMzUzIDY1NTM1IGYNCjAwMDAwMDAzNTQgNjU1MzUgZg0KMDAwMDAwMDM1NSA2 NTUzNSBmDQowMDAwMDAwMzU2IDY1NTM1IGYNCjAwMDAwMDAzNTcgNjU1MzUgZg0KMDAwMDAwMDM1 OCA2NTUzNSBmDQowMDAwMDAwMzU5IDY1NTM1IGYNCjAwMDAwMDAzNjAgNjU1MzUgZg0KMDAwMDAw MDM2MSA2NTUzNSBmDQowMDAwMDAwMzYyIDY1NTM1IGYNCjAwMDAwMDAzNjMgNjU1MzUgZg0KMDAw MDAwMDM2NCA2NTUzNSBmDQowMDAwMDAwMzY1IDY1NTM1IGYNCjAwMDAwMDAzNjYgNjU1MzUgZg0K MDAwMDAwMDM2NyA2NTUzNSBmDQowMDAwMDAwMzY4IDY1NTM1IGYNCjAwMDAwMDAzNjkgNjU1MzUg Zg0KMDAwMDAwMDM3MCA2NTUzNSBmDQowMDAwMDAwMzcxIDY1NTM1IGYNCjAwMDAwMDAzNzIgNjU1 MzUgZg0KMDAwMDAwMDM3MyA2NTUzNSBmDQowMDAwMDAwMzc0IDY1NTM1IGYNCjAwMDAwMDAzNzUg NjU1MzUgZg0KMDAwMDAwMDM3NiA2NTUzNSBmDQowMDAwMDAwMzc3IDY1NTM1IGYNCjAwMDAwMDAz NzggNjU1MzUgZg0KMDAwMDAwMDM3OSA2NTUzNSBmDQowMDAwMDAwMzgwIDY1NTM1IGYNCjAwMDAw MDAzODEgNjU1MzUgZg0KMDAwMDAwMDM4MiA2NTUzNSBmDQowMDAwMDAwMzgzIDY1NTM1IGYNCjAw MDAwMDAzODQgNjU1MzUgZg0KMDAwMDAwMDM4NSA2NTUzNSBmDQowMDAwMDAwMzg2IDY1NTM1IGYN CjAwMDAwMDAzODcgNjU1MzUgZg0KMDAwMDAwMDM4OCA2NTUzNSBmDQowMDAwMDAwMzg5IDY1NTM1 IGYNCjAwMDAwMDAzOTAgNjU1MzUgZg0KMDAwMDAwMDM5MSA2NTUzNSBmDQowMDAwMDAwMzkyIDY1 NTM1IGYNCjAwMDAwMDAzOTMgNjU1MzUgZg0KMDAwMDAwMDM5NCA2NTUzNSBmDQowMDAwMDAwMzk1 IDY1NTM1IGYNCjAwMDAwMDAzOTYgNjU1MzUgZg0KMDAwMDAwMDM5NyA2NTUzNSBmDQowMDAwMDAw Mzk4IDY1NTM1IGYNCjAwMDAwMDAzOTkgNjU1MzUgZg0KMDAwMDAwMDQwMCA2NTUzNSBmDQowMDAw MDAwNDAxIDY1NTM1IGYNCjAwMDAwMDA0MDIgNjU1MzUgZg0KMDAwMDAwMDQwMyA2NTUzNSBmDQow MDAwMDAwNDA0IDY1NTM1IGYNCjAwMDAwMDA0MDUgNjU1MzUgZg0KMDAwMDAwMDQwNiA2NTUzNSBm DQowMDAwMDAwNDA3IDY1NTM1IGYNCjAwMDAwMDA0MDggNjU1MzUgZg0KMDAwMDAwMDQwOSA2NTUz NSBmDQowMDAwMDAwNDEwIDY1NTM1IGYNCjAwMDAwMDA0MTEgNjU1MzUgZg0KMDAwMDAwMDQxMiA2 NTUzNSBmDQowMDAwMDAwNDEzIDY1NTM1IGYNCjAwMDAwMDA0MTQgNjU1MzUgZg0KMDAwMDAwMDQx NSA2NTUzNSBmDQowMDAwMDAwNDE2IDY1NTM1IGYNCjAwMDAwMDA0MTcgNjU1MzUgZg0KMDAwMDAw MDQxOCA2NTUzNSBmDQowMDAwMDAwNDE5IDY1NTM1IGYNCjAwMDAwMDA0MjAgNjU1MzUgZg0KMDAw MDAwMDQyMSA2NTUzNSBmDQowMDAwMDAwNDIyIDY1NTM1IGYNCjAwMDAwMDA0MjMgNjU1MzUgZg0K MDAwMDAwMDQyNCA2NTUzNSBmDQowMDAwMDAwNDI1IDY1NTM1IGYNCjAwMDAwMDA0MjYgNjU1MzUg Zg0KMDAwMDAwMDQyNyA2NTUzNSBmDQowMDAwMDAwNDI4IDY1NTM1IGYNCjAwMDAwMDA0MjkgNjU1 MzUgZg0KMDAwMDAwMDQzMCA2NTUzNSBmDQowMDAwMDAwNDMxIDY1NTM1IGYNCjAwMDAwMDA0MzIg NjU1MzUgZg0KMDAwMDAwMDQzMyA2NTUzNSBmDQowMDAwMDAwNDM0IDY1NTM1IGYNCjAwMDAwMDA0 MzUgNjU1MzUgZg0KMDAwMDAwMDQzNiA2NTUzNSBmDQowMDAwMDAwNDM3IDY1NTM1IGYNCjAwMDAw MDA0MzggNjU1MzUgZg0KMDAwMDAwMDQzOSA2NTUzNSBmDQowMDAwMDAwNDQwIDY1NTM1IGYNCjAw MDAwMDA0NDEgNjU1MzUgZg0KMDAwMDAwMDQ0MiA2NTUzNSBmDQowMDAwMDAwNDQzIDY1NTM1IGYN CjAwMDAwMDA0NDQgNjU1MzUgZg0KMDAwMDAwMDQ0NSA2NTUzNSBmDQowMDAwMDAwNDQ2IDY1NTM1 IGYNCjAwMDAwMDA0NDcgNjU1MzUgZg0KMDAwMDAwMDQ0OCA2NTUzNSBmDQowMDAwMDAwNDQ5IDY1 NTM1IGYNCjAwMDAwMDA0NTAgNjU1MzUgZg0KMDAwMDAwMDQ1MSA2NTUzNSBmDQowMDAwMDAwNDUy IDY1NTM1IGYNCjAwMDAwMDA0NTMgNjU1MzUgZg0KMDAwMDAwMDQ1NCA2NTUzNSBmDQowMDAwMDAw NDU1IDY1NTM1IGYNCjAwMDAwMDA0NTYgNjU1MzUgZg0KMDAwMDAwMDQ1NyA2NTUzNSBmDQowMDAw MDAwNDU4IDY1NTM1IGYNCjAwMDAwMDA0NTkgNjU1MzUgZg0KMDAwMDAwMDQ2MCA2NTUzNSBmDQow MDAwMDAwNDYxIDY1NTM1IGYNCjAwMDAwMDA0NjIgNjU1MzUgZg0KMDAwMDAwMDQ2MyA2NTUzNSBm DQowMDAwMDAwNDY0IDY1NTM1IGYNCjAwMDAwMDA0NjUgNjU1MzUgZg0KMDAwMDAwMDQ2NiA2NTUz NSBmDQowMDAwMDAwNDY3IDY1NTM1IGYNCjAwMDAwMDA0NjggNjU1MzUgZg0KMDAwMDAwMDQ2OSA2 NTUzNSBmDQowMDAwMDAwNDcwIDY1NTM1IGYNCjAwMDAwMDA0NzEgNjU1MzUgZg0KMDAwMDAwMDQ3 MiA2NTUzNSBmDQowMDAwMDAwNDczIDY1NTM1IGYNCjAwMDAwMDA0NzQgNjU1MzUgZg0KMDAwMDAw MDQ3NSA2NTUzNSBmDQowMDAwMDAwNDc2IDY1NTM1IGYNCjAwMDAwMDA0NzcgNjU1MzUgZg0KMDAw MDAwMDQ3OCA2NTUzNSBmDQowMDAwMDAwNDc5IDY1NTM1IGYNCjAwMDAwMDA0ODAgNjU1MzUgZg0K MDAwMDAwMDQ4MSA2NTUzNSBmDQowMDAwMDAwNDgyIDY1NTM1IGYNCjAwMDAwMDA0ODMgNjU1MzUg Zg0KMDAwMDAwMDQ4NCA2NTUzNSBmDQowMDAwMDAwNDg1IDY1NTM1IGYNCjAwMDAwMDA0ODYgNjU1 MzUgZg0KMDAwMDAwMDQ4NyA2NTUzNSBmDQowMDAwMDAwNDg4IDY1NTM1IGYNCjAwMDAwMDA0ODkg NjU1MzUgZg0KMDAwMDAwMDQ5MCA2NTUzNSBmDQowMDAwMDAwNDkxIDY1NTM1IGYNCjAwMDAwMDA0 OTIgNjU1MzUgZg0KMDAwMDAwMDQ5MyA2NTUzNSBmDQowMDAwMDAwNDk0IDY1NTM1IGYNCjAwMDAw MDA0OTUgNjU1MzUgZg0KMDAwMDAwMDQ5NiA2NTUzNSBmDQowMDAwMDAwNDk3IDY1NTM1IGYNCjAw MDAwMDA0OTggNjU1MzUgZg0KMDAwMDAwMDQ5OSA2NTUzNSBmDQowMDAwMDAwNTAwIDY1NTM1IGYN CjAwMDAwMDA1MDEgNjU1MzUgZg0KMDAwMDAwMDUwMiA2NTUzNSBmDQowMDAwMDAwNTAzIDY1NTM1 IGYNCjAwMDAwMDA1MDQgNjU1MzUgZg0KMDAwMDAwMDUwNSA2NTUzNSBmDQowMDAwMDAwNTA2IDY1 NTM1IGYNCjAwMDAwMDA1MDcgNjU1MzUgZg0KMDAwMDAwMDUwOCA2NTUzNSBmDQowMDAwMDAwNTA5 IDY1NTM1IGYNCjAwMDAwMDA1MTAgNjU1MzUgZg0KMDAwMDAwMDUxMSA2NTUzNSBmDQowMDAwMDAw NTEyIDY1NTM1IGYNCjAwMDAwMDA1MTMgNjU1MzUgZg0KMDAwMDAwMDUxNCA2NTUzNSBmDQowMDAw MDAwNTE1IDY1NTM1IGYNCjAwMDAwMDA1MTYgNjU1MzUgZg0KMDAwMDAwMDUxNyA2NTUzNSBmDQow MDAwMDAwNTE4IDY1NTM1IGYNCjAwMDAwMDA1MTkgNjU1MzUgZg0KMDAwMDAwMDUyMCA2NTUzNSBm DQowMDAwMDAwNTIxIDY1NTM1IGYNCjAwMDAwMDA1MjIgNjU1MzUgZg0KMDAwMDAwMDUyMyA2NTUz NSBmDQowMDAwMDAwNTI0IDY1NTM1IGYNCjAwMDAwMDA1MjUgNjU1MzUgZg0KMDAwMDAwMDUyNiA2 NTUzNSBmDQowMDAwMDAwNTI3IDY1NTM1IGYNCjAwMDAwMDA1MjggNjU1MzUgZg0KMDAwMDAwMDUy OSA2NTUzNSBmDQowMDAwMDAwNTMwIDY1NTM1IGYNCjAwMDAwMDA1MzEgNjU1MzUgZg0KMDAwMDAw MDUzMiA2NTUzNSBmDQowMDAwMDAwNTMzIDY1NTM1IGYNCjAwMDAwMDA1MzQgNjU1MzUgZg0KMDAw MDAwMDUzNSA2NTUzNSBmDQowMDAwMDAwNTM2IDY1NTM1IGYNCjAwMDAwMDA1MzcgNjU1MzUgZg0K MDAwMDAwMDUzOCA2NTUzNSBmDQowMDAwMDAwNTM5IDY1NTM1IGYNCjAwMDAwMDA1NDAgNjU1MzUg Zg0KMDAwMDAwMDU0MSA2NTUzNSBmDQowMDAwMDAwNTQyIDY1NTM1IGYNCjAwMDAwMDA1NDMgNjU1 MzUgZg0KMDAwMDAwMDU0NCA2NTUzNSBmDQowMDAwMDAwNTQ1IDY1NTM1IGYNCjAwMDAwMDA1NDYg NjU1MzUgZg0KMDAwMDAwMDU0NyA2NTUzNSBmDQowMDAwMDAwNTQ4IDY1NTM1IGYNCjAwMDAwMDA1 NDkgNjU1MzUgZg0KMDAwMDAwMDU1MCA2NTUzNSBmDQowMDAwMDAwNTUxIDY1NTM1IGYNCjAwMDAw MDA1NTIgNjU1MzUgZg0KMDAwMDAwMDU1MyA2NTUzNSBmDQowMDAwMDAwMDAwIDY1NTM1IGYNCjAw MDAwNjk1MjggMDAwMDAgbg0KMDAwMDA2OTg4OCAwMDAwMCBuDQowMDAwMTEyMTg4IDAwMDAwIG4N CjAwMDAxMTI2MjUgMDAwMDAgbg0KMDAwMDE0MTQzOCAwMDAwMCBuDQowMDAwMTQxNjk0IDAwMDAw IG4NCjAwMDAxNDE3MjIgMDAwMDAgbg0KMDAwMDE4MzU3NCAwMDAwMCBuDQowMDAwMTgzNzI4IDAw MDAwIG4NCjAwMDAxODYyODYgMDAwMDAgbg0KMDAwMDE4NjMxNCAwMDAwMCBuDQp0cmFpbGVyDQo8 PC9TaXplIDU2NS9Sb290IDEgMCBSL0luZm8gMTE0IDAgUi9JRFs8QUFGMEVDRjE1MEYwRTY0ODky Q0QxMENFNkUzNjNFMUI+PEFBRjBFQ0YxNTBGMEU2NDg5MkNEMTBDRTZFMzYzRTFCPl0gPj4NCnN0 YXJ0eHJlZg0KMTg3NzIxDQolJUVPRg0KeHJlZg0KMCAwDQp0cmFpbGVyDQo8PC9TaXplIDU2NS9S b290IDEgMCBSL0luZm8gMTE0IDAgUi9JRFs8QUFGMEVDRjE1MEYwRTY0ODkyQ0QxMENFNkUzNjNF MUI+PEFBRjBFQ0YxNTBGMEU2NDg5MkNEMTBDRTZFMzYzRTFCPl0gL1ByZXYgMTg3NzIxL1hSZWZT dG0gMTg2MzE0Pj4NCnN0YXJ0eHJlZg0KMTk5MTgyDQolJUVPRg== ------=_NextPart_000_07C3_01CA0BF7.04650F40-- From marcelo@it.uc3m.es Thu Jul 23 09:50:35 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E01713A68C4 for ; Thu, 23 Jul 2009 09:50:35 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.283 X-Spam-Level: X-Spam-Status: No, score=-6.283 tagged_above=-999 required=5 tests=[AWL=-0.284, BAYES_00=-2.599, J_CHICKENPOX_44=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nHuYI-BGee8E for ; Thu, 23 Jul 2009 09:50:35 -0700 (PDT) Received: from smtp02.uc3m.es (smtp02.uc3m.es [163.117.176.132]) by core3.amsl.com (Postfix) with ESMTP id DC4813A67EF for ; Thu, 23 Jul 2009 09:50:34 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp02.uc3m.es (Postfix) with ESMTP id 0DAA96BACDA; Thu, 23 Jul 2009 18:20:48 +0200 (CEST) Message-ID: <4A688DDF.6080105@it.uc3m.es> Date: Thu, 23 Jul 2009 18:20:47 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> <4A6888F3.5080809@it.uc3m.es> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:50:36 -0000 Jun Bi escribió: >>> >> well, you could achieve better security if you used another approach > > > > Please let us know the approach with better security. > In my option, FCFS will lower the security. > In CPS, the host under SAVI-swtich can't spoof. it's > reasonable, predictable, and dependable. > In FCFS,even the host user SAVI-switch can STILL spoof, > it's NOT predictable, and dependable. Will you call FCFS brings better > security? > how is that? ... >> >>> >> as i mentioned before, you can call it a deployment suggestion but >> what it really is is a mean to have all the devices in the subnetwork >> to be SAVI devices, which is the way to comply with the limitation >> imposed by the CPS savi > > It's very easy and CLEAR for a operator to divide SAVI area > and non-SAVI area. > sure we can require the IP subnetwork to only have SAVI devices, but this is certainly a limitation Regrads, marcelo From marcelo@it.uc3m.es Thu Jul 23 09:50:59 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 980033A6B7E for ; Thu, 23 Jul 2009 09:50:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.569 X-Spam-Level: X-Spam-Status: No, score=-6.569 tagged_above=-999 required=5 tests=[AWL=0.030, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id p+s41adLOabe for ; Thu, 23 Jul 2009 09:50:58 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 8051F3A6AD7 for ; Thu, 23 Jul 2009 09:50:58 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (wlap005.it.uc3m.es [163.117.139.108]) by smtp01.uc3m.es (Postfix) with ESMTP id 2C948BA009B; Thu, 23 Jul 2009 18:16:52 +0200 (CEST) Message-ID: <4A688CF4.7080102@it.uc3m.es> Date: Thu, 23 Jul 2009 18:16:52 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Jun Bi References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <720C8A3E452D49CD8DA2221E6818EDD8@userPC> In-Reply-To: <720C8A3E452D49CD8DA2221E6818EDD8@userPC> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16780.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 16:50:59 -0000 Jun Bi escribió: > > Hi Marcelo, > > By reading all you emails, I think you also recognize the benifit of CPS. > Yes, you may ask more benifit, but please trade off the cost and the > benifit. > CPS is really a low cost solution and be implemented in switch and > tested. To recognize the benifit, > the WG at least could made some progress (having a solution works in > some situation). > It doesn't mean CPS prevent other new technology. You could continute > you work, but at > least now we did see FCFS has much more problems. I simply fail to see how you conclude that. Let's consider CPS for SLAAC The main problem with CPS is that it hard-codes underlying assumption in the network architecture. What do i mean by this? Well, basically, CPS assumes that in order to allow a host to send packets, it must have been a prior DAD. While this is common, it is not required by the current IPv6 architecture. But CPs hardcodes it in SAVI. The result is that the fate sharing domain of the node is significantly increased. If the SAVI device looses state, then the host is blocked. If the DAD packet is lost, the host is blocked. The result is a significantly less robust network architecture. I simply believe that is not a good tradeoff. then we can go to more practical issues. The CPS solution requires manual configuration of the ports (whehter they are connected to a SAVI device, a host or a legacy switch) IIt doesn't protect from attackers connected to a legacy device from spoofing any address in the subnetwork, even if the target host is connected to a SAVI device. this means that either all the devices of the network are SAVI devices or that significant attacks are possible. So, no, i don't agree to move forward with CPS. Regards, marcelo > > Thanks, > Jun > > > > > >> If you think that is not enough, >> OK, please design a SAVI solution that can protect _all_ the IP >> address in >> the >> IP subnetwork with only _partly_ deployment and _without_ modify current >> protocols. >> I think you may find it is impossible. >>> >>> This must be explicitly mentioned since imho it is a severe deployment >>> limitation. >>> In other words, if we want to deploy CPS in a subntework, then all the >>> devices MUST be SAVI devices. >>> >>> Regards, marcelo >> >> [Guang Yao] >> >> >> > > > From yaoa02@mails.tsinghua.edu.cn Thu Jul 23 11:10:41 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3F1383A688C for ; Thu, 23 Jul 2009 11:10:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.455 X-Spam-Level: X-Spam-Status: No, score=-2.455 tagged_above=-999 required=5 tests=[AWL=0.144, BAYES_00=-2.599] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id wEP6h2YZNr-i for ; Thu, 23 Jul 2009 11:10:40 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id A2DA83A69C0 for ; Thu, 23 Jul 2009 11:10:39 -0700 (PDT) Received: from th024085.ip.tsinghua.edu.cn ([59.66.24.85] helo=yaoguangPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MU1Mq-0007yK-Kr; Fri, 24 Jul 2009 00:42:04 +0800 From: "Guang Yao" To: "'marcelo bagnulo braun'" , "'Jun Bi'" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> In-Reply-To: <4A68784B.3090508@it.uc3m.es> Date: Fri, 24 Jul 2009 00:42:03 +0800 Message-ID: <002001ca0bb4$82282bd0$86788370$@tsinghua.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 12.0 Thread-Index: AcoLrHNK5WRpuyMgSeuzWIOzJy8vEAAAXIZQ Content-Language: zh-cn Cc: 'SAVI Mailing List' , 'Christian Vogt' , 'Guang Yao' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 18:10:41 -0000 > -----Original Message----- > From: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] On Behalf = Of > marcelo bagnulo braun > Sent: Thursday, July 23, 2009 10:49 PM > To: Jun Bi > Cc: SAVI Mailing List; Christian Vogt; Guang Yao > Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? >=20 > Jun Bi escribi=F3: > > > > ----- Original Message ----- From: "marcelo bagnulo braun" > > > > To: "Jun Bi" > > Cc: "SAVI Mailing List" ; "Christian Vogt" > > ; "Guang Yao" > > > Sent: Thursday, July 23, 2009 10:20 PM > > Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > > > > > > Jun Bi escribi=F3: > >> > >> > >> > >> ----- Original Message ----- From: "marcelo bagnulo braun" > >> > >> To: "Christian Vogt" > >> Cc: "SAVI Mailing List" ; "Guang Yao" > >> > >> Sent: Thursday, July 23, 2009 6:07 PM > >> Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > >> > >> > >> Sorry for coming back to this, but i have further comments... > >> > >> Christian Vogt escribi=F3: > >>> > >>> CPS calls for SAVI devices to create > >>> bindings only for directly attached hosts, not for hosts attached = via > >>> another switch. This is based on the assumption that the ports of SAVI > >>> devices are configured with respect to whether they connect to a = host > >>> directly, or whether they connect to another switch. For ports > >>> connecting to another switch, SAVI protection is disabled. > >>> > >> I would like to come back to the level of protection achieved by = this. > >> > >> Suppose you have the following topology. > >> > >> > >> +-------------------+ > >> | Internet | > >> +-------------------+ > >> | > >> | > >> +-------+ > >> | router| > >> +-------+ > >> | > >> +--------+ > >> |SAVICPS1|--H3 > >> +--------+ > >> | | > >> +----+ +---+ > >> | | > >> +-------------+ +--------+ > >> |Legacy Switch| |SAVICPS2| > >> +-------------+ +--------+ > >> | | > >> H1 H2 > >> > >> > >> > >> So suppose that as you say, the SAVICPS does create bindings for = ports > >> connected to another switch. > >> > >> > >> [Jun Bi] > >> SAVI-CPS1 won't creat binding for trunk port. > > > > sorry, this is what i quoted above and that is what i meant... (i = guess > > i was too concentrated in the ascii and disregarded the actual text) > > > >> > >> So, how do we prevent H1 from spoofing H2 address when is sending > >> packets to H3 (or to any host in the rest of the internet in the picture > >> above)? > >> > >> > >> I mean, i understnad that the main idea in CPS is that there is > >> perimeter defense, so all the borders need to provide protection. > >> I understand that in order to actually provide the protection, the > >> SAVICPS1 device must create bindings for hosts connected behind the > >> legacy switch, or am i missing something? > >> > >> [Jun Bi] > >> Dear Marcelo, > >> Thank you for the question. > >> CPS only validate the source address of SAVI deployment area = (SAVI > >> area) (for hosts directly attached to SAVI > >> switches). The goal is to make the hosts in SAVI area (H1 and H3 > >> in your picture) won't spoof. > > > > > >> > >> If the admistrator really want more benifit, we have a = deployment > >> suggestion. > >> The network adminstrator knows which is SAVI-switch, which is > >> non-SAVI-swtich. > >> Then he can configure two VLANs, one for SAVI area, other for > >> non-SAVI area, > >> then assign differnt address space (prefixes) for two differnet > >> areas. > >> The layer 3 device will do the ingress filtering then H1 can't = use > >> H2's source address. > >> > > > > so, basically you mean that in order to get SAVI protection _all_ = the > > devices in the same IP subnetwork MUST use SAVI devices and you = cannot > > have legacy devices. > > > > Hi, I don't want to use the word "protect", it should be > > "anti-spoof". > > SAVI-CPS could anti-spoof in SAVI-area, not none-SAVI area. > > If you deploy _all_ SAVI-CPS switch, then you anti-spoof = for > > _all_ host. > > If you deploy some of them, then you anti-spoof for some = host > > attched to the new SAVI-switch. >=20 > but this is misleading > I mean, as if you see in the figure i sketched above, the host that is > connected in the legacy switch can spoof the address of _any_ host = even > those that are connected to a SAVI device. >=20 [Guang Yao]=20 CPS checks packet from trunk port based on "no local conflict" = principle. In another word, the host cannot spoof the host directly attached to the switch. So at least it cannot spoof _any_ host, specially the directly connected hosts. And with the packet pass through more SAVI devices, the possibility is = lower for it to spoof. And what is most important, the ability of SAVI is defined to be = filtering, not protect. Please see the charter. > So if you have a network that is using some CPS SAVI devices and some > legacy switches, an attacker connected to a legacy device can spoof = any > address in the network. [Guang Yao]=20 I cannot image a mechanism, deployed on a device, stops an attacker = attached to other device=20 from spoofing others' addresses. >=20 > So when a host is connected to a SAVI device this doesn't mean that = its > address is protected and no attacker can spoof it, but what it means = is > that the host cannot spoof any other address of another host that is > also connected to a savi device (this assuming that the DAD packets = are > widely distributed, which may not be the case, but this is a different > story) >=20 [Guang Yao]=20 No, it is protected from used by other nodes attached to SAVI devices. > so i think the protection resulting from the solution is fairly weak. >=20 > Regards, marcelo >=20 > > I think it's reasonable. The more SAVI-switch you deploy, = the > > more host you anti-spoof. > > There is no free luch. > > > > > > This must be explicitly mentioned since imho it is a severe = deployment > > limitation. > > > > Hi, we mentioned it, that's why Christian also methion it = at > > the email above. > > >=20 >=20 >=20 >=20 > > In other words, if we want to deploy CPS in a subntework, then all = the > > devices MUST be SAVI devices. > > > > Not "MUST", did you see you reply? > > > > > > > > > > > > Regards, marcelo > > > >> Best Regards, > >> Jun Bi > >> > >> > >> > >> > >> > >> > >> > >> > > > > _______________________________________________ > > savi mailing list > > savi@ietf.org > > https://www.ietf.org/mailman/listinfo/savi > > > > > > > > >=20 > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi From alberto@it.uc3m.es Fri Jul 24 02:10:29 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 87B523A69EF for ; Fri, 24 Jul 2009 02:10:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hSvbGkBsH5qw for ; Fri, 24 Jul 2009 02:10:27 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id 1CC133A6908 for ; Fri, 24 Jul 2009 02:10:26 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp03.uc3m.es (Postfix) with ESMTP id 876A872CB22; Fri, 24 Jul 2009 11:10:26 +0200 (CEST) From: =?utf-8?Q?Alberto_Garc=C3=ADa?= To: "'Dong Zhang'" , "'Padmanabha Nallur'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com><200907151050081554172@huaweisymantec.com><75998D9056424F94A34294F878EF8958@bombo><200907161018350396693@huaweisymantec.com><16C7F3CCDE434470AF2D409B79B70A8E@bombo><200907171450265993512@huaweisymantec.com><4EB312B4DC044B6DB99E8E16EFEA72D7@bombo><200907201040329011805@huaweisymantec.com><86BC9051818A451D9387B294D512D11B@bombo><000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> <200907231103387344535@huaweisymantec.com> Date: Fri, 24 Jul 2009 11:10:23 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <200907231103387344535@huaweisymantec.com> Thread-Index: AcoLS2K1MQ953TrvSA+OmiFJIcIjtgA7tmdA X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16782.003 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2009 09:10:29 -0000 Hi Dong, | -----Mensaje original----- | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de = Dong | Zhang | Enviado el: jueves, 23 de julio de 2009 5:04 | Para: Alberto_Garc=C3=ADa; 'Padmanabha Nallur' | CC: 'SAVI Mailing List'; 'Christian Vogt' | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi Alberto, | Alberto_Garc=C3=ADa 2009-07-22 Wrote: | >Hi, | > | >| -----Mensaje original----- | >| De: Padmanabha Nallur [mailto:pnallur@huawei.com] | >| Enviado el: lunes, 20 de julio de 2009 23:01 | >| Para: 'Alberto Garc=C3=ADa' | >| CC: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | >| Asunto: RE: [savi] About draft-dong-savi-cga-header-02.txt | >| | >| Hi Alberto, | >| | >| The main point of the CGA proposal is to avoid IP spoofing. | >| In order to avoid IP spoofing the source IP address checks must = be | performed | >| closer to the destination or destination network as opposed to = implementing | >| these checks in the source network (e.g., SAVI). | >| | >| The CGA proposal provides an alternative solution to prevent IP = spoofing by | >| providing the checks that can be implemented in the destination = endpoint or | >| destination network (actually anywhere in the network). We would = like to | >| have as simple solution as possible and preferably even stateless = solution. | > | >In my opinion, what you are proposing is dangerous. Let's consider = flood-based | DoS (draft-ietf-savi-threat-scope-00.txt): an attacker wants to = exhaust the | victim's resources by sending traffic to it. With your mechanism, = packets with | false CGA information do not only consume TCP state, memory for IP | fragmentation... but they also force the host to spend a lot of CPU = in using public | cryptography to check a CGA! This is what any attacker would like: = force hosts to | do a lot of work for fake packets! | >This is why in Shim6 and HIP a 4-way handshake is performed: the = initiator | must prove at least that the address is using is topologically valid = (for accounting | purposes). | We are aware of the cost of the computation and the a few possible = DoS attacks. | Please read the section 8 and the security consideration in the = draft. Would these | remove your worry? Not really.=20 As far as I understand, the three types of verification you propose = (8.1, 8.2, 8.3) are allowed.=20 If you allow 8.1, an host trying to DoS a victim's node will send a CGA = Request, and the victim's node will answer with 'CGA Params, CGA Sig'. = This costs the victim some CPU: the CGA Request includes a sequence = number, and the CGA signature includes this sequence number, so it has = to compute specifically for every packet sent. To protect from this you say in 10: "When one host receives packets with = CGA Request from a same source address repeatedly, it MUST refuse to = return the CGA Params and CGA Signature." But, of course, a single = attacker is going to use different addresses every time! =20 So, IMHO, 8.1 introduces a new vulnerability that was not present = before. You need to rate-limit the generation of this in general, not = for any specific source, and then you should accept packets not = protected. So, if a node wants to impersonate another, first sends lots of requests = to start the rate-limited mode, and then sends unprotected packets from = a source to impersonate. And the purpose of the mechanism is defeated. 8.3 is almost Shim6. But, since with Shim6 a state is created, you don't = need to convey the CGA information on every packet. Security is less = (you are not requesting all the time the other end to prove it has the = private key), but it may be enough for this purpose, since it was proved = at the beginning the address ownership, and the will of the remote host = to communicate.=20 This is statefull, and intermediate routers could not perform any kind = of filtering based on this information unless they trace the whole = exchange.=20 But I don't see which protection could be provided without state: you = have included a sequence number and a request/response mechanism that = use it (8.1, 8.2, 8.3), and it is a good approach because it protects = against reply attacks. If intermediate routers are not aware of this = exchange (because they work without state), they are prone to reply = attacks.=20 I really don't see a clear benefit/cost/security_risk balance for = allowing routers in any intermediate location to perform such filtering. 8.2 is an in-between 8.1 - 8.3 Regards, Alberto | =20 | Thanks. | > | >In addition, you propose not only perform this DoS-prone check not = only in the | host, but anywhere in the network. So any router should divert a = packet from | the silicon fast path to the router CPU to check the CGA... That = would be double | prize for the attacker: not only compromising a host, but the whole | communication pipe of a site. | > | >I really don't see this. | > | >Regards, | >Alberto | > | >| This is the main goal of CGA proposal and it would be great if it = can ALSO | >| be used in other situations (e.g., SAVI) as you mentioned below. | >| | >| Validation of the IP address itself (like prefix check) is not = the main goal | >| of the CGA proposal. | >| | >| | >| Thanks | >| Paddy Nallur | >| | >| -----Original Message----- | >| From: Alberto Garc=C3=ADa [mailto:alberto@it.uc3m.es] | >| Sent: Monday, July 20, 2009 3:29 AM | >| To: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | >| Cc: 'Padmanabha Nallur 73868' | >| Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt | >| | >| Hi | >| | >| | -----Mensaje original----- | >| | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre de | >| Dong | >| | Zhang | >| | Enviado el: lunes, 20 de julio de 2009 4:41 | >| | Para: Alberto_Garc=C3=ADa; 'Christian Vogt'; 'SAVI Mailing = List' | >| | CC: 'Padmanabha Nallur 73868' | >| | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | >| | | >| | Hi Alberto, | >| | Please check inline. | >| | | >| | Thank you. | >| | | >| | Alberto_Garc=C3=ADa 2009-07-17 Wrote: | >| | >Hi | >| | > | >| | >| -----Mensaje original----- | >| | >| De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] = En nombre | de | >| | Dong | >| | >| Zhang | >| | >| Enviado el: viernes, 17 de julio de 2009 8:50 | >| | >| Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | >| | >| CC: 'Padmanabha Nallur 73868' | >| | >| Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | >| | >| | >| | >| Alberto_Garc=E9=9F=86 2009-07-16 Wrote: | >| | >| >| I do not think it is a conflict. The difference is = just how to | >| | >| >| use CGA. For instance, the CGA proposal can be used in = e2e, even | >| | between | >| | >| >the | >| | >| >| host | >| | >| >| and the first-hop router. It can depend on the = destination option | >| header. | >| | >| > | >| | >| >Shim6 allows transporting CGA information end-to-end. It = does that | >| now, in | >| | a | >| | >| >standard way. Why you should want to generate a = yet-another- | protocol | >| to | >| | >| >transport CGA information end-to-end? | >| | >| Thank you for the information. | >| | >| We will read Shim6. If it really does the relative job, we = will be | >| glad to use it. | >| | >| > | >| | >| >Besides, what does such a protocol would have to do with = SAVI? | >| | >| >If you want to use CGAs for providing security in the = link of the | >| host and | >| | >| >the first-hop router, you should probably use the SEND = protocol (see | >| | >| >draft-ietf-savi-send-00). Do you think there is something = in the | >| SEND | >| | >| >protocol that does not suit with binding IPv6 addresses = and link | >| layer | >| | >| >anchors, that could be improved? | >| | >| >And if you want to use the CGA for address validation = further than | >| the first | >| | >| >hop routers, I see some reasons why you should not: at = that point | >| you | >| | need | >| | >| >to validate prefixes, not host addresses, and CGA = provides no | >| protection for | >| | >| >prefixes: any host can generate a valid CGA with = whichever prefix it | >| wanted. | >| | >| >So just validating a CGA does not assure that the host is = authorized | >| to use | >| | >| >that prefix. | >| | >| In the CGA-related information, it contains the signature. = We think | >| it can | >| | >| protect the prefix. Right? | >| | > | >| | >Well, it does not prove that a host has been legitimately = assigned a | >| prefix. | >| | >CGAs, with a protocol transporting signatures made with the = private key, | >| only | >| | assure that once a host generates a given address, it is very = very | >| difficult for | >| | another host to use the same address. And yes, the protection = includes | >| the | >| | prefix: it is just not enough to find a key pair whose hash = generates a | >| given | >| | interface identifier, and then you can impersonate any host = with the same | >| | interface identifier in any network (i.e. with any prefix). | >| | [Dong] Well, yes, we agree with this. CGA does not do identity | >| authentication. | >| | We only validate the address so that someone else cannot use = this IP | >| address. | >| | We do not check for the IP address binding with a host or a = user or some | >| other | >| | higher level entity and validate that. | >| | | >| | Just the fact that someone else cannot use the same address = would give | >| the | >| | benefits mentioned in the use cases within the draft. | >| | >| I think the place to do this is in the first link. And the tool = SEND + SAVI. | >| Outside the first link, I think it is too costly to do checks in = a | >| per-address basis, and you need other tools (manual = configuration, routing | >| info...) for validating prefixes... so just validate prefixes = with this | >| tools. | >| | >| | | >| | IMHO, we don't think even SAVI solutions need to validate the = binding of | >| IP | >| | address with users etc., only check if a certain IP address is = used on a | >| specific | >| | link. | >| | >| Yes, of course. I was not talking at any point in "users". | >| Again, to check the address, use SEND. | >| | >| | > | >| | >But that says nothing about the legitimacy of ah host to use = that | >| prefix. | >| | >For example, give the prefix of your network, and I can = generate | >| immediately | >| | an CGA that claims to belong to your prefix: CGA =3D hash ( = prefix | public | >| key | | >| | etc). And I can use from my network, if the router (and some = routers | >| above) | >| | does not check source prefixes. Looking only at the CGA nobody = can know | >| if my | >| | host is authorized to use a prefix or not. | >| | >So, CGA does not add anything to prefix protection. You have = to provide | >| other | >| | means to protect that. | >| | I guess the ingress filtering could do this. And savi = solutions are the | >| complement | >| | for ingress filtering. This point has been discussed before. | >| | > | >| | > | >| | >| > | >| | >| >| > | >| | >| >| >What does this type of solutions has to do with SAVI, | >| considering that | >| | >| >the | >| | >| >| >charter says: "No changes to hosts are allowed."? = Isn't your | >| solution | >| | >| >| >proposing a change to hosts? | >| | >| >| Yes, the CGA proposal does not fit for the current = charter quit | >| well to | >| | >| >some | >| | >| >| extend. | >| | >| >| The reason why we put the CGA-related info in the = extension | >| header is | >| | >| >that it | >| | >| >| has | >| | >| >| the ability to provide a basic security for the source = address | >| like AH & | >| | >| >ESP. The | >| | >| > | >| | >| >The CGA security model does not have much relationship = with AH & | >| ESP. | >| | Well, | >| | >| >all use keys, but besides that... | >| | >| I mean if we could take the CGA-related information in the = extension | >| header, | >| | >| the packet will have AH, ESP and CGA for the basic = security | >| characteristics, | >| | >| including integrity, confidentiality, and authentication. | >| | > | >| | >This is completely different stuff. It seems like generating = an | >| opportunistic IKE | >| | security context (a la SSL) for a communication, starting with = the | >| public/private | >| | key pair associated to the CGAs of two hosts. Then you should = look at | >| | http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt | >| | I am a little confused here. I have already known this draft = before. Are | >| you | >| | comparing it with my another draft, | >| http://tools.ietf.org/id/draft-zhang-shen-sa- | >| | cga-00.txt ? | >| | >| I was not aware of your draft. I wasn't comparing anything, but, = from the | >| title of your draft, yes it seems similar. | >| | >| Regards, | >| Alberto | >| | >| | | >| | | >| | ------------------ | >| | Dong Zhang | >| | 2009-07-20 | > | >. | =20 From alberto@it.uc3m.es Fri Jul 24 02:15:57 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8621E3A688A for ; Fri, 24 Jul 2009 02:15:57 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.299 X-Spam-Level: X-Spam-Status: No, score=-6.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id V7r3DoHsxsR8 for ; Fri, 24 Jul 2009 02:15:56 -0700 (PDT) Received: from smtp01.uc3m.es (smtp01.uc3m.es [163.117.176.131]) by core3.amsl.com (Postfix) with ESMTP id 9BB953A67FE for ; Fri, 24 Jul 2009 02:15:55 -0700 (PDT) Received: from bombo (bombo.it.uc3m.es [163.117.139.125]) by smtp01.uc3m.es (Postfix) with ESMTP id 21104BA5890; Fri, 24 Jul 2009 11:15:42 +0200 (CEST) From: =?utf-8?Q?Alberto_Garc=C3=ADa?= To: "'Padmanabha Nallur'" References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> <200907201040329011805@huaweisymantec.com> <86BC9051818A451D9387B294D512D11B@bombo> <000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> <008201ca0bd7$fb53d590$bdd9c10a@china.huawei.com> Date: Fri, 24 Jul 2009 11:15:39 +0200 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-Mailer: Microsoft Office Outlook 11 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5579 In-Reply-To: <008201ca0bd7$fb53d590$bdd9c10a@china.huawei.com> Thread-Index: AcoI44hA98flWtdsRCC5hU95ZpxRdAAQCr0gABXGNyAAVj56gABAzbPAABnTtiA= X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16782.003 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2009 09:15:57 -0000 Hi Paddy | -----Mensaje original----- | De: Padmanabha Nallur [mailto:pnallur@huawei.com] | Enviado el: jueves, 23 de julio de 2009 22:56 | Para: 'Alberto Garc=C3=ADa' | CC: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | Asunto: RE: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi, | =20 | Please see inline with [Paddy2]. | =20 | Thanks | Paddy Nallur | =20 | -----Original Message----- | From: Alberto Garc=C3=ADa [mailto:alberto@it.uc3m.es] | Sent: Wednesday, July 22, 2009 7:16 AM | To: 'Padmanabha Nallur' | Cc: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi, | =20 | | -----Mensaje original----- | | De: Padmanabha Nallur [mailto:pnallur@huawei.com] | | Enviado el: lunes, 20 de julio de 2009 23:01 | | Para: 'Alberto Garc=C3=ADa' | | CC: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | | Asunto: RE: [savi] About draft-dong-savi-cga-header-02.txt | | | | Hi Alberto, | | | | The main point of the CGA proposal is to avoid IP spoofing. | | In order to avoid IP spoofing the source IP address checks must be | performed | | closer to the destination or destination network as opposed to | implementing | | these checks in the source network (e.g., SAVI). | | | | The CGA proposal provides an alternative solution to prevent IP = spoofing | by | | providing the checks that can be implemented in the destination = endpoint | or | | destination network (actually anywhere in the network). We would = like to | | have as simple solution as possible and preferably even stateless | solution. | =20 | In my opinion, what you are proposing is dangerous. Let's consider | flood-based DoS (draft-ietf-savi-threat-scope-00.txt): an attacker = wants to | exhaust the victim's resources by sending traffic to it. With your | mechanism, packets with false CGA information do not only consume TCP = state, | memory for IP fragmentation... but they also force the host to spend = a lot | of CPU in using public cryptography to check a CGA! This is what any | attacker would like: force hosts to do a lot of work for fake = packets! | =20 | [Paddy2] Yes, we are well aware of these problems having worked in = this area | for several years. We are also looking at further simplifications = like | making it stateless, performing the public/private key cryptography = only for | the first packet etc.,=20 Statefull? | We would be very glad to receive any suggestions in | this direction. Please see my previous email. | =20 | This is why in Shim6 and HIP a 4-way handshake is performed: the = initiator | must prove at least that the address is using is topologically valid = (for | accounting purposes). | =20 | [Paddy2] I took a quick look at Shim6 and it seems like it is meant = to solve | a different problem than the one we are trying to. It looks = incredibly | complex for CGA proposal.=20 Yes, it solves a different problem. But there could be, if this approach = is value (at least for the end host) an applicability statement for this = use. Don't think it is so complex in the part related to the initial = exchange, which would be the part of the specification required. Of = course, for this use no locator exchange would be required... | Do you know, how much acceptance is there for the | Shim6 in the industry ? Any pointers would help us. Well, it is just standard from June 09...=20 Although it is a bit outdated, you can find some pointers about = implementations in http://www.shim6.org/ | =20 | =20 | In addition, you propose not only perform this DoS-prone check not = only in | the host, but anywhere in the network. So any router should divert a = packet | from the silicon fast path to the router CPU to check the CGA... That = would | be double prize for the attacker: not only compromising a host, but = the | whole communication pipe of a site. | =20 | [Paddy2] We are not saying that this should be performed all over the | network. It CAN be done in selective locations without compromising = the | device performance. I think this has important problems, see previous email. Regards, Alberto | =20 | I really don't see this. | =20 | Regards, | Alberto | =20 | | This is the main goal of CGA proposal and it would be great if it = can | ALSO | | be used in other situations (e.g., SAVI) as you mentioned below. | | | | Validation of the IP address itself (like prefix check) is not the = main | goal | | of the CGA proposal. | | | | | | Thanks | | Paddy Nallur | | | | -----Original Message----- | | From: Alberto Garc=C3=ADa [mailto:alberto@it.uc3m.es] | | Sent: Monday, July 20, 2009 3:29 AM | | To: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | | Cc: 'Padmanabha Nallur 73868' | | Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt | | | | Hi | | | | | -----Mensaje original----- | | | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre de | | Dong | | | Zhang | | | Enviado el: lunes, 20 de julio de 2009 4:41 | | | Para: Alberto_Garc=C3=ADa; 'Christian Vogt'; 'SAVI Mailing = List' | | | CC: 'Padmanabha Nallur 73868' | | | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | | | | | | Hi Alberto, | | | Please check inline. | | | | | | Thank you. | | | | | | Alberto_Garc=C3=ADa 2009-07-17 Wrote: | | | >Hi | | | > | | | >| -----Mensaje original----- | | | >| De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre | de | | | Dong | | | >| Zhang | | | >| Enviado el: viernes, 17 de julio de 2009 8:50 | | | >| Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | | | >| CC: 'Padmanabha Nallur 73868' | | | >| Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | | | >| | | | >| Alberto_Garc=E9=9F=86 2009-07-16 Wrote: | | | >| >| I do not think it is a conflict. The difference is just = how to | | | >| >| use CGA. For instance, the CGA proposal can be used in = e2e, | even | | | between | | | >| >the | | | >| >| host | | | >| >| and the first-hop router. It can depend on the = destination | option | | header. | | | >| > | | | >| >Shim6 allows transporting CGA information end-to-end. It = does | that | | now, in | | | a | | | >| >standard way. Why you should want to generate a | yet-another-protocol | | to | | | >| >transport CGA information end-to-end? | | | >| Thank you for the information. | | | >| We will read Shim6. If it really does the relative job, we = will be | | glad to use it. | | | >| > | | | >| >Besides, what does such a protocol would have to do with = SAVI? | | | >| >If you want to use CGAs for providing security in the link = of the | | host and | | | >| >the first-hop router, you should probably use the SEND = protocol | (see | | | >| >draft-ietf-savi-send-00). Do you think there is something = in the | | SEND | | | >| >protocol that does not suit with binding IPv6 addresses = and link | | layer | | | >| >anchors, that could be improved? | | | >| >And if you want to use the CGA for address validation = further | than | | the first | | | >| >hop routers, I see some reasons why you should not: at = that | point | | you | | | need | | | >| >to validate prefixes, not host addresses, and CGA provides = no | | protection for | | | >| >prefixes: any host can generate a valid CGA with whichever = prefix | it | | wanted. | | | >| >So just validating a CGA does not assure that the host is | authorized | | to use | | | >| >that prefix. | | | >| In the CGA-related information, it contains the signature. = We | think | | it can | | | >| protect the prefix. Right? | | | > | | | >Well, it does not prove that a host has been legitimately = assigned a | | prefix. | | | >CGAs, with a protocol transporting signatures made with the = private | key, | | only | | | assure that once a host generates a given address, it is very = very | | difficult for | | | another host to use the same address. And yes, the protection = includes | | the | | | prefix: it is just not enough to find a key pair whose hash = generates | a | | given | | | interface identifier, and then you can impersonate any host = with the | same | | | interface identifier in any network (i.e. with any prefix). | | | [Dong] Well, yes, we agree with this. CGA does not do identity | | authentication. | | | We only validate the address so that someone else cannot use = this IP | | address. | | | We do not check for the IP address binding with a host or a = user or | some | | other | | | higher level entity and validate that. | | | | | | Just the fact that someone else cannot use the same address = would give | | the | | | benefits mentioned in the use cases within the draft. | | | | I think the place to do this is in the first link. And the tool = SEND + | SAVI. | | Outside the first link, I think it is too costly to do checks in a | | per-address basis, and you need other tools (manual configuration, | routing | | info...) for validating prefixes... so just validate prefixes with = this | | tools. | | | | | | | | IMHO, we don't think even SAVI solutions need to validate the = binding | of | | IP | | | address with users etc., only check if a certain IP address is = used on | a | | specific | | | link. | | | | Yes, of course. I was not talking at any point in "users". | | Again, to check the address, use SEND. | | | | | > | | | >But that says nothing about the legitimacy of ah host to use = that | | prefix. | | | >For example, give the prefix of your network, and I can = generate | | immediately | | | an CGA that claims to belong to your prefix: CGA =3D hash ( = prefix | | public | | key | | | | etc). And I can use from my network, if the router (and some = routers | | above) | | | does not check source prefixes. Looking only at the CGA nobody = can | know | | if my | | | host is authorized to use a prefix or not. | | | >So, CGA does not add anything to prefix protection. You have = to | provide | | other | | | means to protect that. | | | I guess the ingress filtering could do this. And savi solutions = are | the | | complement | | | for ingress filtering. This point has been discussed before. | | | > | | | > | | | >| > | | | >| >| > | | | >| >| >What does this type of solutions has to do with SAVI, | | considering that | | | >| >the | | | >| >| >charter says: "No changes to hosts are allowed."? = Isn't your | | solution | | | >| >| >proposing a change to hosts? | | | >| >| Yes, the CGA proposal does not fit for the current = charter | quit | | well to | | | >| >some | | | >| >| extend. | | | >| >| The reason why we put the CGA-related info in the = extension | | header is | | | >| >that it | | | >| >| has | | | >| >| the ability to provide a basic security for the source = address | | like AH & | | | >| >ESP. The | | | >| > | | | >| >The CGA security model does not have much relationship = with AH & | | ESP. | | | Well, | | | >| >all use keys, but besides that... | | | >| I mean if we could take the CGA-related information in the | extension | | header, | | | >| the packet will have AH, ESP and CGA for the basic security | | characteristics, | | | >| including integrity, confidentiality, and authentication. | | | > | | | >This is completely different stuff. It seems like generating = an | | opportunistic IKE | | | security context (a la SSL) for a communication, starting with = the | | public/private | | | key pair associated to the CGAs of two hosts. Then you should = look at | | | http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt | | | I am a little confused here. I have already known this draft = before. | Are | | you | | | comparing it with my another draft, | | http://tools.ietf.org/id/draft-zhang-shen-sa- | | | cga-00.txt ? | | | | I was not aware of your draft. I wasn't comparing anything, but, = from the | | title of your draft, yes it seems similar. | | | | Regards, | | Alberto | | | | | | | | | | | ------------------ | | | Dong Zhang | | | 2009-07-20 From marcelo@it.uc3m.es Fri Jul 24 10:09:00 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3A60B3A684F for ; Fri, 24 Jul 2009 10:09:00 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.473 X-Spam-Level: X-Spam-Status: No, score=-6.473 tagged_above=-999 required=5 tests=[AWL=0.126, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id y728dNjb0rzZ for ; Fri, 24 Jul 2009 10:08:59 -0700 (PDT) Received: from smtp03.uc3m.es (smtp03.uc3m.es [163.117.176.133]) by core3.amsl.com (Postfix) with ESMTP id C8C1F3A6D19 for ; Fri, 24 Jul 2009 10:08:47 -0700 (PDT) Received: from marcelo-bagnulos-macbook-pro.local (34.pool85-53-136.dynamic.orange.es [85.53.136.34]) by smtp03.uc3m.es (Postfix) with ESMTP id 8A8B773175B; Fri, 24 Jul 2009 19:08:46 +0200 (CEST) Message-ID: <4A69EA9E.2080106@it.uc3m.es> Date: Fri, 24 Jul 2009 19:08:46 +0200 From: marcelo bagnulo braun User-Agent: Thunderbird 2.0.0.22 (Macintosh/20090605) MIME-Version: 1.0 To: Guang Yao References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <720C8A3E452D49CD8DA2221E6818EDD8@userPC> <4A688CF4.7080102@it.uc3m.es> <001e01ca0bb3$2a600db0$7f202910$@tsinghua.edu.cn> In-Reply-To: <001e01ca0bb3$2a600db0$7f202910$@tsinghua.edu.cn> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-TM-AS-Product-Ver: IMSS-7.0.0.3116-5.6.0.1016-16782.007 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 24 Jul 2009 17:09:00 -0000 Guang Yao escribió: > I want to summary my personal view on FCFS here: > [Guang Yao] > 1 The first weakness point is logic error. > > As we know, FCFS currently uses the following logic: > > "Bind the address if it is first ever appear on the switch, and drop the > packet with address conflicting current bindings." > > And FCFS_with_BDP uses the following logic: > > "Bind the address if it is first ever appear on all the SAVI switches on the > link, and drop the packet with address conflicting any the current binding > on all the SAVI switches." > > The problem is, whether it is reasonable and sufficient to set up bindings > when one address is first ever appear on one or any of the SAVI device? > > In a SLAAC only network, an implicit rule is that if a host uses an address > first, it has the right to hold this address and ask others not to use the > address. In another word, a reasonable binding is set up based on the clear > knowledge that the sender is the _first_ to use the address on the link. > > However, both FCFS and FCFS with BDP fail to be compatible with this rule, > though it is not obvious. FCFS actually takes "first appear on one of the > FCFS device" as "first used in the local link". Unfortunately, they are not > equivalent. > > For example, host H may be the first to use an address ADDR, but without > sending any packet to pass any of the FCFS devices, the host should send a DAD when configuring the address in the interface, so the FCFS SAVI device will learn it from there The remaining case is when the DAD is lost. In that case what to do? FCFS learns from the data packet (instead of blocking the legitimate user out of the network) > thus no binding will be > set up for it. Then, another host has the chance to trigger a binding of > ADDR. This binding will cause dropping of legal packets from H. > > The wrong design principle of FCFS results in a lot of potential problems. > > 2 The failure model in DHCP only scenario > > Recently FCFS is declared to support DHCP, except for no protection for > unused address. > > The first problem is that whether it is reasonable not to protect unused > addresses in DHCP only model. It is clear in a lot of DHCP only scenarios, > to allow other kinds of addresses will cause management problem. Another > problem is, since DHCP is the only used address assignment method, why not > choose a more stable and simple solution based on DHCPv6 snooping just as > DHCPv4 snooping, but choose an untested and potentially dangerous solution? > What's the benefit? > > i certainly can see the benefits of having the dhcp server to act as an authorization server centrally allocating the addreses. So, i can see a benefit in spoofing dhcp traffic In addition, dhcp exchange is reliable, so it is more likely that the savi device can learn reliably from it My concerns with this is what happens if the savi device looses the state? As we discussed earlier, it is clear that in wireless networks, the node does not need to send any dhcp msg when the AP reboots. the situation in the wired network still needs to be clarified by the dhcp experts, hope it can be done in the next meeting An additional concern is about how to handle legacy switches, as we discussed extensively already. An additionla concern is how to authenticat the dhcp server (i.e. how to prevent an attacker to send false dhcp msg and make beleive the savi device it has the right to use a given address) An additional concern is how to deal with topology changes, where the ports where packets come from a soruce may change > And a more serious problem is FCFS model will give chance to attackers to > trigger evil bindings to filter legal traffic. Because DHCPv6 server would > be likely to assign to a host the same address (Also an attacker may has the > chance to know the assigned address before the host if it is in the middle > of the victim and DHCPv6 server), an attacker has the chance to trigger that > address binding first. When a host gets a REPLY from DHCPv6 server, it > performs DAD but the attacker doesn't reply. Then once the victim sends > packets, these packets will be discarded by FCFS. > I am not sure i understnad this situation Does the host has or not has the address allocated to it? If it does not has it, but it is expecting to have the same address, there is no problem if it gets a different address. If the host does has it assigned, the savi device would have the binding. > 3 About BDP > FCFS relies on a BDP to sync all the FCFS devices in order to make > it work "more correctly". (See section 1 to find why FCFS will never work > real correctly). BDP has been regarded as a bad idea by a lot of people. > Here just to list some of the defects of BDP. > 1. Violate charter. > 2. Heavy cost. > how come? current switches execute a number of protocols, hwo come this one would be a heavy cost and the other are not? > 3. Incrementally deployment problem. > not sure what do you mean by this > 4. Secure problem on authentication between SAVI devices. > i can't see how this is different from authenticating a dhcp server for instance or with configuring some ports to be the ones that are connecting the other SAVI devices as CPS does > 5. Real time problem. > 6. Reliable problem. > 7. Economic problem. > > i don't understnad what do you mean by none of these > Recently, there is a trend to use DAD as BDP. However, we don't think the > above problems are really solved if DAD is modified to have the function of > BDP. > > using DAD is another alternative, as you mention, and it has pros and cons that need to be analyzed > 4 The problem of clearing binding > FCFS doesn't have specified design of when and how to remove a > binding. This problem is same important as the problem of setting up > binding. No binding clear mechanism will surely make the binding table full > and no new binding can be set up after a time. > > However, it is hard for FCFS to design a binding clearing mechanism. > We think this problem is due to FCFS sets up binding without regarding the > packet is from directly connected hosts or not directly connected hosts. If > a not directly connected host is disconnected from a switch, the FCFS switch > receives no signal and cannot drop the corresponding binding. > > so in cps, you assume that if the connection with the host is lost, then the binding is deleted? So you actually hardcode the rule that the host must perform DAD when the links flaps? what can i say, i don't think this is required by any rfc In FCFS, before dropping a entry, a series of NUDs is performed to make sure that the host is no longer connected, so the binding can be reliably discarded. > Though a BDP can make things better, the problem returns to the > problem of designing a _useable_ BDP. > > 5 Binding lost problem > FCFS has declared its robustness when binding lost. However, I don't > think it is reasonable. > Whenever a FCFS device reboot, an attacker can easily set up > bindings of all other addresses on the reboot device before any other hosts. > this woudl require the attacker to be able to reboot the savi device to launch the attack or to limit the attacks to the moment when the savi device reboost, which hopefull is not very often > Then all other hosts will be blocked from network. > Please note that FCFS works by definition better than CPS in this case. In fcfs, if the nodes perform the DAD, then they are in like in CPS. If they don't they can still be in, when they send a data packet. In CPS they are simply out > Although FCFS can learn bindings from data traffic, the problem is, > it may not learn correct bindings. > > 6 Filtering cost > The filtering cost is rarely high for FCFS. > 6.1. It will take every data packet into CPU > wouldn't every solution require that? I mean, since the savi device is epxected to filter every data apcket, then every data apcket needs to be processed Regards, marcelo > 6.2 It must go through a long "deny" list to make sure whether a > packet should be forwarded. > > > IMO, I don't agree to move forward with FCFS. > > > From christian.vogt@ericsson.com Sat Jul 25 08:27:59 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 04D543A67F2 for ; Sat, 25 Jul 2009 08:27:59 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.53 X-Spam-Level: X-Spam-Status: No, score=-2.53 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DATE_IN_PAST_06_12=1.069, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id NeAhaFCHEhqv for ; Sat, 25 Jul 2009 08:27:58 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id 54C7D3A6403 for ; Sat, 25 Jul 2009 08:27:58 -0700 (PDT) Received: from compute2.internal (compute2.internal [10.202.2.42]) by out1.messagingengine.com (Postfix) with ESMTP id 2D0353B1DEB; Sat, 25 Jul 2009 11:24:45 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute2.internal (MEProxy); Sat, 25 Jul 2009 11:24:45 -0400 X-Sasl-enc: 7HSpJGxKAZXgbQGQkxuDhvvfkCCqjBD7gzgPO6vHPXqj 1248535482 Received: from host-78-64-88-206.homerun.telia.com (host-78-64-88-206.homerun.telia.com [78.64.88.206]) by mail.messagingengine.com (Postfix) with ESMTPSA id 782202927F; Sat, 25 Jul 2009 11:24:42 -0400 (EDT) From: Christian Vogt To: "Jun Bi" In-Reply-To: <25255C7E5FB5419981A9AD148122331E@userPC> X-Priority: 3 References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <25255C7E5FB5419981A9AD148122331E@userPC> Message-Id: <62D489FF-D717-4FA5-AAF3-49DD8AECC941@ericsson.com> Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v930.4) Date: Fri, 24 Jul 2009 23:22:57 -0700 X-Mailer: Apple Mail (2.930.4) Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2009 15:27:59 -0000 On Jul 23, 2009, Jun Bi wrote: > We support two modes in SAVI. > (1) In DHCP-only network. > (2) In DHCP-SLAAC mixed network. This exactly matches with the two questions of the consensus call: Your case (1) corresponds to question (B), your case (2) to question (A). Given that you obviously agree with the way the consensus call was made, why didn't you send your response? - Christian From christian.vogt@ericsson.com Sat Jul 25 08:55:05 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1EE143A67EA for ; Sat, 25 Jul 2009 08:55:05 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.797 X-Spam-Level: X-Spam-Status: No, score=-2.797 tagged_above=-999 required=5 tests=[AWL=-0.267, BAYES_00=-2.599, DATE_IN_PAST_06_12=1.069, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C-XimlnxT0g9 for ; Sat, 25 Jul 2009 08:55:04 -0700 (PDT) Received: from out1.smtp.messagingengine.com (out1.smtp.messagingengine.com [66.111.4.25]) by core3.amsl.com (Postfix) with ESMTP id 74FB83A6403 for ; Sat, 25 Jul 2009 08:55:04 -0700 (PDT) Received: from compute2.internal (compute2.internal [10.202.2.42]) by out1.messagingengine.com (Postfix) with ESMTP id D710C3BC903; Sat, 25 Jul 2009 11:24:46 -0400 (EDT) Received: from heartbeat1.messagingengine.com ([10.202.2.160]) by compute2.internal (MEProxy); Sat, 25 Jul 2009 11:24:46 -0400 X-Sasl-enc: geMXyRlgugC3dgmwHMxVXExTl8Y3NNfHz+7D7KBnElsp 1248535484 Received: from host-78-64-88-206.homerun.telia.com (host-78-64-88-206.homerun.telia.com [78.64.88.206]) by mail.messagingengine.com (Postfix) with ESMTPSA id 029762927F; Sat, 25 Jul 2009 11:24:43 -0400 (EDT) Message-Id: From: Christian Vogt To: Guang Yao In-Reply-To: <001e01ca0bb3$2a600db0$7f202910$@tsinghua.edu.cn> Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v930.4) Date: Sat, 25 Jul 2009 00:25:46 -0700 References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <720C8A3E452D49CD8DA2221E6818EDD8@userPC> <4A688CF4.7080102@it.uc3m.es> <001e01ca0bb3$2a600db0$7f202910$@tsinghua.edu.cn> X-Mailer: Apple Mail (2.930.4) Cc: 'SAVI Mailing List' Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 25 Jul 2009 15:55:05 -0000 On Jul 23, 2009, Guang Yao wrote: > I want to summary my personal view on FCFS here... Guang - Thanks for the detailed analysis! Independent of whether one agrees with the conclusions you are making, it seems that the middle-ground approach sketched in [1] would satisfy your conclusions. Is this right? Recall the properties of the middle-ground approach: - binding creation exclusively based on DAD packets (for SLAAC) - protection of unused addresses in DHCP-only mode - no need for BDP Christian [1] http://www.ietf.org/mail-archive/web/savi/current/msg00715.html From root@core3.amsl.com Mon Jul 27 00:30:02 2009 Return-Path: X-Original-To: savi@ietf.org Delivered-To: savi@core3.amsl.com Received: by core3.amsl.com (Postfix, from userid 0) id 531143A6C02; Mon, 27 Jul 2009 00:30:02 -0700 (PDT) From: Internet-Drafts@ietf.org To: i-d-announce@ietf.org Content-Type: Multipart/Mixed; Boundary="NextPart" Mime-Version: 1.0 Message-Id: <20090727073002.531143A6C02@core3.amsl.com> Date: Mon, 27 Jul 2009 00:30:02 -0700 (PDT) Cc: savi@ietf.org Subject: [savi] I-D Action:draft-ietf-savi-threat-scope-01.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2009 07:30:02 -0000 --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Source Address Validation Improvements Working Group of the IETF. Title : SAVI Threat Scope Author(s) : D. McPherson, et al. Filename : draft-ietf-savi-threat-scope-01.txt Pages : 22 Date : 2009-07-27 This memo discusses threats enabled by IP source address spoofing and discusses a number of techniques aimed at mitigating those threats. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-savi-threat-scope-01.txt Internet-Drafts are also available by anonymous FTP at: ftp://ftp.ietf.org/internet-drafts/ Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Message/External-body; name="draft-ietf-savi-threat-scope-01.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2009-07-27002457.I-D@ietf.org> --NextPart-- From fred@cisco.com Mon Jul 27 02:31:42 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3610728C246 for ; Mon, 27 Jul 2009 02:31:42 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -110.016 X-Spam-Level: X-Spam-Status: No, score=-110.016 tagged_above=-999 required=5 tests=[AWL=0.583, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VDCL5hmVFYr8 for ; Mon, 27 Jul 2009 02:31:41 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id 0C81828C158 for ; Mon, 27 Jul 2009 02:31:40 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: Ak0AAHYQbUqQ/uCLe2dsb2JhbACBUZguAQEWJAadc4gojWcFhA0 X-IronPort-AV: E=Sophos;i="4.43,276,1246838400"; d="scan'208";a="45889412" Received: from ams-dkim-2.cisco.com ([144.254.224.139]) by ams-iport-1.cisco.com with ESMTP; 27 Jul 2009 09:31:41 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id n6R9Vfgs029888 for ; Mon, 27 Jul 2009 11:31:41 +0200 Received: from dhcp-56c8.meeting.ietf.org (dhcp-10-61-101-21.cisco.com [10.61.101.21]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6R9Vetl007703 for ; Mon, 27 Jul 2009 09:31:41 GMT Message-Id: <13B10312-E21D-4D74-8EC6-AEFE53F9F5EC@cisco.com> From: Fred Baker To: SAVI Mailing List Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 27 Jul 2009 11:31:40 +0200 References: <20090727072457.3693A28C11D@core3.amsl.com> X-Mailer: Apple Mail (2.935.3) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=789; t=1248687101; x=1249551101; c=relaxed/simple; s=amsdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=fred@cisco.com; z=From:=20Fred=20Baker=20 |Subject:=20Fwd=3A=20New=20Version=20Notification=20for=20d raft-ietf-savi-threat-scope-01=20 |Sender:=20; bh=z0U9GyLKV9t15AuPDlebbKgeNZw08fFQQOFt3MV4hdA=; b=Wj68zlijO9JdcmjikE2enmmeU85015CWQK9KUB45RFn3VZA2kKfC139Q6l N8Ss3xghNyrdY/494ga0ZzeUa+csKBqy3A9icUf8eE546lw6h/T8nOjYu9JK xLV/RXEDgz; Authentication-Results: ams-dkim-2; header.From=fred@cisco.com; dkim=pass ( sig from cisco.com/amsdkim2001 verified; ); Subject: [savi] Fwd: New Version Notification for draft-ietf-savi-threat-scope-01 X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2009 09:31:42 -0000 Begin forwarded message: > From: IETF I-D Submission Tool > Date: July 27, 2009 9:24:57 AM GMT+02:00 > To: fred@cisco.com > Cc: danny@arbor.net, jhalpern@redback.com > Subject: New Version Notification for draft-ietf-savi-threat-scope-01 > > > A new version of I-D, draft-ietf-savi-threat-scope-01.txt has been > successfuly submitted by Fred Baker and posted to the IETF repository. > > Filename: draft-ietf-savi-threat-scope > Revision: 01 > Title: SAVI Threat Scope > Creation_date: 2009-07-25 > WG ID: savi > Number_of_pages: 22 > > Abstract: > This memo discusses threats enabled by IP source address spoofing and > discusses a number of techniques aimed at mitigating those threats. > > > > The IETF Secretariat. > > From junbi@tsinghua.edu.cn Mon Jul 27 05:29:07 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 01C033A69FA for ; Mon, 27 Jul 2009 05:29:07 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.104 X-Spam-Level: X-Spam-Status: No, score=-1.104 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id QJ016C15tej0 for ; Mon, 27 Jul 2009 05:29:05 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.81]) by core3.amsl.com (Postfix) with ESMTP id D5E3B28C1B0 for ; Mon, 27 Jul 2009 05:28:56 -0700 (PDT) Received: from dhcp-176e.meeting.ietf.org ([130.129.23.110] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MVPJr-00075Q-Sg; Mon, 27 Jul 2009 20:28:45 +0800 Message-ID: <7D8423ECAF7C4CDD9D7B46E25A5F0127@userPC> From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC><4A687198.1010009@it.uc3m.es><001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn><720C8A3E452D49CD8DA2221E6818EDD8@userPC><4A688CF4.7080102@it.uc3m.es><001e01ca0bb3$2a600db0$7f202910$@tsinghua.edu.cn> <4A69EA9E.2080106@it.uc3m.es> In-Reply-To: <4A69EA9E.2080106@it.uc3m.es> Date: Mon, 27 Jul 2009 14:28:31 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: savi@ietf.org Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2009 12:29:07 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Guang Yao" Cc: "'SAVI Mailing List'" ; "'Christian Vogt'" Sent: Friday, July 24, 2009 7:08 PM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? Guang Yao escribió: > I want to summary my personal view on FCFS here: > [Guang Yao] 1 The first weakness point is logic error. > > As we know, FCFS currently uses the following logic: > > "Bind the address if it is first ever appear on the switch, and drop the > packet with address conflicting current bindings." > > And FCFS_with_BDP uses the following logic: > > "Bind the address if it is first ever appear on all the SAVI switches on > the > link, and drop the packet with address conflicting any the current binding > on all the SAVI switches." > > The problem is, whether it is reasonable and sufficient to set up bindings > when one address is first ever appear on one or any of the SAVI device? > > In a SLAAC only network, an implicit rule is that if a host uses an > address > first, it has the right to hold this address and ask others not to use the > address. In another word, a reasonable binding is set up based on the > clear > knowledge that the sender is the _first_ to use the address on the link. > > However, both FCFS and FCFS with BDP fail to be compatible with this rule, > though it is not obvious. FCFS actually takes "first appear on one of the > FCFS device" as "first used in the local link". Unfortunately, they are > not > equivalent. > > For example, host H may be the first to use an address ADDR, but without > sending any packet to pass any of the FCFS devices, the host should send a DAD when configuring the address in the interface, so the FCFS SAVI device will learn it from there The remaining case is when the DAD is lost. We talked many times on the DAD lost. 1) the possiblity of lost is really very low 2) One simple way to resolve it let the host to send redundent DAD by change the default value of DupAddrDetectTransmits to more than 2. Then the lost possiblity will even lower. If be a low cost way compared FCFS to bring more cost the data plan in the switch (heavy burden). thanks, Jun In that case what to do? FCFS learns from the data packet (instead of blocking the legitimate user out of the network) > thus no binding will be > set up for it. Then, another host has the chance to trigger a binding of > ADDR. This binding will cause dropping of legal packets from H. > > The wrong design principle of FCFS results in a lot of potential problems. > > 2 The failure model in DHCP only scenario > > Recently FCFS is declared to support DHCP, except for no protection for > unused address. > The first problem is that whether it is reasonable not to protect unused > addresses in DHCP only model. It is clear in a lot of DHCP only scenarios, > to allow other kinds of addresses will cause management problem. Another > problem is, since DHCP is the only used address assignment method, why not > choose a more stable and simple solution based on DHCPv6 snooping just as > DHCPv4 snooping, but choose an untested and potentially dangerous > solution? > What's the benefit? > > i certainly can see the benefits of having the dhcp server to act as an authorization server centrally allocating the addreses. So, i can see a benefit in spoofing dhcp traffic In addition, dhcp exchange is reliable, so it is more likely that the savi device can learn reliably from it My concerns with this is what happens if the savi device looses the state? As we discussed earlier, it is clear that in wireless networks, the node does not need to send any dhcp msg when the AP reboots. the situation in the wired network still needs to be clarified by the dhcp experts, hope it can be done in the next meeting An additional concern is about how to handle legacy switches, as we discussed extensively already. An additionla concern is how to authenticat the dhcp server (i.e. how to prevent an attacker to send false dhcp msg and make beleive the savi device it has the right to use a given address) An additional concern is how to deal with topology changes, where the ports where packets come from a soruce may change > And a more serious problem is FCFS model will give chance to attackers to > trigger evil bindings to filter legal traffic. Because DHCPv6 server would > be likely to assign to a host the same address (Also an attacker may has > the > chance to know the assigned address before the host if it is in the middle > of the victim and DHCPv6 server), an attacker has the chance to trigger > that > address binding first. When a host gets a REPLY from DHCPv6 server, it > performs DAD but the attacker doesn't reply. Then once the victim sends > packets, these packets will be discarded by FCFS. > I am not sure i understnad this situation Does the host has or not has the address allocated to it? If it does not has it, but it is expecting to have the same address, there is no problem if it gets a different address. If the host does has it assigned, the savi device would have the binding. > 3 About BDP > FCFS relies on a BDP to sync all the FCFS devices in order to make > it work "more correctly". (See section 1 to find why FCFS will never work > real correctly). BDP has been regarded as a bad idea by a lot of people. > Here just to list some of the defects of BDP. > 1. Violate charter. > 2. Heavy cost. > how come? current switches execute a number of protocols, hwo come this one would be a heavy cost and the other are not? > 3. Incrementally deployment problem. > not sure what do you mean by this > 4. Secure problem on authentication between SAVI devices. > i can't see how this is different from authenticating a dhcp server for instance or with configuring some ports to be the ones that are connecting the other SAVI devices as CPS does > 5. Real time problem. > 6. Reliable problem. > 7. Economic problem. > > i don't understnad what do you mean by none of these > Recently, there is a trend to use DAD as BDP. However, we don't think the > above problems are really solved if DAD is modified to have the function > of > BDP. > using DAD is another alternative, as you mention, and it has pros and cons that need to be analyzed > 4 The problem of clearing binding > FCFS doesn't have specified design of when and how to remove a > binding. This problem is same important as the problem of setting up > binding. No binding clear mechanism will surely make the binding table > full > and no new binding can be set up after a time. > > However, it is hard for FCFS to design a binding clearing mechanism. > We think this problem is due to FCFS sets up binding without regarding the > packet is from directly connected hosts or not directly connected hosts. > If > a not directly connected host is disconnected from a switch, the FCFS > switch > receives no signal and cannot drop the corresponding binding. > > so in cps, you assume that if the connection with the host is lost, then the binding is deleted? So you actually hardcode the rule that the host must perform DAD when the links flaps? what can i say, i don't think this is required by any rfc In FCFS, before dropping a entry, a series of NUDs is performed to make sure that the host is no longer connected, so the binding can be reliably discarded. > Though a BDP can make things better, the problem returns to the > problem of designing a _useable_ BDP. > > 5 Binding lost problem > FCFS has declared its robustness when binding lost. However, I don't > think it is reasonable. > Whenever a FCFS device reboot, an attacker can easily set up > bindings of all other addresses on the reboot device before any other > hosts. > this woudl require the attacker to be able to reboot the savi device to launch the attack or to limit the attacks to the moment when the savi device reboost, which hopefull is not very often > Then all other hosts will be blocked from network. > Please note that FCFS works by definition better than CPS in this case. In fcfs, if the nodes perform the DAD, then they are in like in CPS. If they don't they can still be in, when they send a data packet. In CPS they are simply out > Although FCFS can learn bindings from data traffic, the problem is, > it may not learn correct bindings. > > 6 Filtering cost > The filtering cost is rarely high for FCFS. > 6.1. It will take every data packet into CPU > wouldn't every solution require that? I mean, since the savi device is epxected to filter every data apcket, then every data apcket needs to be processed It's differnet. A switch could control the rate of control packet (because if the rate of control packets such as NDP is high, it means something wrong in the host, then the switch could limit the rate or close the port to stop attacking. But a swtich could NEVER control the normal data packet rate, it might be 100Mbps constant, and there is no reason to limit the normal traffic rate, then FCFS need to track every data packet to match with a long list (binding table) (the cost is high for a access switch). CPS just need to match the bit to see if it is a control packet. (the cost is low). So it is different. Best Regars, Jun Bi Regards, marcelo > 6.2 It must go through a long "deny" list to make sure whether a > packet should be forwarded. > > > IMO, I don't agree to move forward with FCFS. > > > _______________________________________________ savi mailing list savi@ietf.org https://www.ietf.org/mailman/listinfo/savi From junbi@tsinghua.edu.cn Mon Jul 27 05:38:09 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6D5C43A67FC for ; Mon, 27 Jul 2009 05:38:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.804 X-Spam-Level: X-Spam-Status: No, score=-0.804 tagged_above=-999 required=5 tests=[AWL=-0.300, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495, J_CHICKENPOX_44=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sJRn5-pIRjbT for ; Mon, 27 Jul 2009 05:38:08 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 8D2FA3A67D7 for ; Mon, 27 Jul 2009 05:38:08 -0700 (PDT) Received: from dhcp-176e.meeting.ietf.org ([130.129.23.110] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MVP95-0006En-Mx; Mon, 27 Jul 2009 20:17:36 +0800 Message-ID: From: "Jun Bi" To: "marcelo bagnulo braun" References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com><4A68367B.4000109@it.uc3m.es><44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <4A68784B.3090508@it.uc3m.es> <4A6888F3.5080809@it.uc3m.es> <4A688DDF.6080105@it.uc3m.es> In-Reply-To: <4A688DDF.6080105@it.uc3m.es> Date: Mon, 27 Jul 2009 14:17:23 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2009 12:38:09 -0000 ----- Original Message ----- From: "marcelo bagnulo braun" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" ; "Guang Yao" Sent: Thursday, July 23, 2009 6:20 PM Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? > Jun Bi escribió: >>>> >>> well, you could achieve better security if you used another approach >> >> >> >> Please let us know the approach with better security. >> In my option, FCFS will lower the security. >> In CPS, the host under SAVI-swtich can't spoof. it's >> reasonable, predictable, and dependable. >> In FCFS,even the host user SAVI-switch can STILL spoof, it's >> NOT predictable, and dependable. Will you call FCFS brings better >> security? >> > how is that? > ... >>> >>>> >>> as i mentioned before, you can call it a deployment suggestion but what >>> it really is is a mean to have all the devices in the subnetwork to be >>> SAVI devices, which is the way to comply with the limitation imposed by >>> the CPS savi >> >> It's very easy and CLEAR for a operator to divide SAVI area >> and non-SAVI area. >> > sure we can require the IP subnetwork to only have SAVI devices, but this > is certainly a limitation You may call it has "limitation" (everything in the world has limitation), but it also means you agree it works. A solution which is working and with low cost brought to switch is doable. The vendors already showed their support. thanks, Jun From elevyabe@cisco.com Mon Jul 27 06:55:31 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 62C463A6C43 for ; Mon, 27 Jul 2009 06:55:31 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.266 X-Spam-Level: X-Spam-Status: No, score=-9.266 tagged_above=-999 required=5 tests=[AWL=1.333, BAYES_00=-2.599, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id G9CY5wCzcicZ for ; Mon, 27 Jul 2009 06:55:30 -0700 (PDT) Received: from ams-iport-1.cisco.com (ams-iport-1.cisco.com [144.254.224.140]) by core3.amsl.com (Postfix) with ESMTP id C9C9C3A6C2D for ; Mon, 27 Jul 2009 06:55:29 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: AkkAAJNObUqQ/uCLe2dsb2JhbACaAAEBFiQGn2qIKI1+BYIpgWSBTQ X-IronPort-AV: E=Sophos;i="4.43,276,1246838400"; d="scan'208";a="45914681" Received: from ams-dkim-2.cisco.com ([144.254.224.139]) by ams-iport-1.cisco.com with ESMTP; 27 Jul 2009 13:55:29 +0000 Received: from ams-core-1.cisco.com (ams-core-1.cisco.com [144.254.224.150]) by ams-dkim-2.cisco.com (8.12.11/8.12.11) with ESMTP id n6RDtTIk001578; Mon, 27 Jul 2009 15:55:29 +0200 Received: from xbh-ams-102.cisco.com (xbh-ams-102.cisco.com [144.254.73.132]) by ams-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6RDtTfA021441; Mon, 27 Jul 2009 13:55:29 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-102.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Mon, 27 Jul 2009 15:55:30 +0200 Received: from [10.61.103.226] ([10.61.103.226]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Mon, 27 Jul 2009 15:55:29 +0200 Message-ID: <4A6DB1CD.2090001@cisco.com> Date: Mon, 27 Jul 2009 15:55:25 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: marcelo bagnulo braun References: <2AE43E7B-7B84-4751-8871-B8A949F52666@ericsson.com><001201c9e1c6$399cc780$acd65680$@tsinghua.edu.cn><4A225E1C.1080300@it.uc3m.es><3C7216EA-FE6C-4151-8468-B9F7FFF87D06@ericsson.com> <4A68367B.4000109@it.uc3m.es> <44CD17705F1A4E649C0EEE4EBC3A6EDD@userPC> <4A687198.1010009@it.uc3m.es> <001101ca0ba7$34cd6380$9e682a80$@tsinghua.edu.cn> <720C8A3E452D49CD8DA2221E6818EDD8@userPC> <4A688CF4.7080102@it.uc3m.es> In-Reply-To: <4A688CF4.7080102@it.uc3m.es> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 27 Jul 2009 13:55:29.0307 (UTC) FILETIME=[E68EB6B0:01CA0EC1] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=4204; t=1248702929; x=1249566929; c=relaxed/simple; s=amsdkim2001; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20SAVI=20Bindings=20For=20Hosts= 20Behind=20Legacy=20Switches? |Sender:=20; bh=/bN/gPd6e4px2nm/Z6wp832f2Rj+zxe/TSFOFlbPBxY=; b=R7dwK2ClXgwidFszxzYGT2YEFkyR0J+yY3NEHEAR3NLrubae92/BakEGj5 NOzFKgp1teZ9pTNBB8/tOvlqZAbpf4ZniBmGn4jgrKenFO+tGnJWx2ZafN5E L3wMQD7OSo; Authentication-Results: ams-dkim-2; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/amsdkim2001 verified; ); Cc: 'SAVI Mailing List' , 'Christian Vogt' , Guang Yao Subject: Re: [savi] SAVI Bindings For Hosts Behind Legacy Switches? X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2009 13:55:31 -0000 Marcelo, Jun, lenghty discussion .. I had to pick one mail to give my position. So be this one ... marcelo bagnulo braun a écrit : > Jun Bi escribió: >> >> Hi Marcelo, >> >> By reading all you emails, I think you also recognize the benifit of >> CPS. >> Yes, you may ask more benifit, but please trade off the cost and the >> benifit. >> CPS is really a low cost solution and be implemented in switch and >> tested. To recognize the benifit, >> the WG at least could made some progress (having a solution works in >> some situation). >> It doesn't mean CPS prevent other new technology. You could continute >> you work, but at >> least now we did see FCFS has much more problems. > I simply fail to see how you conclude that. > > Let's consider CPS for SLAAC > > The main problem with CPS is that it hard-codes underlying assumption > in the network architecture. What do i mean by this? Well, basically, > CPS assumes that in order to allow a host to send packets, it must > have been a prior DAD. While this is common, it is not required by the > current IPv6 architecture. But CPs hardcodes it in SAVI. The result is > that the fate sharing domain of the node is significantly increased. > If the SAVI device looses state, then the host is blocked. If the DAD > packet is lost, the host is blocked. The result is a significantly > less robust network architecture. > > I simply believe that is not a good tradeoff. > > then we can go to more practical issues. > > The CPS solution requires manual configuration of the ports (whehter > they are connected to a SAVI device, a host or a legacy switch) > IIt doesn't protect from attackers connected to a legacy device from > spoofing any address in the subnetwork, even if the target host is > connected to a SAVI device. this means that either all the devices of > the network are SAVI devices or that significant attacks are possible. > > So, no, i don't agree to move forward with CPS. > I think CPS has good potential. As opposed to FCFS. Being able to work at the control protocol level is absolutely key on switches which sometimes have tens of thousands of Gigabit ports. Creating binding entries off data traffic on these devices, as well as logging anomalies , is going to do more harm than good, and opens avenues for DoS attacks. We got to find a way to build a solid binding table out of the control traffic (DHCP, NDP, ...).Would be a lot easier if we had a declarative protocol (such as RFC3122) , but unfortunately it's not widely implemented. The DHCP case is quite easy, and well covered in the CPS draft. The SLACC case needs imrpovements and I think it's exactly what my draft is about (draft-levy-abegnoli-savi-plbt-00 ). Basically, the issue that Marcelo raised can be solved: - to deal with missing DAD packets, snoop other NDP packets. A node doing SLACC is going to send 1) DAD 2) unsolicited NA 3) NS prior to talk to anybody. None of these messages is required, but the odds of getting none of them are extremely low. - As far as dealing with attackers connected to legacy switches, use the preference algorithm that I proposed. A binding coming from an attached host or received via a savi-device should be preferred over one coming from a non-savi device. Eric > Regards, marcelo > > >> >> Thanks, >> Jun >> >> >> >> >> >>> If you think that is not enough, >>> OK, please design a SAVI solution that can protect _all_ the IP >>> address in >>> the >>> IP subnetwork with only _partly_ deployment and _without_ modify >>> current >>> protocols. >>> I think you may find it is impossible. >>>> >>>> This must be explicitly mentioned since imho it is a severe deployment >>>> limitation. >>>> In other words, if we want to deploy CPS in a subntework, then all the >>>> devices MUST be SAVI devices. >>>> >>>> Regards, marcelo >>> >>> [Guang Yao] >>> >>> >>> >> >> >> > > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From pnallur@huawei.com Mon Jul 20 14:25:18 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0632F3A6A20 for ; Mon, 20 Jul 2009 14:25:18 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oGRkk+fBFeNF for ; Mon, 20 Jul 2009 14:25:11 -0700 (PDT) Received: from usaga04-in.huawei.com (usaga04-in.huawei.com [206.16.17.180]) by core3.amsl.com (Postfix) with ESMTP id E71D23A67E2 for ; Mon, 20 Jul 2009 14:25:10 -0700 (PDT) Received: from huawei.com (usaga04-in [172.18.4.101]) by usaga04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KN300587MDK39@usaga04-in.huawei.com> for savi@ietf.org; Mon, 20 Jul 2009 16:00:56 -0500 (CDT) Received: from PadNallurSC ([10.193.217.189]) by usaga04-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTPA id <0KN30034HMDG2B@usaga04-in.huawei.com> for savi@ietf.org; Mon, 20 Jul 2009 16:00:56 -0500 (CDT) Date: Mon, 20 Jul 2009 14:00:50 -0700 From: Padmanabha Nallur In-reply-to: <86BC9051818A451D9387B294D512D11B@bombo> To: =?gb2312?B?J0FsYmVydG8gR2FyY6iqYSc=?= Message-id: <000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Mailer: Microsoft Office Outlook 11 Content-type: text/plain; charset=gb2312 Content-transfer-encoding: quoted-printable Thread-index: AcoI44hA98flWtdsRCC5hU95ZpxRdAAQCr0gABXGNyA= References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> <200907201040329011805@huaweisymantec.com> <86BC9051818A451D9387B294D512D11B@bombo> X-Mailman-Approved-At: Mon, 27 Jul 2009 15:36:16 -0700 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Jul 2009 21:25:18 -0000 Hi Alberto, The main point of the CGA proposal is to avoid IP spoofing. In order to avoid IP spoofing the source IP address checks must be = performed closer to the destination or destination network as opposed to = implementing these checks in the source network (e.g., SAVI). The CGA proposal provides an alternative solution to prevent IP spoofing = by providing the checks that can be implemented in the destination endpoint = or destination network (actually anywhere in the network). We would like to have as simple solution as possible and preferably even stateless = solution. This is the main goal of CGA proposal and it would be great if it can = ALSO be used in other situations (e.g., SAVI) as you mentioned below. Validation of the IP address itself (like prefix check) is not the main = goal of the CGA proposal. Thanks Paddy Nallur -----Original Message----- From: Alberto Garc=A8=AAa [mailto:alberto@it.uc3m.es]=20 Sent: Monday, July 20, 2009 3:29 AM To: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' Cc: 'Padmanabha Nallur 73868' Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt Hi | -----Mensaje original----- | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre de Dong | Zhang | Enviado el: lunes, 20 de julio de 2009 4:41 | Para: Alberto_Garc=A8=AAa; 'Christian Vogt'; 'SAVI Mailing List' | CC: 'Padmanabha Nallur 73868' | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi Alberto, | Please check inline. | =20 | Thank you. | =20 | Alberto_Garc=A8=AAa 2009-07-17 Wrote: | >Hi | > | >| -----Mensaje original----- | >| De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre de | Dong | >| Zhang | >| Enviado el: viernes, 17 de julio de 2009 8:50 | >| Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | >| CC: 'Padmanabha Nallur 73868' | >| Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | >| | >| Alberto_Garc=EDa 2009-07-16 Wrote: | >| >| I do not think it is a conflict. The difference is just how = to | >| >| use CGA. For instance, the CGA proposal can be used in e2e, = even | between | >| >the | >| >| host | >| >| and the first-hop router. It can depend on the destination = option header. | >| > | >| >Shim6 allows transporting CGA information end-to-end. It does = that now, in | a | >| >standard way. Why you should want to generate a = yet-another-protocol to | >| >transport CGA information end-to-end? | >| Thank you for the information. | >| We will read Shim6. If it really does the relative job, we will = be glad to use it. | >| > | >| >Besides, what does such a protocol would have to do with SAVI? | >| >If you want to use CGAs for providing security in the link of = the host and | >| >the first-hop router, you should probably use the SEND protocol = (see | >| >draft-ietf-savi-send-00). Do you think there is something in the SEND | >| >protocol that does not suit with binding IPv6 addresses and link layer | >| >anchors, that could be improved? | >| >And if you want to use the CGA for address validation further = than the first | >| >hop routers, I see some reasons why you should not: at that = point you | need | >| >to validate prefixes, not host addresses, and CGA provides no protection for | >| >prefixes: any host can generate a valid CGA with whichever = prefix it wanted. | >| >So just validating a CGA does not assure that the host is = authorized to use | >| >that prefix. | >| In the CGA-related information, it contains the signature. We = think it can | >| protect the prefix. Right? | > | >Well, it does not prove that a host has been legitimately assigned a prefix. | >CGAs, with a protocol transporting signatures made with the private = key, only | assure that once a host generates a given address, it is very very difficult for | another host to use the same address. And yes, the protection = includes the | prefix: it is just not enough to find a key pair whose hash generates = a given | interface identifier, and then you can impersonate any host with the = same | interface identifier in any network (i.e. with any prefix). | [Dong] Well, yes, we agree with this. CGA does not do identity authentication. | We only validate the address so that someone else cannot use this IP address. | We do not check for the IP address binding with a host or a user or = some other | higher level entity and validate that. | =20 | Just the fact that someone else cannot use the same address would = give the | benefits mentioned in the use cases within the draft. I think the place to do this is in the first link. And the tool SEND + = SAVI. Outside the first link, I think it is too costly to do checks in a per-address basis, and you need other tools (manual configuration, = routing info...) for validating prefixes... so just validate prefixes with this tools. | =20 | IMHO, we don't think even SAVI solutions need to validate the binding = of IP | address with users etc., only check if a certain IP address is used = on a specific | link. Yes, of course. I was not talking at any point in "users".=20 Again, to check the address, use SEND. | > | >But that says nothing about the legitimacy of ah host to use that prefix. | >For example, give the prefix of your network, and I can generate immediately | an CGA that claims to belong to your prefix: CGA =3D hash ( prefix | = public key | | etc). And I can use from my network, if the router (and some routers above) | does not check source prefixes. Looking only at the CGA nobody can = know if my | host is authorized to use a prefix or not. | >So, CGA does not add anything to prefix protection. You have to = provide other | means to protect that. | I guess the ingress filtering could do this. And savi solutions are = the complement | for ingress filtering. This point has been discussed before. | > | > | >| > | >| >| > | >| >| >What does this type of solutions has to do with SAVI, considering that | >| >the | >| >| >charter says: "No changes to hosts are allowed."? Isn't your solution | >| >| >proposing a change to hosts? | >| >| Yes, the CGA proposal does not fit for the current charter = quit well to | >| >some | >| >| extend. | >| >| The reason why we put the CGA-related info in the extension header is | >| >that it | >| >| has | >| >| the ability to provide a basic security for the source = address like AH & | >| >ESP. The | >| > | >| >The CGA security model does not have much relationship with AH & ESP. | Well, | >| >all use keys, but besides that... | >| I mean if we could take the CGA-related information in the = extension header, | >| the packet will have AH, ESP and CGA for the basic security characteristics, | >| including integrity, confidentiality, and authentication. | > | >This is completely different stuff. It seems like generating an opportunistic IKE | security context (a la SSL) for a communication, starting with the public/private | key pair associated to the CGAs of two hosts. Then you should look at | http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt | I am a little confused here. I have already known this draft before. = Are you | comparing it with my another draft, http://tools.ietf.org/id/draft-zhang-shen-sa- | cga-00.txt ? I was not aware of your draft. I wasn't comparing anything, but, from = the title of your draft, yes it seems similar. Regards, Alberto | =20 | =20 | ------------------ | Dong Zhang | 2009-07-20 From pnallur@huawei.com Thu Jul 23 13:57:27 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E31623A6B32 for ; Thu, 23 Jul 2009 13:57:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.299 X-Spam-Level: X-Spam-Status: No, score=-2.299 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, MIME_8BIT_HEADER=0.3] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id trmchrnO6KL1 for ; Thu, 23 Jul 2009 13:57:26 -0700 (PDT) Received: from usaga02-in.huawei.com (usaga02-in.huawei.com [206.16.17.70]) by core3.amsl.com (Postfix) with ESMTP id 99DD828C108 for ; Thu, 23 Jul 2009 13:57:26 -0700 (PDT) Received: from huawei.com (localhost [127.0.0.1]) by usaga02-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTP id <0KN90029I65G2Y@usaga02-in.huawei.com> for savi@ietf.org; Thu, 23 Jul 2009 13:56:05 -0700 (PDT) Received: from PadNallurSC ([10.193.217.189]) by usaga02-in.huawei.com (iPlanet Messaging Server 5.2 HotFix 2.14 (built Aug 8 2006)) with ESMTPA id <0KN9004QJ65EYG@usaga02-in.huawei.com> for savi@ietf.org; Thu, 23 Jul 2009 13:56:04 -0700 (PDT) Date: Thu, 23 Jul 2009 13:55:58 -0700 From: Padmanabha Nallur In-reply-to: To: =?gb2312?B?J0FsYmVydG8gR2FyY6iqYSc=?= Message-id: <008201ca0bd7$fb53d590$bdd9c10a@china.huawei.com> MIME-version: 1.0 X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2900.3350 X-Mailer: Microsoft Office Outlook 11 Content-type: text/plain; charset=gb2312 Content-transfer-encoding: quoted-printable Thread-index: AcoI44hA98flWtdsRCC5hU95ZpxRdAAQCr0gABXGNyAAVj56gABAzbPA References: <4CB1C400-9A7F-435D-9B7A-B6B1B259E997@ericsson.com> <200907151050081554172@huaweisymantec.com> <75998D9056424F94A34294F878EF8958@bombo> <200907161018350396693@huaweisymantec.com> <16C7F3CCDE434470AF2D409B79B70A8E@bombo> <200907171450265993512@huaweisymantec.com> <4EB312B4DC044B6DB99E8E16EFEA72D7@bombo> <200907201040329011805@huaweisymantec.com> <86BC9051818A451D9387B294D512D11B@bombo> <000001ca097d$2ae827a0$bdd9c10a@china.huawei.com> X-Mailman-Approved-At: Mon, 27 Jul 2009 15:36:16 -0700 Cc: 'SAVI Mailing List' , 'Christian Vogt' Subject: Re: [savi] About draft-dong-savi-cga-header-02.txt X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 23 Jul 2009 20:57:28 -0000 Hi, Please see inline with [Paddy2]. Thanks Paddy Nallur -----Original Message----- From: Alberto Garc=A8=AAa [mailto:alberto@it.uc3m.es]=20 Sent: Wednesday, July 22, 2009 7:16 AM To: 'Padmanabha Nallur' Cc: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt Hi, | -----Mensaje original----- | De: Padmanabha Nallur [mailto:pnallur@huawei.com] | Enviado el: lunes, 20 de julio de 2009 23:01 | Para: 'Alberto Garc=A8=AAa' | CC: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | Asunto: RE: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi Alberto, | =20 | The main point of the CGA proposal is to avoid IP spoofing. | In order to avoid IP spoofing the source IP address checks must be performed | closer to the destination or destination network as opposed to implementing | these checks in the source network (e.g., SAVI). | =20 | The CGA proposal provides an alternative solution to prevent IP = spoofing by | providing the checks that can be implemented in the destination = endpoint or | destination network (actually anywhere in the network). We would like = to | have as simple solution as possible and preferably even stateless solution. In my opinion, what you are proposing is dangerous. Let's consider flood-based DoS (draft-ietf-savi-threat-scope-00.txt): an attacker wants = to exhaust the victim's resources by sending traffic to it. With your mechanism, packets with false CGA information do not only consume TCP = state, memory for IP fragmentation... but they also force the host to spend a = lot of CPU in using public cryptography to check a CGA! This is what any attacker would like: force hosts to do a lot of work for fake packets! [Paddy2] Yes, we are well aware of these problems having worked in this = area for several years. We are also looking at further simplifications like making it stateless, performing the public/private key cryptography only = for the first packet etc., We would be very glad to receive any suggestions = in this direction. This is why in Shim6 and HIP a 4-way handshake is performed: the = initiator must prove at least that the address is using is topologically valid = (for accounting purposes).=20 [Paddy2] I took a quick look at Shim6 and it seems like it is meant to = solve a different problem than the one we are trying to. It looks incredibly complex for CGA proposal. Do you know, how much acceptance is there for = the Shim6 in the industry ? Any pointers would help us. In addition, you propose not only perform this DoS-prone check not only = in the host, but anywhere in the network. So any router should divert a = packet from the silicon fast path to the router CPU to check the CGA... That = would be double prize for the attacker: not only compromising a host, but the whole communication pipe of a site. [Paddy2] We are not saying that this should be performed all over the network. It CAN be done in selective locations without compromising the device performance. =20 I really don't see this. Regards, Alberto | This is the main goal of CGA proposal and it would be great if it can ALSO | be used in other situations (e.g., SAVI) as you mentioned below. | =20 | Validation of the IP address itself (like prefix check) is not the = main goal | of the CGA proposal. | =20 | =20 | Thanks | Paddy Nallur | =20 | -----Original Message----- | From: Alberto Garc=A8=AAa [mailto:alberto@it.uc3m.es] | Sent: Monday, July 20, 2009 3:29 AM | To: 'Dong Zhang'; 'Christian Vogt'; 'SAVI Mailing List' | Cc: 'Padmanabha Nallur 73868' | Subject: RE: [savi] About draft-dong-savi-cga-header-02.txt | =20 | Hi | =20 | | -----Mensaje original----- | | De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En nombre = de | Dong | | Zhang | | Enviado el: lunes, 20 de julio de 2009 4:41 | | Para: Alberto_Garc=A8=AAa; 'Christian Vogt'; 'SAVI Mailing List' | | CC: 'Padmanabha Nallur 73868' | | Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | | | | Hi Alberto, | | Please check inline. | | | | Thank you. | | | | Alberto_Garc=A8=AAa 2009-07-17 Wrote: | | >Hi | | > | | >| -----Mensaje original----- | | >| De: savi-bounces@ietf.org [mailto:savi-bounces@ietf.org] En = nombre de | | Dong | | >| Zhang | | >| Enviado el: viernes, 17 de julio de 2009 8:50 | | >| Para: Alberto_Garc?; 'Christian Vogt'; 'SAVI Mailing List' | | >| CC: 'Padmanabha Nallur 73868' | | >| Asunto: Re: [savi] About draft-dong-savi-cga-header-02.txt | | >| | | >| Alberto_Garc=EDa 2009-07-16 Wrote: | | >| >| I do not think it is a conflict. The difference is just = how to | | >| >| use CGA. For instance, the CGA proposal can be used in = e2e, even | | between | | >| >the | | >| >| host | | >| >| and the first-hop router. It can depend on the destination option | header. | | >| > | | >| >Shim6 allows transporting CGA information end-to-end. It does that | now, in | | a | | >| >standard way. Why you should want to generate a yet-another-protocol | to | | >| >transport CGA information end-to-end? | | >| Thank you for the information. | | >| We will read Shim6. If it really does the relative job, we = will be | glad to use it. | | >| > | | >| >Besides, what does such a protocol would have to do with = SAVI? | | >| >If you want to use CGAs for providing security in the link of = the | host and | | >| >the first-hop router, you should probably use the SEND = protocol (see | | >| >draft-ietf-savi-send-00). Do you think there is something in = the | SEND | | >| >protocol that does not suit with binding IPv6 addresses and = link | layer | | >| >anchors, that could be improved? | | >| >And if you want to use the CGA for address validation further than | the first | | >| >hop routers, I see some reasons why you should not: at that point | you | | need | | >| >to validate prefixes, not host addresses, and CGA provides no | protection for | | >| >prefixes: any host can generate a valid CGA with whichever = prefix it | wanted. | | >| >So just validating a CGA does not assure that the host is authorized | to use | | >| >that prefix. | | >| In the CGA-related information, it contains the signature. We think | it can | | >| protect the prefix. Right? | | > | | >Well, it does not prove that a host has been legitimately = assigned a | prefix. | | >CGAs, with a protocol transporting signatures made with the = private key, | only | | assure that once a host generates a given address, it is very very | difficult for | | another host to use the same address. And yes, the protection = includes | the | | prefix: it is just not enough to find a key pair whose hash = generates a | given | | interface identifier, and then you can impersonate any host with = the same | | interface identifier in any network (i.e. with any prefix). | | [Dong] Well, yes, we agree with this. CGA does not do identity | authentication. | | We only validate the address so that someone else cannot use this = IP | address. | | We do not check for the IP address binding with a host or a user = or some | other | | higher level entity and validate that. | | | | Just the fact that someone else cannot use the same address would = give | the | | benefits mentioned in the use cases within the draft. | =20 | I think the place to do this is in the first link. And the tool SEND = + SAVI. | Outside the first link, I think it is too costly to do checks in a | per-address basis, and you need other tools (manual configuration, routing | info...) for validating prefixes... so just validate prefixes with = this | tools. | =20 | | | | IMHO, we don't think even SAVI solutions need to validate the = binding of | IP | | address with users etc., only check if a certain IP address is = used on a | specific | | link. | =20 | Yes, of course. I was not talking at any point in "users". | Again, to check the address, use SEND. | =20 | | > | | >But that says nothing about the legitimacy of ah host to use that | prefix. | | >For example, give the prefix of your network, and I can generate | immediately | | an CGA that claims to belong to your prefix: CGA =3D hash ( prefix = | public | key | | | etc). And I can use from my network, if the router (and some = routers | above) | | does not check source prefixes. Looking only at the CGA nobody can know | if my | | host is authorized to use a prefix or not. | | >So, CGA does not add anything to prefix protection. You have to provide | other | | means to protect that. | | I guess the ingress filtering could do this. And savi solutions = are the | complement | | for ingress filtering. This point has been discussed before. | | > | | > | | >| > | | >| >| > | | >| >| >What does this type of solutions has to do with SAVI, | considering that | | >| >the | | >| >| >charter says: "No changes to hosts are allowed."? Isn't = your | solution | | >| >| >proposing a change to hosts? | | >| >| Yes, the CGA proposal does not fit for the current charter quit | well to | | >| >some | | >| >| extend. | | >| >| The reason why we put the CGA-related info in the = extension | header is | | >| >that it | | >| >| has | | >| >| the ability to provide a basic security for the source = address | like AH & | | >| >ESP. The | | >| > | | >| >The CGA security model does not have much relationship with = AH & | ESP. | | Well, | | >| >all use keys, but besides that... | | >| I mean if we could take the CGA-related information in the extension | header, | | >| the packet will have AH, ESP and CGA for the basic security | characteristics, | | >| including integrity, confidentiality, and authentication. | | > | | >This is completely different stuff. It seems like generating an | opportunistic IKE | | security context (a la SSL) for a communication, starting with the | public/private | | key pair associated to the CGAs of two hosts. Then you should look = at | | http://tools.ietf.org/id/draft-laganier-ike-ipv6-cga-02.txt | | I am a little confused here. I have already known this draft = before. Are | you | | comparing it with my another draft, | http://tools.ietf.org/id/draft-zhang-shen-sa- | | cga-00.txt ? | =20 | I was not aware of your draft. I wasn't comparing anything, but, from = the | title of your draft, yes it seems similar. | =20 | Regards, | Alberto | =20 | | | | | | ------------------ | | Dong Zhang | | 2009-07-20 From christian.vogt@ericsson.com Mon Jul 27 14:39:50 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 7F6DB3A6B29 for ; Mon, 27 Jul 2009 14:39:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AK0XRRGCPs0Q for ; Mon, 27 Jul 2009 14:39:49 -0700 (PDT) Received: from imr2.ericy.com (imr2.ericy.com [198.24.6.3]) by core3.amsl.com (Postfix) with ESMTP id A27123A6A9F for ; Mon, 27 Jul 2009 14:39:49 -0700 (PDT) Received: from eusrcmw751.eamcs.ericsson.se (eusrcmw751.exu.ericsson.se [138.85.77.51]) by imr2.ericy.com (8.13.1/8.13.1) with ESMTP id n6RLdReO017713; Mon, 27 Jul 2009 16:39:27 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.56]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Mon, 27 Jul 2009 16:39:21 -0500 Received: from [10.16.1.9] ([164.48.124.45]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Mon, 27 Jul 2009 16:39:17 -0500 Message-Id: <138EB57B-9003-448F-A60A-C7837E8BE7BC@ericsson.com> From: Christian Vogt To: SAVI Mailing List Content-Type: text/plain; charset=US-ASCII; format=flowed Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Mon, 27 Jul 2009 23:38:51 +0200 X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 27 Jul 2009 21:39:17.0759 (UTC) FILETIME=[B19B80F0:01CA0F02] X-Mailman-Approved-At: Mon, 27 Jul 2009 15:36:16 -0700 Cc: Guang Yao , Alan Kavanagh , Hongyu Li , Bill Fenner , Frank Xia Subject: [savi] SAVI Meeting Agenda for IETF 75 X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 27 Jul 2009 21:39:50 -0000 Folks - Below please find the agenda for our meeting on Thursday. This time, we are unlikely to have time for presentations that go beyond our immediate work items. I kindly ask for the understanding of those of you who are affected by this -- I know about the effort you have spent. Although all agenda slot requests show up on the agenda below, partly under the lighting talk section, please be prepared that we may have to skip the lighting talk section. A demo of CPS will follow the meeting. To give people time to attend this demo, the meeting will close slightly earlier than the official morning session. - Christian ----------------------------------------------------------- Agenda of the SAVI working group meeting at IETF 75 Thursday, July 30, 9:00 am - 11:30 am, Cabaret room ----------------------------------------------------------- Introduction and agenda bashing 9:00 Christian Vogt Protecting unassigned IP addresses -- 9:10 Discussion summary and analysis Christian Vogt Discussion 9:30 All Increasing binding table accuracy 10:30 Eric Levy-Abegnoli SAVI in broadband access networks 10:50 Alan Kavanagh Lightening talks on potential future work, if time permits: CGA Extension Header of IPv6 5 min Dong Zhang (draft-dong-savi-cga-header) SAVI for Delegated IPv6 Prefixes 5 min Frank Xia (draft-kaippallimalil-savi-dhcp-pd) Source Address Validation via Shared Key 5 min Hongyu Li (lihy@huawei.com) end at 11:15 After working group meeting: Control Plane Snooping prototype demonstration 11:15 Jianping Wu, Jun Bi, Guang Wao (draft-bi-savi-cps) From erik.nordmark@sun.com Tue Jul 28 01:57:54 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 4655F3A6D82 for ; Tue, 28 Jul 2009 01:57:54 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.829 X-Spam-Level: X-Spam-Status: No, score=-5.829 tagged_above=-999 required=5 tests=[AWL=0.217, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SDMIHd-vA4xi for ; Tue, 28 Jul 2009 01:57:53 -0700 (PDT) Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by core3.amsl.com (Postfix) with ESMTP id 2E19E3A6DF1 for ; Tue, 28 Jul 2009 01:57:52 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6S8voqU016358; Tue, 28 Jul 2009 08:57:50 GMT Received: from [10.7.251.248] (punchin-nordmark.SFBay.Sun.COM [10.7.251.248]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6S8vm03736135 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jul 2009 01:57:49 -0700 (PDT) Message-ID: <4A6EBD8B.8000607@sun.com> Date: Tue, 28 Jul 2009 01:57:47 -0700 From: Erik Nordmark User-Agent: Thunderbird 2.0.0.21 (X11/20090323) MIME-Version: 1.0 To: Christian Vogt References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> In-Reply-To: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 08:57:54 -0000 Christian Vogt wrote: > Folks - > > As announced earlier, we will have a consensus call on how SAVI devices > should treat source addresses for which no configuration signaling was > seen. Consensus questions for this were proposed on July 8, and the > feedback received from the working group indicates that those are OK. > > I would hence like to initiate the consensus call. To participate in > the consensus call, please answer by Sunday, July 19, the following two > questions (A) and (B), using one of the two possible answers provided > for each question: > > (A) In networks where SLAAC is permitted for address configuration, how > should a SAVI device treat packets with a source address for which > neither a successful DAD procedure nor a DHCP assignment was seen? > > (A1) Discard the packet > (A2) Forward and optionally log the packet I think the question was malformed for the following reasons. *IF* SLAAC is permitted, then by definition the host can pick whatever address it wants. DAD as defined is not a reliable protocol, thus pretending it is the way a host *registers* a SLAAC address makes no sense. For instance, if 802.1D bridges wait for 30 seconds before enabling a Ethernet port, then no DAD packet would be seen on the network. Thus I think the case when the the admin wants to only allow registered addresses then SLAAC can not be used; DHCPv6 would need to be used as the assignment/registration protocol. Erik From erik.nordmark@sun.com Tue Jul 28 01:58:02 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 135D73A6D82 for ; Tue, 28 Jul 2009 01:58:02 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.86 X-Spam-Level: X-Spam-Status: No, score=-5.86 tagged_above=-999 required=5 tests=[AWL=0.186, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ZEmPqQkqKB9B for ; Tue, 28 Jul 2009 01:58:01 -0700 (PDT) Received: from sca-ea-mail-3.sun.com (sca-ea-mail-3.Sun.COM [192.18.43.21]) by core3.amsl.com (Postfix) with ESMTP id 4D57F3A6DE9 for ; Tue, 28 Jul 2009 01:58:01 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by sca-ea-mail-3.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6S8w096007191; Tue, 28 Jul 2009 08:58:00 GMT Received: from [10.7.251.248] (punchin-nordmark.SFBay.Sun.COM [10.7.251.248]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6S8vv3f736152 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jul 2009 01:57:58 -0700 (PDT) Message-ID: <4A6EBD95.1030903@sun.com> Date: Tue, 28 Jul 2009 01:57:57 -0700 From: Erik Nordmark User-Agent: Thunderbird 2.0.0.21 (X11/20090323) MIME-Version: 1.0 To: Greg Daley References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com> <4A681808.1070602@it.uc3m.es> <6983BF97BFC24D4EA551F1407123291801193C1B@melmail.netstarnetworks.com> In-Reply-To: <6983BF97BFC24D4EA551F1407123291801193C1B@melmail.netstarnetworks.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 08:58:02 -0000 Greg Daley wrote: > On a link where all addresses are managed by DHCP (RFC4862 M=1), it has complete ownership of the > address. There is no explicit need to ask the DHCP server for an address in RFC3315. It may try to > check that the service is there with DHCPv6 SOLICIT or CONFIRM (which by default doesn't bind an address) > > In section 18.1.2, a host which believes it may have moved to a new link MUST CONFIRM. > This doesn't mean that a lease is being allocated though. What happens when a host can't tell that it has moved to a new link? I think in practice there are issues where the host can't tell or can't easily tell that it might be connected to a different l2 device. To make the SAVI protocol robust I think we shouldn't rely on the "MUST CONFIRM". > The Simple DNAv6 procedures cover this in more detail though, and specify that the > host should check if the DHCP server is actually there, even if the Router says no movement has occurred. > Clearly this is not standard RFC3315 behaviour though. -08 of that draft says Where the host has acquired addresses from DHCPv6 or the host does not have a global prefix, it MAY prefer to use DHCPv6 messages either before or simultanously with Neighbour Discovery probing. That doesn't seem to require that the host confirm. FWIW I think the same issues show up for DHCPv4 where we have DNAv4 (RFC 4436) where the hosts sends a unicast ARP request to verify reachability after suspected movement. That specification doesn't request the host to do a DHCP transaction. It merely RECOMMENDs it be done in parallel with the ARP check as a performance optimization for the case when the host moved to a different subnet. Erik From junbi@cernet.edu.cn Tue Jul 28 02:49:51 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id E7AAF3A6A13 for ; Tue, 28 Jul 2009 02:49:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.697 X-Spam-Level: X-Spam-Status: No, score=0.697 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_HAS_XAIMC=2.696, J_CHICKENPOX_32=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OFGKZHK+BR8J for ; Tue, 28 Jul 2009 02:49:51 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 7CD3E3A6886 for ; Tue, 28 Jul 2009 02:49:50 -0700 (PDT) Received: from userPC([130.129.23.110]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm04a6efc34; Tue, 28 Jul 2009 17:49:45 +0800 Message-ID: <2F6EEBE6F98E4EE391A0ACFA8F043275@userPC> From: "Jun Bi" To: "Erik Nordmark" , "Greg Daley" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com><4A6416E0.8090004@it.uc3m.es><3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com><4A680FD7.4000202@it.uc3m.es><6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com><4A681808.1070602@it.uc3m.es><6983BF97BFC24D4EA551F1407123291801193C1B@melmail.netstarnetworks.com> <4A6EBD95.1030903@sun.com> In-Reply-To: <4A6EBD95.1030903@sun.com> Date: Tue, 28 Jul 2009 11:49:27 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: 109Tj5WB Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 09:49:52 -0000 ----- Original Message ----- From: "Erik Nordmark" To: "Greg Daley" Cc: "SAVI Mailing List" ; "Christian Vogt" Sent: Tuesday, July 28, 2009 10:57 AM Subject: Re: [savi] Consensus call on "unregistered" source addresses > Greg Daley wrote: > >> On a link where all addresses are managed by DHCP (RFC4862 M=1), it has >> complete ownership of the >> address. There is no explicit need to ask the DHCP server for an address >> in RFC3315. It may try to check that the service is there with DHCPv6 >> SOLICIT or CONFIRM (which by default doesn't bind an address) >> >> In section 18.1.2, a host which believes it may have moved to a new link >> MUST CONFIRM. >> This doesn't mean that a lease is being allocated though. > > What happens when a host can't tell that it has moved to a new link? I > think in practice there are issues where the host can't tell or can't > easily tell that it might be connected to a different l2 device. > > To make the SAVI protocol robust I think we shouldn't rely on the "MUST > CONFIRM". > Dear Eric, Thank you for the analysis. However, from the viewpoint of network opeartor, if we chose DHCPv6-ONLY mode, it means that the administrator needs higher level of management on source addresses. Then host can only get the address by following DHCPv6 prcedure, so that the administrator could manage the network without any source spoofing. If the host failed to do DHCPv6 procedure, it's reasonable that the host can't access the network. During our real test on CPS, host did send CONFIRM when it change to another port or switch reboot (in was triggered by the link down and up). We will demo CPS at SAVI-WG. CPS is being widely deployed in CNGI-CERNET2, if we found the problem, we will report it. Up to now,no problem on this was found. I also believe the long time use of IP source guard in IPv4 also proved no problem was found. Best Regards, Jun >> The Simple DNAv6 procedures cover this in more detail though, and specify >> that the host should check if the DHCP server is actually there, even if >> the Router says no movement has occurred. >> Clearly this is not standard RFC3315 behaviour though. > > -08 of that draft says > Where the host has acquired addresses from DHCPv6 or the host does > not have a global prefix, it MAY prefer to use DHCPv6 messages either > before or simultanously with Neighbour Discovery probing. > > That doesn't seem to require that the host confirm. > > FWIW I think the same issues show up for DHCPv4 where we have DNAv4 (RFC > 4436) where the hosts sends a unicast ARP request to verify reachability > after suspected movement. That specification doesn't request the host to > do a DHCP transaction. It merely RECOMMENDs it be done in parallel with > the ARP check as a performance optimization for the case when the host > moved to a different subnet. > > Erik > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > From junbi@cernet.edu.cn Tue Jul 28 03:20:37 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C34723A6D57 for ; Tue, 28 Jul 2009 03:20:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.397 X-Spam-Level: X-Spam-Status: No, score=0.397 tagged_above=-999 required=5 tests=[AWL=0.300, BAYES_00=-2.599, FH_HAS_XAIMC=2.696] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 171JKjavzmGY for ; Tue, 28 Jul 2009 03:20:37 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 714DF3A69CD for ; Tue, 28 Jul 2009 03:20:36 -0700 (PDT) Received: from userPC([130.129.23.110]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm224a6f036d; Tue, 28 Jul 2009 18:20:35 +0800 Message-ID: From: "Jun Bi" To: "Erik Nordmark" , "Christian Vogt" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> In-Reply-To: <4A6EBD8B.8000607@sun.com> Date: Tue, 28 Jul 2009 12:20:11 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: 1JZnj5WB Cc: SAVI Mailing List Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 10:20:37 -0000 ----- Original Message ----- From: "Erik Nordmark" To: "Christian Vogt" Cc: "SAVI Mailing List" Sent: Tuesday, July 28, 2009 10:57 AM Subject: Re: [savi] Consensus call on "unregistered" source addresses > Christian Vogt wrote: >> Folks - >> >> As announced earlier, we will have a consensus call on how SAVI devices >> should treat source addresses for which no configuration signaling was >> seen. Consensus questions for this were proposed on July 8, and the >> feedback received from the working group indicates that those are OK. >> >> I would hence like to initiate the consensus call. To participate in >> the consensus call, please answer by Sunday, July 19, the following two >> questions (A) and (B), using one of the two possible answers provided >> for each question: >> >> (A) In networks where SLAAC is permitted for address configuration, how >> should a SAVI device treat packets with a source address for which >> neither a successful DAD procedure nor a DHCP assignment was seen? >> >> (A1) Discard the packet >> (A2) Forward and optionally log the packet Hi Eric, I believe up to know, most people in the mailing-list thinks that in DHCP-ONLY network, It will discard the packet (where FCFS doesn't discard but forwarding). The purpose of the WG is to anto-spoofing in fine granularity. So In DHCP-SLAAC mixed mode, I think maybe the switch still need to discard the packet A1) because the DHCP is still here. We could discuss for SLAAC-only case. See below. > > I think the question was malformed for the following reasons. > > *IF* SLAAC is permitted, then by definition the host can pick whatever > address it wants. Sorry, I don't agree with that. In SLAAC-only case, the administrator *at least* doesn't want a host to use the source address of another *unsed* address being used in the same link, so you could not say "by definition the host can pick whatever address". If you statement was correct, then "the requrement of SAVI solution to work on SLAAC-only network" should be remove from the SAVI charter becasue "by definiation", we did't need anti-spoofing in SLAAC-only mode ("host can pick up whatever address it wants"). I know you are an expert, so I don't belive you really think so. Best Regards, Jun Bi From elevyabe@cisco.com Tue Jul 28 04:31:09 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C187C3A6E3D for ; Tue, 28 Jul 2009 04:31:09 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.599 X-Spam-Level: X-Spam-Status: No, score=-7.599 tagged_above=-999 required=5 tests=[AWL=-1.000, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id eLi20nuQYVHQ for ; Tue, 28 Jul 2009 04:31:08 -0700 (PDT) Received: from sj-iport-2.cisco.com (sj-iport-2.cisco.com [171.71.176.71]) by core3.amsl.com (Postfix) with ESMTP id CDCA43A6A59 for ; Tue, 28 Jul 2009 04:31:08 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEABd+bkqrR7MV/2dsb2JhbAC6YYgnj0sFgjmBU4FN X-IronPort-AV: E=Sophos;i="4.43,282,1246838400"; d="scan'208";a="190251298" Received: from sj-dkim-1.cisco.com ([171.71.179.21]) by sj-iport-2.cisco.com with ESMTP; 28 Jul 2009 11:31:10 +0000 Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-1.cisco.com (8.12.11/8.12.11) with ESMTP id n6SBVArT021584; Tue, 28 Jul 2009 04:31:10 -0700 Received: from xbh-ams-101.cisco.com (xbh-ams-101.cisco.com [144.254.74.71]) by sj-core-5.cisco.com (8.13.8/8.14.3) with ESMTP id n6SBV5X0022760; Tue, 28 Jul 2009 11:31:10 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 28 Jul 2009 13:31:08 +0200 Received: from [10.61.100.188] ([10.61.100.188]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 28 Jul 2009 13:31:07 +0200 Message-ID: <4A6EE179.4080400@cisco.com> Date: Tue, 28 Jul 2009 13:31:05 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Erik Nordmark References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> In-Reply-To: <4A6EBD8B.8000607@sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 28 Jul 2009 11:31:07.0966 (UTC) FILETIME=[E668B5E0:01CA0F76] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=2487; t=1248780670; x=1249644670; c=relaxed/simple; s=sjdkim1004; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Consensus=20call=20on=20=22unr egistered=22=20source=20addresses |Sender:=20; bh=ZN6+ukES7eGOMW9tjAYWzYMDQgYlQ0IgBA6biRns6vU=; b=WwqSZsixrG706hilxOpUNnBdk5OSVpIM9U63LFuNwkNv8SkWjfFyhkTEKA US1gnj/WVVQDNoriGLNDmZzNdJcuu9b1jK/oWmbKUw3dOwiSmmyifhAhaRNp Qiv5NhXg7dRUsc3UjIZTh7ZlJt3skZCvOwYvBKnC4vKXsEhR8v770=; Authentication-Results: sj-dkim-1; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/sjdkim1004 verified; ); Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 11:31:09 -0000 Erik, Erik Nordmark a écrit : > Christian Vogt wrote: >> Folks - >> >> As announced earlier, we will have a consensus call on how SAVI devices >> should treat source addresses for which no configuration signaling was >> seen. Consensus questions for this were proposed on July 8, and the >> feedback received from the working group indicates that those are OK. >> >> I would hence like to initiate the consensus call. To participate in >> the consensus call, please answer by Sunday, July 19, the following two >> questions (A) and (B), using one of the two possible answers provided >> for each question: >> >> (A) In networks where SLAAC is permitted for address configuration, how >> should a SAVI device treat packets with a source address for which >> neither a successful DAD procedure nor a DHCP assignment was seen? >> >> (A1) Discard the packet >> (A2) Forward and optionally log the packet > > I think the question was malformed for the following reasons. > > *IF* SLAAC is permitted, then by definition the host can pick whatever > address it wants. DAD as defined is not a reliable protocol, thus > pretending it is the way a host *registers* a SLAAC address makes no > sense. For instance, if 802.1D bridges wait for 30 seconds before > enabling a Ethernet port, then no DAD packet would be seen on the > network. > > Thus I think the case when the the admin wants to only allow > registered addresses then SLAAC can not be used; DHCPv6 would need to > be used as the assignment/registration protocol. > Maybe it's a matter of wording. In the SLACC case, the host does not *register*, however it is not unreasonnable to expect that the first hop (L2 switch) have seen a binding for it. In a sense, it's not very different from RPF. If you don't have a return path to it, it is suspicious. Not broken because the nexthop will do address resolution on the reverse path, but suspicious because bindings are announced in a fairly redundant way (DAD * n, NA, NS*3) It really takes some specific cases to not see any binding prior to forward a host traffic. And then it's a matter of policy: Your example is the one of a non-savi switch (your 802.1D bridge) connected to a savi switch. The policy could be to forward by default in this case. Eric. > Erik > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > From erik.nordmark@sun.com Tue Jul 28 05:12:23 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 70BA43A6EBB for ; Tue, 28 Jul 2009 05:12:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.725 X-Spam-Level: X-Spam-Status: No, score=-5.725 tagged_above=-999 required=5 tests=[AWL=-0.279, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, J_CHICKENPOX_32=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fmdl6hBD9vvm for ; Tue, 28 Jul 2009 05:12:22 -0700 (PDT) Received: from brmea-mail-1.sun.com (brmea-mail-1.Sun.COM [192.18.98.31]) by core3.amsl.com (Postfix) with ESMTP id 8163F3A6EF5 for ; Tue, 28 Jul 2009 05:12:22 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brmea-mail-1.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6SCCJ6e018365; Tue, 28 Jul 2009 12:12:19 GMT Received: from [10.7.251.248] (punchin-nordmark.SFBay.Sun.COM [10.7.251.248]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6SCCGnJ763109 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jul 2009 05:12:17 -0700 (PDT) Message-ID: <4A6EEB1E.1020303@sun.com> Date: Tue, 28 Jul 2009 05:12:14 -0700 From: Erik Nordmark User-Agent: Thunderbird 2.0.0.21 (X11/20090323) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6416E0.8090004@it.uc3m.es> <3EFE4316-7F75-4933-88BC-1584BC897BF1@ericsson.com> <4A680FD7.4000202@it.uc3m.es> <6983BF97BFC24D4EA551F1407123291801193C14@melmail.netstarnetworks.com> <4A681808.1070602@it.uc3m.es> <6983BF97BFC24D4EA551F1407123291801193C1B@melmail.netstarnetworks.com> <4A6EBD95.1030903@sun.com> <2F6EEBE6F98E4EE391A0ACFA8F043275@userPC> In-Reply-To: <2F6EEBE6F98E4EE391A0ACFA8F043275@userPC> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Christian Vogt , Greg Daley Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 12:12:23 -0000 Jun Bi wrote: > Thank you for the analysis. > However, from the viewpoint of network opeartor, if we chose DHCPv6-ONLY > mode, it means that the administrator > needs higher level of management on source addresses. Then host can only > get the address by following DHCPv6 > prcedure, so that the administrator could manage the network without any > source spoofing. > If the host failed to do DHCPv6 procedure, it's reasonable that the host > can't access the network. Agreed. > During our real test on CPS, host did send CONFIRM when it change to > another port or switch reboot Did you test all implementations that exist? Did you test future implementations (not yet implemented) which will conform to draft-ietf-dna-simple? > (in was triggered by the link down and up). We will demo CPS at SAVI-WG. > CPS is being widely deployed > in CNGI-CERNET2, if we found the problem, we will report it. Up to > now,no problem on this was found. > I also believe the long time use of IP source guard in IPv4 also proved > no problem was found. Has IPv4 source guard been tested with all possible DHCPv4 implementations, including implementations that conform to RFC 4436? I think for DNAv4 and DNAv6 is it relatively simple to make the host fall back to sending a DHCP packet; just need to make sure that the ARP/ND packet that is used to verify the connectivity is blocked by the SAVI device (when the source address is not registered). For non-DNA implementations things are harder assuming that we want to support folks having unmanaged switches at the edges of the network, because in that case the host would not see a link down event if the SAVI switch fails. Similar issues can appear for wireless technologies if the NIC or device driver transparently reconnects to a different access point. In those case it would be difficult to come up with a robust DHCPv* SAVI approach. Erik From erik.nordmark@sun.com Tue Jul 28 05:14:15 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A5C423A67AA for ; Tue, 28 Jul 2009 05:14:15 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.006 X-Spam-Level: X-Spam-Status: No, score=-6.006 tagged_above=-999 required=5 tests=[AWL=0.040, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vhE-B2Y4EdyS for ; Tue, 28 Jul 2009 05:14:15 -0700 (PDT) Received: from brmea-mail-2.sun.com (brmea-mail-2.Sun.COM [192.18.98.43]) by core3.amsl.com (Postfix) with ESMTP id 0352B3A6EFE for ; Tue, 28 Jul 2009 05:14:00 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by brmea-mail-2.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6SCDvNF013928; Tue, 28 Jul 2009 12:13:57 GMT Received: from [10.7.251.248] (punchin-nordmark.SFBay.Sun.COM [10.7.251.248]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6SCDs2S763192 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jul 2009 05:13:56 -0700 (PDT) Message-ID: <4A6EEB82.2010607@sun.com> Date: Tue, 28 Jul 2009 05:13:54 -0700 From: Erik Nordmark User-Agent: Thunderbird 2.0.0.21 (X11/20090323) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 12:14:15 -0000 Jun Bi wrote: >> I think the question was malformed for the following reasons. >> >> *IF* SLAAC is permitted, then by definition the host can pick whatever >> address it wants. > > Sorry, I don't agree with that. In SLAAC-only case, the administrator > *at least* doesn't > want a host to use the source address of another *unsed* address being > used in the same link, > so you could not say "by definition the host can pick whatever address". > If you statement was correct, > then "the requrement of SAVI solution to work on SLAAC-only network" > should be remove from > the SAVI charter becasue "by definiation", we did't need anti-spoofing > in SLAAC-only mode ("host can pick up whatever address it wants"). > I know you are an expert, so I don't belive you really think so. You missed the key point that DAD is not a reliable address registration protocol. Regards, Erik From junbi@cernet.edu.cn Tue Jul 28 06:20:37 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 507963A6CFA for ; Tue, 28 Jul 2009 06:20:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.247 X-Spam-Level: X-Spam-Status: No, score=0.247 tagged_above=-999 required=5 tests=[AWL=0.150, BAYES_00=-2.599, FH_HAS_XAIMC=2.696] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id u3BvYNYkP+kL for ; Tue, 28 Jul 2009 06:20:36 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 8B3933A6C1A for ; Tue, 28 Jul 2009 06:20:34 -0700 (PDT) Received: from userPC([130.129.53.245]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm04a6f2d9c; Tue, 28 Jul 2009 21:20:33 +0800 Message-ID: <6A64ACF86EDB42E88EE4DCA481CD404B@userPC> From: "Jun Bi" To: "Erik Nordmark" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> <4A6EEB82.2010607@sun.com> In-Reply-To: <4A6EEB82.2010607@sun.com> Date: Tue, 28 Jul 2009 15:20:18 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: 1Z9bm5WB Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 13:20:37 -0000 ----- Original Message ----- From: "Erik Nordmark" To: "Jun Bi" Cc: "Christian Vogt" ; "SAVI Mailing List" Sent: Tuesday, July 28, 2009 2:13 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses > Jun Bi wrote: > >>> I think the question was malformed for the following reasons. >>> >>> *IF* SLAAC is permitted, then by definition the host can pick whatever >>> address it wants. >> >> Sorry, I don't agree with that. In SLAAC-only case, the administrator *at >> least* doesn't >> want a host to use the source address of another *unsed* address being >> used in the same link, >> so you could not say "by definition the host can pick whatever address". >> If you statement was correct, >> then "the requrement of SAVI solution to work on SLAAC-only network" >> should be remove from >> the SAVI charter becasue "by definiation", we did't need anti-spoofing in >> SLAAC-only mode ("host can pick up whatever address it wants"). >> I know you are an expert, so I don't belive you really think so. > > You missed the key point that DAD is not a reliable address registration > protocol. Hi Eric, I didn't think in my last email I was talking about how to set up the binding table in CPS. Then I don't know why you ask such a question here. In my last email, I questioned your such a statement: "*IF* SLAAC is permitted, then by definition the host can pick whatever address it wants". Can a savi-swtich allow a host to use the address that another host under another SAVI switch being legally used ? (you statement permits this). It is really source address spoofing. If you statement was agreed in SAVI WG, then the SLAAC network should be removed from SAVI charter. Then I thought you mistyped something. Since you mentioned the DAD loss again, I am happy to let you know that in the new verison of CPS-01, no only DAD is used, but also the unsolicited NA and NS to resovle the address, based on the suggestion from Eric Levy-Abegnoli. As he stated and we agreed, "the odds of getting none of them are extremely low." You questions helped us to improve the CPS, so thank you very much. I am happy because so far the CPS is still a low cost solution to makes the low end access switch (as low as 200-300USD per switch as we will demo on Thursday) easy to implement CPS. There is another way could be consdiered to enhace the reliability of DAD. In RFC4862. " DupAddrDetectTransmits The number of consecutive Neighbor Solicitation messages sent while performing Duplicate Address Detection on a tentative address. A value of zero indicates that Duplicate Address Detection is not performed on tentative addresses. A value of one indicates a single transmission with no follow-up retransmissions. Default: 1, but may be overridden by a link-type specific value in the document that covers issues related to the transmission of IP over a particular link type (e.g., [RFC2464])." One possible way is to ask the value of DupAddrDetectTransmits for SAVI client to change it to a value of 2 or greater than 2 (then loss possiblity will be really lowered). It's not a heavy effort like to design a reliable BDP. We also discussed with vendors on the possiblity of implementation. For example, if we have 20 IPv6 address bound at one port (one host could have multiple IPv6 addresses) in an access SAVI-switch, then the binding table wil be only 480 entries in ONE acceess switch (usually a switch has 24 ports). If we use the default forwarding at the access switch, then the binding table of other access SAVI-switches will has to be distributed to every SAVI-switches. Let say if we have 50 SAVI switches in the link, then each SAVI-switch will have 480*50=24K entries. The problems then are: (1) The cost of the switch will be extremely higher. You could check in the market how many ACL entries in the 2.5 layer access switches. (2) The size of binding table in a single switch will increase when the network getting larger. In a large network, it will be worse. (3) Every DATA packet will go through this 24K-long list, it is a heavy burden for low end 2.5 layer access switch. It might has 24 100Mbit ports and giga ports. In CPS, the data packets only go through a list of 480 entries. (4)Defaul fowarding has to have a complicated binding talbe remove mechnisam for savi access switch, to synchonize the binding table with other 49 savi-switch in the local link. Otherwise, your binding table will be increased. When a host plug out the cable from one of other 49 far away switches, how could a local switch know this event and remove that host's address form its local binding table? It's even worse in IPv6, because the large space of IPv6, the possiblity of the new host to use the unpluged address will be very low, then the new host's address just be added into binding entry in all 50 savi-switches, the unpluged host's "old" address won't be removed. Then the binding table size in each access swithc will be larger and larger. Yes, you colud say, we could ask a bigger switch with bigger ACLs to do it, but it means the opeator like us, we have to buy expensive switch to use it as access switch. I don't think it's acceptable. > > Regards, > Erik > > From erik.nordmark@sun.com Tue Jul 28 07:35:46 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id BEEBD3A6FDF for ; Tue, 28 Jul 2009 07:35:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.008 X-Spam-Level: X-Spam-Status: No, score=-6.008 tagged_above=-999 required=5 tests=[AWL=0.038, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vDVAwokeJOsQ for ; Tue, 28 Jul 2009 07:35:45 -0700 (PDT) Received: from sca-ea-mail-4.sun.com (sca-ea-mail-4.Sun.COM [192.18.43.22]) by core3.amsl.com (Postfix) with ESMTP id C57983A6FD4 for ; Tue, 28 Jul 2009 07:35:45 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.59]) by sca-ea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6SEZhD4003805; Tue, 28 Jul 2009 14:35:43 GMT Received: from [10.7.251.248] (punchin-nordmark.SFBay.Sun.COM [10.7.251.248]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6SEZbJq777998 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jul 2009 07:35:39 -0700 (PDT) Message-ID: <4A6F0CB8.4010209@sun.com> Date: Tue, 28 Jul 2009 07:35:36 -0700 From: Erik Nordmark User-Agent: Thunderbird 2.0.0.21 (X11/20090323) MIME-Version: 1.0 To: Jun Bi References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> <4A6EEB82.2010607@sun.com> <6A64ACF86EDB42E88EE4DCA481CD404B@userPC> In-Reply-To: <6A64ACF86EDB42E88EE4DCA481CD404B@userPC> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 14:35:46 -0000 Jun Bi wrote: > I didn't think in my last email I was talking about how to set up the > binding table in CPS. > Then I don't know why you ask such a question here. > In my last email, I questioned your such a statement: "*IF* SLAAC is > permitted, then by definition the host can pick whatever address it > wants". Can a savi-swtich allow a host to use the address that another > host under another SAVI switch being legally used ? (you statement > permits this). It is really source address spoofing. If you statement > was agreed in SAVI WG, then the SLAAC network should be removed from > SAVI charter. Then I thought you mistyped something. FWIW what I meant is that a host can pick an address with any interface ID, which is different than the DHCP case when the DHCP server assigns the interface ID. Of course we want SAVI to prevent stealing somebody else's IP address even when SLAAC is used. > Since you mentioned the DAD loss again, I am happy to let you know that > in the new verison of CPS-01, > no only DAD is used, but also the unsolicited NA and NS to resovle the > address, based on the suggestion from Eric Levy-Abegnoli. As he stated > and we agreed, "the odds of getting none of them are extremely low." You > questions helped us to improve the CPS, so thank you very much. I am > happy because so far the CPS is still a low cost solution to makes the > low end access switch (as low as 200-300USD per switch as we will demo > on Thursday) easy to implement CPS. I suspect you have a model where - SAVI must be implemented on the first hop switch (the one connected to the host) - the hosts can reliably get indications from layer 2 when the switch fails or the link goes down and up I want SAVI to applicable in a broader model. It seems to be sufficient to require that there is a (convex) SAVI perimeter where all the switch ports that cross that perimeter have SAVI enabled. Switch ports inside the perimeter (e.g., the ports that connect switches together) do not need to have SAVI enabled. That model allows non-SAVI devices outside of the perimeter. However, in that model you can't assume that the host will send anything when there are switch failures. Instead you have to build the robustness into the SAVI mechanisms themselves. In the case that we allow unregistered access that isn't hard; the SAVI device would send a DAD probe on behalf of the host when it hears a new IP address on a port. Thus it gets triggered (subject to rate limiting of course) by any IPv6 packet arriving on the port that doesn't match the allowed set of IPv6 addresses on the port. > There is another way could be consdiered to enhace the reliability of DAD. > > In RFC4862. > " DupAddrDetectTransmits The number of consecutive Neighbor > Solicitation messages sent while performing Duplicate Address > Detection on a tentative address. A value of zero indicates that > Duplicate Address Detection is not performed on tentative > addresses. A value of one indicates a single transmission with no > follow-up retransmissions. > Default: 1, but may be overridden by a link-type specific value in > the document that covers issues related to the transmission of IP > over a particular link type (e.g., [RFC2464])." > > One possible way is to ask the value of DupAddrDetectTransmits for > SAVI client to change > it to a value of 2 or greater than 2 (then loss possiblity will be > really lowered). I don't think the reliability of SAVI should depend on changes to the hosts. If we are going to allow changes to host we might as well have the host do something designed to be reliable such as http://tools.ietf.org/html/draft-nordmark-6lowpan-reg-00 > It's not a heavy effort like to design a reliable BDP. FWIW I don't see a need to design a reliable BDP, nor a need for every SAVI device to know all the IP addresses in use. But SAVI needs to be robust against different host behavior. And if we can't allow unmanaged switches outside of the SAVI perimeter then I think we are significantly limiting the utility of SAVI. Erik From junbi@cernet.edu.cn Tue Jul 28 08:11:04 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 68AF03A7048 for ; Tue, 28 Jul 2009 08:11:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.497 X-Spam-Level: X-Spam-Status: No, score=0.497 tagged_above=-999 required=5 tests=[AWL=-0.200, BAYES_00=-2.599, FH_HAS_XAIMC=2.696, J_CHICKENPOX_32=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 0kZQLZRGIKML for ; Tue, 28 Jul 2009 08:11:03 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id D52F53A7043 for ; Tue, 28 Jul 2009 08:11:00 -0700 (PDT) Received: from userPC([130.129.53.245]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm04a6f477d; Tue, 28 Jul 2009 23:10:58 +0800 Message-ID: <2C83F650DFD148DAB865379794496AC7@userPC> From: "Jun Bi" To: "Erik Nordmark" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> <4A6EEB82.2010607@sun.com> In-Reply-To: <4A6EEB82.2010607@sun.com> Date: Tue, 28 Jul 2009 17:10:42 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: 1p0Uo5WB Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 15:11:04 -0000 ----- Original Message ----- From: "Erik Nordmark" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" ; "Greg Daley" Sent: Tuesday, July 28, 2009 2:12 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses > Jun Bi wrote: > >> Thank you for the analysis. >> However, from the viewpoint of network opeartor, if we chose DHCPv6-ONLY >> mode, it means that the administrator >> needs higher level of management on source addresses. Then host can only >> get the address by following DHCPv6 >> prcedure, so that the administrator could manage the network without any >> source spoofing. >> If the host failed to do DHCPv6 procedure, it's reasonable that the host >> can't access the network. > > Agreed. > >> During our real test on CPS, host did send CONFIRM when it change to >> another port or switch reboot > > Did you test all implementations that exist? We will demo with dhcpv6 client on Vista on Thursday. We also test the open source dhcpv6 client software dibbler with linux and windows. There is an "IPv6 ready" logo test on the confermance to IPv6 protocols. They do test IPv6-ready-DHCPv6. The current conclusion is that for those implementations conform to standard, we don't found problem yet. Don't we hope the implementations conform to standards? > Did you test future implementations (not yet implemented) which will > conform to draft-ietf-dna-simple? > If it is not yet implemented, certianly we didn't test it. >> (in was triggered by the link down and up). We will demo CPS at SAVI-WG. >> CPS is being widely deployed >> in CNGI-CERNET2, if we found the problem, we will report it. Up to now,no >> problem on this was found. >> I also believe the long time use of IP source guard in IPv4 also proved >> no problem was found. > > Has IPv4 source guard been tested with all possible DHCPv4 > implementations, including implementations that conform to RFC 4436? > > > I think for DNAv4 and DNAv6 is it relatively simple to make the host fall > back to sending a DHCP packet; just need to make sure that the ARP/ND > packet that is used to verify the connectivity is blocked by the SAVI > device (when the source address is not registered). > CPS does snoop DHCPv4/v6, as well as APR/ND to set up binding table. Don't forget, the princle of CPS is "control packets snooping ". So I wonder why you ask such a question. What we blocked are the unwanted data traffic. > > For non-DNA implementations things are harder assuming that we want to > support folks having unmanaged switches at the edges of the network, > because in that case the host would not see a link down event if the SAVI > switch fails. I don't quit understand you questions. We only use default dropping at the savi access switch for the port directly attached to a host. In the case, the host should know the link down/up at the port. Please see the multiple roles of port defined in CPS. >Similar issues can appear for wireless technologies if the NIC or device >driver transparently reconnects to a different access point. The current CPS is consdiered to be used in wired ethernet first (What we will demo is also in wired ethernet, at least we know it works for wired ethernet now.) Extention will be considered later (how the savi-wifi ap should do). > > In those case it would be difficult to come up with a robust DHCPv* SAVI > approach. > > Erik > _______________________________________________ > savi mailing list > savi@ietf.org > https://www.ietf.org/mailman/listinfo/savi > > From erik.nordmark@sun.com Tue Jul 28 08:26:29 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 18ABB3A6FFB for ; Tue, 28 Jul 2009 08:26:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.013 X-Spam-Level: X-Spam-Status: No, score=-6.013 tagged_above=-999 required=5 tests=[AWL=0.033, BAYES_00=-2.599, HELO_MISMATCH_COM=0.553, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id HQxn7K1xKcq4 for ; Tue, 28 Jul 2009 08:26:28 -0700 (PDT) Received: from brmea-mail-4.sun.com (brmea-mail-4.Sun.COM [192.18.98.36]) by core3.amsl.com (Postfix) with ESMTP id 302F03A706C for ; Tue, 28 Jul 2009 08:26:27 -0700 (PDT) Received: from jurassic-x4600.sfbay.sun.com ([129.146.17.63]) by brmea-mail-4.sun.com (8.13.6+Sun/8.12.9) with ESMTP id n6SFQQbQ014581; Tue, 28 Jul 2009 15:26:27 GMT Received: from [10.7.251.248] (punchin-nordmark.SFBay.Sun.COM [10.7.251.248]) by jurassic-x4600.sfbay.sun.com (8.14.3+Sun/8.14.3) with ESMTP id n6SFQONu785094 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO); Tue, 28 Jul 2009 08:26:25 -0700 (PDT) Message-ID: <4A6F189F.1050206@sun.com> Date: Tue, 28 Jul 2009 08:26:23 -0700 From: Erik Nordmark User-Agent: Thunderbird 2.0.0.21 (X11/20090323) MIME-Version: 1.0 To: Eric Levy-Abegnoli References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> <4A6EE179.4080400@cisco.com> In-Reply-To: <4A6EE179.4080400@cisco.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 15:26:29 -0000 Eric Levy-Abegnoli wrote: > Erik, > Erik Nordmark a écrit : >> Christian Vogt wrote: >>> Folks - >>> >>> As announced earlier, we will have a consensus call on how SAVI devices >>> should treat source addresses for which no configuration signaling was >>> seen. Consensus questions for this were proposed on July 8, and the >>> feedback received from the working group indicates that those are OK. >>> >>> I would hence like to initiate the consensus call. To participate in >>> the consensus call, please answer by Sunday, July 19, the following two >>> questions (A) and (B), using one of the two possible answers provided >>> for each question: >>> >>> (A) In networks where SLAAC is permitted for address configuration, how >>> should a SAVI device treat packets with a source address for which >>> neither a successful DAD procedure nor a DHCP assignment was seen? >>> >>> (A1) Discard the packet >>> (A2) Forward and optionally log the packet >> >> I think the question was malformed for the following reasons. >> >> *IF* SLAAC is permitted, then by definition the host can pick whatever >> address it wants. DAD as defined is not a reliable protocol, thus >> pretending it is the way a host *registers* a SLAAC address makes no >> sense. For instance, if 802.1D bridges wait for 30 seconds before >> enabling a Ethernet port, then no DAD packet would be seen on the >> network. >> >> Thus I think the case when the the admin wants to only allow >> registered addresses then SLAAC can not be used; DHCPv6 would need to >> be used as the assignment/registration protocol. >> > Maybe it's a matter of wording. In the SLACC case, the host does not > *register*, however it is not unreasonnable to expect that the first > hop (L2 switch) have seen a binding for it. Which protocol reliably established that binding? > In a sense, it's not very > different from RPF. If you don't have a return path to it, it is > suspicious. Not broken because the nexthop will do address resolution on > the reverse path, but suspicious because bindings are announced in a > fairly redundant way (DAD * n, NA, NS*3) Standard IPv6 DAD does 1 DAD probe and nothing more. The proposal I've seen is to only rely on that DAD probe. > It really takes some specific cases to not see any binding prior to > forward a host traffic. And then it's a matter of policy: Your example > is the one of a non-savi switch (your 802.1D bridge) connected to a savi > switch. The policy could be to forward by default in this case. My primary example is SAVI/802.1D switches which leave the port in blocked or learning state for a while thereby dropping the DAD probe. For the case where there is a legacy switch between the host and the SAVI switch I don't think we want to completely disable SAVI; that would severely limit the utility of SAVI (and I really want to see SAVI enabled by default everywhere) in common topologies. For instance corporate IT organizations that de-fact encourage folks to have small unmanaged switches in their office by charging per Ethernet drop. I think the WG should figure out how to handle such cases in a robust manner. Erik From junbi@tsinghua.edu.cn Tue Jul 28 08:40:38 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id D9B6C3A706D for ; Tue, 28 Jul 2009 08:40:38 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.654 X-Spam-Level: X-Spam-Status: No, score=-0.654 tagged_above=-999 required=5 tests=[AWL=-0.151, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495, J_CHICKENPOX_42=0.6, STOX_REPLY_TYPE=0.001] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GgI97LmtXPZc for ; Tue, 28 Jul 2009 08:40:37 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 1B3DD3A6DA3 for ; Tue, 28 Jul 2009 08:40:36 -0700 (PDT) Received: from dhcp-35f5.meeting.ietf.org ([130.129.53.245] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MVon0-0005rq-Vm; Tue, 28 Jul 2009 23:40:32 +0800 Message-ID: From: "Jun Bi" To: "Erik Nordmark" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com><4A6EBD8B.8000607@sun.com><4A6EEB82.2010607@sun.com><6A64ACF86EDB42E88EE4DCA481CD404B@userPC> <4A6F0CB8.4010209@sun.com> In-Reply-To: <4A6F0CB8.4010209@sun.com> Date: Tue, 28 Jul 2009 17:40:13 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 15:40:39 -0000 ----- Original Message ----- From: "Erik Nordmark" To: "Jun Bi" Cc: "SAVI Mailing List" ; "Christian Vogt" Sent: Tuesday, July 28, 2009 4:35 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses > Jun Bi wrote: > >> I didn't think in my last email I was talking about how to set up the >> binding table in CPS. >> Then I don't know why you ask such a question here. >> In my last email, I questioned your such a statement: "*IF* SLAAC is >> permitted, then by definition the host can pick whatever address it >> wants". Can a savi-swtich allow a host to use the address that another >> host under another SAVI switch being legally used ? (you statement >> permits this). It is really source address spoofing. If you statement was >> agreed in SAVI WG, then the SLAAC network should be removed from SAVI >> charter. Then I thought you mistyped something. > > FWIW what I meant is that a host can pick an address with any interface > ID, which is different than the DHCP case when the DHCP server assigns the > interface ID. Of course we want SAVI to prevent stealing somebody else's > IP address even when SLAAC is used. > Hi Eric, Thank you for the reply. You explaination make me undertand that we have the same goal. >> Since you mentioned the DAD loss again, I am happy to let you know that >> in the new verison of CPS-01, >> no only DAD is used, but also the unsolicited NA and NS to resovle the >> address, based on the suggestion from Eric Levy-Abegnoli. As he stated >> and we agreed, "the odds of getting none of them are extremely low." You >> questions helped us to improve the CPS, so thank you very much. I am >> happy because so far the CPS is still a low cost solution to makes the >> low end access switch (as low as 200-300USD per switch as we will demo on >> Thursday) easy to implement CPS. > > I suspect you have a model where > - SAVI must be implemented on the first hop switch (the one connected to > the host) > - the hosts can reliably get indications from layer 2 when the switch > fails or the link goes down and up > > I want SAVI to applicable in a broader model. > > It seems to be sufficient to require that there is a (convex) SAVI > perimeter where all the switch ports that cross that perimeter have SAVI > enabled. Switch ports inside the perimeter (e.g., the ports that connect > switches together) do not need to have SAVI enabled. > That model allows non-SAVI devices outside of the perimeter. In CPS-01, we have the following port tyeps: 8.1.1. Port Attributes The attribute of port depends on the role of the port. A port on a SAVI switch can be set to have none or more of all the attributes. If a port has an attribute, the corresponding snooping and filtering policy will be used on this port. If a port has multiple attributes, all the corresponding policies will be used. Conflict attributes MUST not be set to the same port. 8.1.1.1. SAVI-Host Attribute If and only if a port is directly connected with a host, this port can be set to have SAVI-Host attribute. Trunk port cannot be set to have this attribute. If a port has SAVI-Host attribute, control packet snooping MUST be performed on this port to set up bindings, and then the data packets from this port MUST be verified based on these bindings. 8.1.1.2. SAVI-DHCP-Trust Attribute If and only if a port is directly connected with a trustable DHCP server, or is a trunk port from which the DHCP reply should arrive, it can be set to have this attribute. When a port is configured to have SAVI-DHCP-Trust attribute, the switch trusts the DHCP reply messages from this port to establish bindings. If DHCP is used to assign address in the network, there should be at least one port has this attribute. DHCP reply message not from such ports MUST be dropped. In the situation DHCP-PD is used to configure prefix of the network, the switch also trust the Prefix Delegation message from port with this attribute. 8.1.1.3. SAVI-RA-Trust Attribute If and only if a port is directly connected with a trustable router, or is a trunk port from which the Router Advertisement should arrive, it can be set to have this attribute. When a port is configured to have a SAVI-RA-Trust attribute, the switch trusts the Router Advertisement messages from this port to learn the prefixes used on the link. There may be no SAVI-RA-Trust port in the network, even if only SLAAC is used to configure address. Router Advertisement received not from SAVI-RA-Trust port MUST be discarded. 8.1.1.4. SAVI-Trunk-Default Attribute If and only if a port is a trunk port, it can be set to have this attribute. This attribute is a conflict attribute of SAVI-Host attribute and SAVI-Trunk-Snooping attribute. No packet snooping will be performed on port with this attribute. Packet from port with such attribute will be forwarded if its source address doesn't conflict existing local bindings. 8.1.1.5. SAVI-Trunk-Snooping Attribute If and only if a port is a trunk port, it can be set to have this attribute. This attribute is a conflict attribute of SAVI-Host attribute and SAVI-Trunk-Default attribute. Control packet snooping MUST be performed on port with this attribute. The filtering policy on port with such attribute is based on "default-forwarding" principle, which means packets from this port can be forwarded if its source address doesn't conflict local bindings. It is not SUGGESTED to set a trunk port to have this attribute, unless it is found that only to set a port to have this attribute will achieve the spoofing mitigation goal. Setting a port to have this attribute will possibly result in forwarding performance problem. > > However, in that model you can't assume that the host will send anything > when there are switch failures. Instead you have to build the robustness > into the SAVI mechanisms themselves. However, we really observed the hosts realy sent control packets when the switch down and up. We have such a demo. > > In the case that we allow unregistered access that isn't hard; the SAVI > device would send a DAD probe on behalf of the host when it hears a new IP > address on a port. Thus it gets triggered (subject to rate limiting of > course) by any IPv6 packet arriving on the port that doesn't match the > allowed set of IPv6 addresses on the port. Hi Eric, are you proposing some enhancement on CPS? If yes, then I understand. If no, then I have to ask futher questions to understand it: (1) How the binding table is setup up? By CPS or by FCFS? (2) You do the DAD only at the access switch (directly connected to host)or at trunk ports. (3)After the DAD, if there is no NA replyed, will the savi-switch setup a permit entry for that source address. (4) If there is NA replyed, then will the savi-swtich setup a deny entry for that source address > >> There is another way could be consdiered to enhace the reliability of >> DAD. >> >> In RFC4862. >> " DupAddrDetectTransmits The number of consecutive Neighbor >> Solicitation messages sent while performing Duplicate Address >> Detection on a tentative address. A value of zero indicates that >> Duplicate Address Detection is not performed on tentative >> addresses. A value of one indicates a single transmission with no >> follow-up retransmissions. >> Default: 1, but may be overridden by a link-type specific value in >> the document that covers issues related to the transmission of IP >> over a particular link type (e.g., [RFC2464])." >> >> One possible way is to ask the value of DupAddrDetectTransmits for >> SAVI client to change >> it to a value of 2 or greater than 2 (then loss possiblity will be >> really lowered). > > I don't think the reliability of SAVI should depend on changes to the > hosts. If we are going to allow changes to host we might as well have the > host do something designed to be reliable such as > http://tools.ietf.org/html/draft-nordmark-6lowpan-reg-00 The current chart prevent to do much host change. The value setting of DupAddrDetectTransmits is a very minor thing. It is called the "value setting", not the host change. Since DupAddrDetectTransmits is defined as a vaiable, not a constant, it should be setable. (Anway, please also see the above session another methond to reduce the effction of dad loss.) If we could change host much, please also see my solution draft CSA presented in the first SAVI meeting in IETF72 at Dublin. So I think it depends on the degree of host change. Setting a value is very lightweight and reasonable. > >> It's not a heavy effort like to design a reliable BDP. > > FWIW I don't see a need to design a reliable BDP, nor a need for every > SAVI device to know all the IP addresses in use. Oh, I thought you are on the side to support a BDP or a way to let every savi--switch know the IP addresses being used, so that the savi-switch could use this binding table to do anti-spoofing. I am a little bit confused. Then how you drop the spoofed trafic to achive the goal your statement at the top of this email: "Of course we want SAVI to prevent stealing somebody else's IP address even when SLAAC is used." I really don't belive you can make it without our idea "control packet snooping". Hi Eric, although curently I don't agree all you points, but I really feel good to discuss technical questions with you. You reply inspired me sometimes. > > But SAVI needs to be robust against different host behavior. And if we > can't allow unmanaged switches outside of the SAVI perimeter then I think > we are significantly limiting the utility of SAVI. > I don't quite understand this. Best Regards, Jun Bi From junbi@tsinghua.edu.cn Tue Jul 28 08:53:23 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6B4B33A6EB9 for ; Tue, 28 Jul 2009 08:53:23 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.604 X-Spam-Level: X-Spam-Status: No, score=-0.604 tagged_above=-999 required=5 tests=[AWL=-0.100, BAYES_00=-2.599, DNS_FROM_RFC_DSN=1.495, J_CHICKENPOX_31=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JHd88KEbmzHu for ; Tue, 28 Jul 2009 08:53:22 -0700 (PDT) Received: from smtp.tsinghua.edu.cn (smtp.tsinghua.edu.cn [166.111.8.80]) by core3.amsl.com (Postfix) with ESMTP id 498743A6DA3 for ; Tue, 28 Jul 2009 08:53:22 -0700 (PDT) Received: from dhcp-35f5.meeting.ietf.org ([130.129.53.245] helo=userPC) by smtp.tsinghua.edu.cn with esmtpa (Exim 4.69) (envelope-from ) id 1MVozL-00062E-47; Tue, 28 Jul 2009 23:53:15 +0800 Message-ID: <208E41B2D47542C2AF61A73F9F3F15FD@userPC> From: "Jun Bi" To: "Erik Nordmark" , "Eric Levy-Abegnoli" References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com><4A6EBD8B.8000607@sun.com> <4A6EE179.4080400@cisco.com> <4A6F189F.1050206@sun.com> In-Reply-To: <4A6F189F.1050206@sun.com> Date: Tue, 28 Jul 2009 17:52:49 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=response Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list Reply-To: Jun Bi List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 15:53:23 -0000 ----- Original Message ----- From: "Erik Nordmark" To: "Eric Levy-Abegnoli" Cc: "SAVI Mailing List" ; "Christian Vogt" Sent: Tuesday, July 28, 2009 5:26 PM Subject: Re: [savi] Consensus call on "unregistered" source addresses Eric Levy-Abegnoli wrote: > Erik, > Erik Nordmark a écrit : >> Christian Vogt wrote: >>> Folks - >>> >>> As announced earlier, we will have a consensus call on how SAVI devices >>> should treat source addresses for which no configuration signaling was >>> seen. Consensus questions for this were proposed on July 8, and the >>> feedback received from the working group indicates that those are OK. >>> >>> I would hence like to initiate the consensus call. To participate in >>> the consensus call, please answer by Sunday, July 19, the following two >>> questions (A) and (B), using one of the two possible answers provided >>> for each question: >>> >>> (A) In networks where SLAAC is permitted for address configuration, how >>> should a SAVI device treat packets with a source address for which >>> neither a successful DAD procedure nor a DHCP assignment was seen? >>> >>> (A1) Discard the packet >>> (A2) Forward and optionally log the packet >> >> I think the question was malformed for the following reasons. >> >> *IF* SLAAC is permitted, then by definition the host can pick whatever >> address it wants. DAD as defined is not a reliable protocol, thus >> pretending it is the way a host *registers* a SLAAC address makes no >> sense. For instance, if 802.1D bridges wait for 30 seconds before >> enabling a Ethernet port, then no DAD packet would be seen on the >> network. >> >> Thus I think the case when the the admin wants to only allow registered >> addresses then SLAAC can not be used; DHCPv6 would need to be used as the >> assignment/registration protocol. >> > Maybe it's a matter of wording. In the SLACC case, the host does not > *register*, however it is not unreasonnable to expect that the first hop > (L2 switch) have seen a binding for it. Which protocol reliably established that binding? > In a sense, it's not very different from RPF. If you don't have a return > path to it, it is suspicious. Not broken because the nexthop will do > address resolution on the reverse path, but suspicious because bindings > are announced in a fairly redundant way (DAD * n, NA, NS*3) Standard IPv6 DAD does 1 DAD probe and nothing more. The proposal I've seen is to only rely on that DAD probe. Hi Eric, You saw the current CPS will do this in my last email. That is DAV*N (the value N of DupAddrDetectTransmits) + NA + NS). In this case, the lost all of them is rare. Since you mentioned the DAD loss again, I am happy to let you know that in the new verison of CPS-01, no only DAD is used, but also the unsolicited NA and NS to resovle the address, based on the suggestion from Eric Levy-Abegnoli. As he stated and we agreed, "the odds of getting none of them are extremely low." You questions helped us to improve the CPS, so thank you very much. I am happy because so far the CPS is still a low cost solution to makes the low end access switch (as low as 200-300USD per switch as we will demo on Thursday) easy to implement CPS. There is another way could be consdiered to enhace the reliability of DAD. In RFC4862. " DupAddrDetectTransmits The number of consecutive Neighbor Solicitation messages sent while performing Duplicate Address Detection on a tentative address. A value of zero indicates that Duplicate Address Detection is not performed on tentative addresses. A value of one indicates a single transmission with no follow-up retransmissions. Default: 1, but may be overridden by a link-type specific value in the document that covers issues related to the transmission of IP over a particular link type (e.g., [RFC2464])." One possible way is to ask the value of DupAddrDetectTransmits for SAVI client to change t to a value of 2 or greater than 2 (then loss possiblity will be really lowered). It's not a heavy effort like to design a reliable BDP. Best Regards, Jun Bi My primary example is SAVI/802.1D switches which leave the port in blocked or learning state for a while thereby dropping the DAD probe. For the case where there is a legacy switch between the host and the SAVI switch I don't think we want to completely disable SAVI; that would severely limit the utility of SAVI (and I really want to see SAVI enabled by default everywhere) in common topologies. For instance corporate IT organizations that de-fact encourage folks to have small unmanaged switches in their office by charging per Ethernet drop. I think the WG should figure out how to handle such cases in a robust manner. Hi Eric, I just replyed you the port type of CPS in my last email. Please take a look at those port attributes defined. different logic are designd by different type of ports. I believe CPS will handle the case you mentioned. However, in FCFS, the swtich reboot will cause serious problems. thanks, Jun Bi Erik _______________________________________________ savi mailing list savi@ietf.org https://www.ietf.org/mailman/listinfo/savi From christian.vogt@ericsson.com Tue Jul 28 12:14:44 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 6611A3A6925 for ; Tue, 28 Jul 2009 12:14:44 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BHaZdG527VBy for ; Tue, 28 Jul 2009 12:14:43 -0700 (PDT) Received: from imr1.ericy.com (imr1.ericy.com [198.24.6.9]) by core3.amsl.com (Postfix) with ESMTP id AE7DA3A6BE5 for ; Tue, 28 Jul 2009 12:14:43 -0700 (PDT) Received: from eusrcmw750.eamcs.ericsson.se (eusrcmw750.exu.ericsson.se [138.85.77.50]) by imr1.ericy.com (8.13.1/8.13.1) with ESMTP id n6SJEKCc003343; Tue, 28 Jul 2009 14:14:21 -0500 Received: from eusrcmw751.eamcs.ericsson.se ([138.85.77.51]) by eusrcmw750.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Tue, 28 Jul 2009 14:13:50 -0500 Received: from [10.16.1.9] ([164.48.124.45]) by eusrcmw751.eamcs.ericsson.se with Microsoft SMTPSVC(6.0.3790.3959); Tue, 28 Jul 2009 14:13:50 -0500 Message-Id: <1ECAE2BC-45F1-43E4-AA60-C54F821B53C3@ericsson.com> From: Christian Vogt To: SAVI Mailing List In-Reply-To: <138EB57B-9003-448F-A60A-C7837E8BE7BC@ericsson.com> Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes Content-Transfer-Encoding: 7bit Mime-Version: 1.0 (Apple Message framework v935.3) Date: Tue, 28 Jul 2009 21:13:47 +0200 References: <138EB57B-9003-448F-A60A-C7837E8BE7BC@ericsson.com> X-Mailer: Apple Mail (2.935.3) X-OriginalArrivalTime: 28 Jul 2009 19:13:50.0845 (UTC) FILETIME=[8A5FDAD0:01CA0FB7] Cc: Guang Yao , Alan Kavanagh , Hongyu Li , Frank Xia Subject: [savi] Presenters, please send slides X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 19:14:44 -0000 Presenters and potential presenters - Please send me your slides by Wednesday, 18:00, preferably in PDF format. I will then upload the slides to the meeting proceedings. Thank you. - Christian From elevyabe@cisco.com Tue Jul 28 12:45:34 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 87E303A67EB for ; Tue, 28 Jul 2009 12:45:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.399 X-Spam-Level: X-Spam-Status: No, score=-7.399 tagged_above=-999 required=5 tests=[AWL=-0.800, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H+5Q07Uk4ege for ; Tue, 28 Jul 2009 12:45:33 -0700 (PDT) Received: from sj-iport-6.cisco.com (sj-iport-6.cisco.com [171.71.176.117]) by core3.amsl.com (Postfix) with ESMTP id 7232F3A6359 for ; Tue, 28 Jul 2009 12:45:33 -0700 (PDT) X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: ApoEAJPybkqrR7PE/2dsb2JhbAC9WYgnkBkFgikQgVeBTQ X-IronPort-AV: E=Sophos;i="4.43,284,1246838400"; d="scan'208";a="355747806" Received: from sj-dkim-4.cisco.com ([171.71.179.196]) by sj-iport-6.cisco.com with ESMTP; 28 Jul 2009 19:45:35 +0000 Received: from sj-core-1.cisco.com (sj-core-1.cisco.com [171.71.177.237]) by sj-dkim-4.cisco.com (8.12.11/8.12.11) with ESMTP id n6SJjZSw012257; Tue, 28 Jul 2009 12:45:35 -0700 Received: from xbh-ams-101.cisco.com (xbh-ams-101.cisco.com [144.254.74.71]) by sj-core-1.cisco.com (8.13.8/8.14.3) with ESMTP id n6SJjYFl024213; Tue, 28 Jul 2009 19:45:34 GMT Received: from xmb-ams-335.cisco.com ([144.254.231.80]) by xbh-ams-101.cisco.com with Microsoft SMTPSVC(6.0.3790.3959); Tue, 28 Jul 2009 21:45:34 +0200 Received: from [10.61.101.81] ([10.61.101.81]) by xmb-ams-335.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 28 Jul 2009 21:45:33 +0200 Message-ID: <4A6F555D.6070806@cisco.com> Date: Tue, 28 Jul 2009 21:45:33 +0200 From: Eric Levy-Abegnoli User-Agent: Thunderbird 2.0.0.22 (Windows/20090605) MIME-Version: 1.0 To: Erik Nordmark References: <21507DAB-FC6E-4651-8672-90327657C368@ericsson.com> <4A6EBD8B.8000607@sun.com> <4A6EE179.4080400@cisco.com> <4A6F189F.1050206@sun.com> In-Reply-To: <4A6F189F.1050206@sun.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit X-OriginalArrivalTime: 28 Jul 2009 19:45:33.0547 (UTC) FILETIME=[F87923B0:01CA0FBB] DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; l=4602; t=1248810335; x=1249674335; c=relaxed/simple; s=sjdkim4002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=elevyabe@cisco.com; z=From:=20Eric=20Levy-Abegnoli=20 |Subject:=20Re=3A=20[savi]=20Consensus=20call=20on=20=22unr egistered=22=20source=20addresses |Sender:=20; bh=OI63hA9v0CdWiuZ1NqArUam3GTnI7+fBaqxbFmVRrJ8=; b=hNO5YDDJtsM9wXqveiV/0vfNklVJtQwTAk5gYerpQXKysxSPAQw/bCcUYx zfT1Qj/URwjAWgvNpXBFOnZ3Fz6EOIFu54wmHfaIxmqtoj/SL/2Q/L9ReCy5 5Ri0X2v07w; Authentication-Results: sj-dkim-4; header.From=elevyabe@cisco.com; dkim=pass ( sig from cisco.com/sjdkim4002 verified; ); Cc: SAVI Mailing List , Christian Vogt Subject: Re: [savi] Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 28 Jul 2009 19:45:34 -0000 Erik Nordmark a écrit : > Eric Levy-Abegnoli wrote: >> Erik, >> Erik Nordmark a écrit : >>> Christian Vogt wrote: >>>> Folks - >>>> >>>> As announced earlier, we will have a consensus call on how SAVI >>>> devices >>>> should treat source addresses for which no configuration signaling was >>>> seen. Consensus questions for this were proposed on July 8, and the >>>> feedback received from the working group indicates that those are OK. >>>> >>>> I would hence like to initiate the consensus call. To participate in >>>> the consensus call, please answer by Sunday, July 19, the following >>>> two >>>> questions (A) and (B), using one of the two possible answers provided >>>> for each question: >>>> >>>> (A) In networks where SLAAC is permitted for address configuration, >>>> how >>>> should a SAVI device treat packets with a source address for which >>>> neither a successful DAD procedure nor a DHCP assignment was seen? >>>> >>>> (A1) Discard the packet >>>> (A2) Forward and optionally log the packet >>> >>> I think the question was malformed for the following reasons. >>> >>> *IF* SLAAC is permitted, then by definition the host can pick >>> whatever address it wants. DAD as defined is not a reliable >>> protocol, thus pretending it is the way a host *registers* a SLAAC >>> address makes no sense. For instance, if 802.1D bridges wait for 30 >>> seconds before enabling a Ethernet port, then no DAD packet would be >>> seen on the network. >>> >>> Thus I think the case when the the admin wants to only allow >>> registered addresses then SLAAC can not be used; DHCPv6 would need >>> to be used as the assignment/registration protocol. >>> >> Maybe it's a matter of wording. In the SLACC case, the host does not >> *register*, however it is not unreasonnable to expect that the first >> hop (L2 switch) have seen a binding for it. > > Which protocol reliably established that binding? Did you read "reliably established"? None, so? We can spend years solving a problem that is a completely theoritical problem in most environments. Or we can try to do with what we have. DAD is theoritically broken. I mean DAD, no savi. If your DAD packet is lost, you never know that your address is duplicate. - in theory, it could be- *exactly* in the case that you describe below, you don't know neither. Does that prevent node to test duplicate in most cases? no. It would be great to have a declarative reliable protocol. Not sure we need yet another one though. InverseND would do. But the truth is, getting anything like this into the host is going to take a decade, and only if there is a buyout. I find the charter very wise from that regard: no new protocol allowed. > >> In a sense, it's not very different from RPF. If you don't have a >> return path to it, it is suspicious. Not broken because the nexthop >> will do address resolution on the reverse path, but suspicious >> because bindings are announced in a fairly redundant way (DAD * n, >> NA, NS*3) > > Standard IPv6 DAD does 1 DAD probe and nothing more. > The proposal I've seen is to only rely on that DAD probe. > One DAD is the default,.certainly not a MUST. So I don't see anything wrong in recomemnding to use a higher value in a savi setup. As fas as using more than DAD, well, it's still opened, isn't it? >> It really takes some specific cases to not see any binding prior to >> forward a host traffic. And then it's a matter of policy: Your >> example is the one of a non-savi switch (your 802.1D bridge) >> connected to a savi switch. The policy could be to forward by default >> in this case. > > My primary example is SAVI/802.1D switches which leave the port in > blocked or learning state for a while thereby dropping the DAD probe. > > For the case where there is a legacy switch between the host and the > SAVI switch I don't think we want to completely disable SAVI; that > would severely limit the utility of SAVI (and I really want to see > SAVI enabled by default everywhere) in common topologies. For instance > corporate IT organizations that de-fact encourage folks to have small > unmanaged switches in their office by charging per Ethernet drop. > > I think the WG should figure out how to handle such cases in a robust > manner. I am not ruling that out. But a non-savi switch, not doing authentication at layer2, connected to a savi switch is the hard case. I would not pre-req solving it to make progress on the other cases. Eric > > Erik > From junbi@cernet.edu.cn Tue Jul 28 23:57:39 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3B4723A6907 for ; Tue, 28 Jul 2009 23:57:39 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0 X-Spam-Level: X-Spam-Status: No, score=x tagged_above=-999 required=5 tests=[] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id K7b0lxEulXPN for ; Tue, 28 Jul 2009 23:57:39 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id BF9C33A6E53 for ; Tue, 28 Jul 2009 23:57:35 -0700 (PDT) Received: from userPC([130.129.23.110]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm04a706e72; Wed, 29 Jul 2009 14:57:34 +0800 Message-ID: From: "Jun Bi" To: "SAVI Mailing List" Date: Wed, 29 Jul 2009 08:57:06 +0200 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0208_01CA102A.8CBC9340" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MIMEOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: X04GD6WB Subject: [savi] Fw: Presenters, please send slides savi-cps X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 29 Jul 2009 06:57:39 -0000 ÕâÊÇ MIME ¸ñʽµÄ¶à·½Óʼþ¡£ ------=_NextPart_000_0208_01CA102A.8CBC9340 Content-Type: text/plain; format=flowed; charset="gb2312"; reply-type=original Content-Transfer-Encoding: 8bit The cps-01 draft is here. thanks, Jun Bi ----- Original Message ----- From: "junbi" To: "Christian Vogt" ; "SAVI Mailing List" Cc: "Eric Levy-Abegnoli" ; "Alan Kavanagh" ; "Jianping Wu" ; "Jun Bi" ; "Guang Yao" ; "Dong Zhang" ; "Frank Xia" ; "Hongyu Li" Sent: Wednesday, July 29, 2009 2:07 AM Subject: Re: Presenters, please send slides > Hi Christian, > > The attached is my draft ppt. > I plan to add some slides to introduce SAVI-CPS. > But since I have only 15 minutes, I may be able only give a very brife > introduction. > > Best Regards, > Jun Bi > > > > > >> -----Original Message----- >> ·¢¼þÈË: Christian Vogt >> ÈÕÆÚ: Tue, 28 Jul 2009 21:13:47 +0200 >> ÊÕ¼þÈË: SAVI Mailing List >> ³­ËÍ: Eric Levy-Abegnoli , > Alan Kavanagh , > Jianping Wu , Jun Bi , > Guang Yao , > Dong Zhang , > Frank Xia , Hongyu Li >> Ö÷Ìâ: Presenters, please send slides >> Presenters and potential presenters - >> >> Please send me your slides by Wednesday, 18:00, preferably in PDF >> format. >> I will then upload the slides to the meeting proceedings. >> >> Thank you. >> - Christian >> >> > > ------=_NextPart_000_0208_01CA102A.8CBC9340 Content-Type: application/pdf; name="SAVI-ietf75-CERNET2-draft.pdf" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="SAVI-ietf75-CERNET2-draft.pdf" JVBERi0xLjQNJeLjz9MNCjEwNCAwIG9iag08PC9MaW5lYXJpemVkIDEvTCAzNTQxOTAvTyAxMDYv RSA1MDc1L04gMTkvVCAzNTIwNjIvSCBbIDUxNiAzOTBdPj4NZW5kb2JqDSAgICAgICAgICAgICAg DQp4cmVmDQoxMDQgMTENCjAwMDAwMDAwMTYgMDAwMDAgbg0KMDAwMDAwMDkwNiAwMDAwMCBuDQow MDAwMDAwOTg5IDAwMDAwIG4NCjAwMDAwMDExMzAgMDAwMDAgbg0KMDAwMDAwMTI0NSAwMDAwMCBu DQowMDAwMDAxNjE5IDAwMDAwIG4NCjAwMDAwMDE2NTYgMDAwMDAgbg0KMDAwMDAwMTczNCAwMDAw MCBuDQowMDAwMDAyMTM4IDAwMDAwIG4NCjAwMDAwMDIzODEgMDAwMDAgbg0KMDAwMDAwMDUxNiAw MDAwMCBuDQp0cmFpbGVyDQo8PC9TaXplIDExNS9QcmV2IDM1MjA1MC9Sb290IDEwNSAwIFIvSW5m byAxMDMgMCBSL0lEWzw3RkI4N0JDMUFBNjU3NEExMzU3OERERENBMDEwODU1Mj48QzhDMUY3RDNF MzMyRkM0Njg4QURGNTFDQUIxQjE1NTA+XT4+DQpzdGFydHhyZWYNCjANCiUlRU9GDQogICAgICAg IA0KMTE0IDAgb2JqDTw8L0xlbmd0aCAzMDEvRmlsdGVyL0ZsYXRlRGVjb2RlL0kgMzYzL0wgMzQ3 L1MgMjc3Pj5zdHJlYW0NCnjaYmBgYGZgYApnYGFgYHzBIMSAAEJAMVYg5ghgYAwwYGAoa2Bgbm4Q MmBQYHBmOM3DvvGGAOODNicGkQVAA+oZohhYJnim8B9h/uYguYGhJDQ09FVoaFhHawDQKJ4Oz2Mu Cx57cRQuZbE4MUUmTSvAw3C19Z2FS1li+L5rpHjxGamySwo192oogtQpBQr3aqgsBxJzOkGsp8IQ iQeCSg2MEkoujUoaDAyNQhpgZ3Z0MDAYd3SApZRdGhg4GAQblc0bGBjYIZhRHCimZNxAgtuBpoYy MB8+BqQ5gFgEbI8qgyCDCYNwg5YCMKQ8WPcwzuFKZPjJoOcgu0C0gbuBsYJxUpI8g57bBQaNBp4A SBAmMrD6nAXSTEBsC8TpDKwxW4A0IxD/AAgwAEMfVYUNCmVuZHN0cmVhbQ1lbmRvYmoNMTA1IDAg b2JqDTw8L01ldGFkYXRhIDEwMiAwIFIvUGFnZXMgOTkgMCBSL1R5cGUvQ2F0YWxvZy9QYWdlTGFi ZWxzIDk3IDAgUj4+DWVuZG9iag0xMDYgMCBvYmoNPDwvQ3JvcEJveFswIDAgNTk1LjIyIDg0Ml0v UGFyZW50IDEwMCAwIFIvQ29udGVudHMgMTA4IDAgUi9Sb3RhdGUgOTAvTWVkaWFCb3hbMCAwIDU5 NS4yMiA4NDJdL1Jlc291cmNlcyAxMDcgMCBSL1R5cGUvUGFnZT4+DWVuZG9iag0xMDcgMCBvYmoN PDwvQ29sb3JTcGFjZTw8L0NzNiAxMDkgMCBSPj4vRm9udDw8L1RUMiAxMTEgMCBSPj4vUHJvY1Nl dFsvUERGL1RleHRdL0V4dEdTdGF0ZTw8L0dTMSAxMTAgMCBSPj4+Pg1lbmRvYmoNMTA4IDAgb2Jq DTw8L0xlbmd0aCAzMDMvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmjeVJDLTkIxEIb3fYpZ oqFlej3UnYIxuEJpZE2wEAzn4ukxhrd3WtBgmmYynfm/f6afTMIBmHWVMFNwUqCUwK1BqBRCH5m6 LtRsfQsNQ5gaKfwUrLdCAb9k1L2m6mSWHGwTyHLSll6eVhL26T/rymPHXv56HgKbhKBIGXZkZFAg OZwDgqy8IKrSwlu0EGpq2dMNWyYQ0UD4ZqPZcgXLvt33MSV4jV3bD3ewqLtjrGMzbIZD24zhJnww JZRzHrgU0nvSzhnPFPmLswU3j92xPWXpGDbNe0YP7XDq4oVhta+uGWUavEjrtklDXzxzN4IuX8XP gdLKCetAKyW8PG80Wt2/LTgtwVFmjUBrDCloZS2zQR5NZ5MyrSpOz1/HE2gcAyhEn2WPgf0IMADH cW+7Cg0KZW5kc3RyZWFtDWVuZG9iag0xMDkgMCBvYmoNWy9JQ0NCYXNlZCAxMTMgMCBSXQ1lbmRv YmoNMTEwIDAgb2JqDTw8L09QTSAxL09QIGZhbHNlL29wIGZhbHNlL1R5cGUvRXh0R1N0YXRlL1NB IGZhbHNlL1NNIDAuMDI+Pg1lbmRvYmoNMTExIDAgb2JqDTw8L1N1YnR5cGUvVHJ1ZVR5cGUvRm9u dERlc2NyaXB0b3IgMTEyIDAgUi9MYXN0Q2hhciAxMjEvV2lkdGhzWzI1MCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMjUwIDMzMyAwIDAgNTAwIDUwMCA1MDAgNTAwIDAgMCAwIDAgMCA1MDAgMjc4IDAg MCAwIDAgMCAwIDcyMiAwIDY2NyA3MjIgMCAwIDAgMCAzMzMgMzg5IDAgMCAwIDAgMCA1NTYgMCA2 NjcgNTU2IDAgMCA3MjIgMCAwIDAgMCAwIDAgMCAwIDAgMCA0NDQgMCAwIDUwMCA0NDQgMCA1MDAg MCAyNzggMCAwIDI3OCA3NzggNTAwIDUwMCA1MDAgMCAzMzMgMzg5IDI3OCA1MDAgMCAwIDAgNTAw XS9CYXNlRm9udC9UaW1lc05ld1JvbWFuUFNNVC9GaXJzdENoYXIgMzIvRW5jb2RpbmcvV2luQW5z aUVuY29kaW5nL1R5cGUvRm9udD4+DWVuZG9iag0xMTIgMCBvYmoNPDwvU3RlbVYgODIvRm9udE5h bWUvVGltZXNOZXdSb21hblBTTVQvRm9udFN0cmV0Y2gvTm9ybWFsL0ZvbnRXZWlnaHQgNDAwL0Zs YWdzIDM0L0Rlc2NlbnQgLTIxNi9Gb250QkJveFstNTY4IC0zMDcgMjAwMCAxMDA3XS9Bc2NlbnQg ODkxL0ZvbnRGYW1pbHkoVGltZXMgTmV3IFJvbWFuKS9DYXBIZWlnaHQgNjU2L1hIZWlnaHQgNDUz L1R5cGUvRm9udERlc2NyaXB0b3IvSXRhbGljQW5nbGUgMD4+DWVuZG9iag0xMTMgMCBvYmoNPDwv TGVuZ3RoIDI1OTgvRmlsdGVyL0ZsYXRlRGVjb2RlL04gMy9BbHRlcm5hdGUvRGV2aWNlUkdCPj5z dHJlYW0NCmjenJZ3VFTXFofPvXd6oc0w0hl6ky4wgPQuIB0EURhmBhjKAMMMTWyIqEBEEREBRZCg gAGjoUisiGIhKKhgD0gQUGIwiqioZEbWSnx5ee/l5ffHvd/aZ+9z99l7n7UuACRPHy4vBZYCIJkn 4Ad6ONNXhUfQsf0ABniAAaYAMFnpqb5B7sFAJC83F3q6yAn8i94MAUj8vmXo6U+ng/9P0qxUvgAA yF/E5mxOOkvE+SJOyhSkiu0zIqbGJIoZRomZL0pQxHJijlvkpZ99FtlRzOxkHlvE4pxT2clsMfeI eHuGkCNixEfEBRlcTqaIb4tYM0mYzBXxW3FsMoeZDgCKJLYLOKx4EZuImMQPDnQR8XIAcKS4Lzjm CxZwsgTiQ7mkpGbzuXHxArouS49uam3NoHtyMpM4AoGhP5OVyOSz6S4pyalMXjYAi2f+LBlxbemi IluaWltaGpoZmX5RqP+6+Dcl7u0ivQr43DOI1veH7a/8UuoAYMyKarPrD1vMfgA6tgIgd/8Pm+Yh ACRFfWu/8cV5aOJ5iRcIUm2MjTMzM424HJaRuKC/6386/A198T0j8Xa/l4fuyollCpMEdHHdWClJ KUI+PT2VyeLQDf88xP848K/zWBrIieXwOTxRRKhoyri8OFG7eWyugJvCo3N5/6mJ/zDsT1qca5Eo 9Z8ANcoISN2gAuTnPoCiEAESeVDc9d/75oMPBeKbF6Y6sTj3nwX9+65wifiRzo37HOcSGExnCfkZ i2viawnQgAAkARXIAxWgAXSBITADVsAWOAI3sAL4gWAQDtYCFogHyYAPMkEu2AwKQBHYBfaCSlAD 6kEjaAEnQAc4DS6Ay+A6uAnugAdgBIyD52AGvAHzEARhITJEgeQhVUgLMoDMIAZkD7lBPlAgFA5F Q3EQDxJCudAWqAgqhSqhWqgR+hY6BV2ArkID0D1oFJqCfoXewwhMgqmwMqwNG8MM2An2hoPhNXAc nAbnwPnwTrgCroOPwe3wBfg6fAcegZ/DswhAiAgNUUMMEQbigvghEUgswkc2IIVIOVKHtCBdSC9y CxlBppF3KAyKgqKjDFG2KE9UCIqFSkNtQBWjKlFHUe2oHtQt1ChqBvUJTUYroQ3QNmgv9Cp0HDoT XYAuRzeg29CX0HfQ4+g3GAyGhtHBWGE8MeGYBMw6TDHmAKYVcx4zgBnDzGKxWHmsAdYO64dlYgXY Aux+7DHsOewgdhz7FkfEqeLMcO64CBwPl4crxzXhzuIGcRO4ebwUXgtvg/fDs/HZ+BJ8Pb4LfwM/ jp8nSBN0CHaEYEICYTOhgtBCuER4SHhFJBLVidbEACKXuIlYQTxOvEIcJb4jyZD0SS6kSJKQtJN0 hHSedI/0ikwma5MdyRFkAXknuZF8kfyY/FaCImEk4SXBltgoUSXRLjEo8UISL6kl6SS5VjJHslzy pOQNyWkpvJS2lIsUU2qDVJXUKalhqVlpirSptJ90snSxdJP0VelJGayMtoybDFsmX+awzEWZMQpC 0aC4UFiULZR6yiXKOBVD1aF6UROoRdRvqP3UGVkZ2WWyobJZslWyZ2RHaAhNm+ZFS6KV0E7Qhmjv lygvcVrCWbJjScuSwSVzcopyjnIcuUK5Vrk7cu/l6fJu8onyu+U75B8poBT0FQIUMhUOKlxSmFak KtoqshQLFU8o3leClfSVApXWKR1W6lOaVVZR9lBOVd6vfFF5WoWm4qiSoFKmclZlSpWiaq/KVS1T Paf6jC5Ld6In0SvoPfQZNSU1TzWhWq1av9q8uo56iHqeeqv6Iw2CBkMjVqNMo1tjRlNV01czV7NZ 874WXouhFa+1T6tXa05bRztMe5t2h/akjpyOl06OTrPOQ12yroNumm6d7m09jB5DL1HvgN5NfVjf Qj9ev0r/hgFsYGnANThgMLAUvdR6KW9p3dJhQ5Khk2GGYbPhqBHNyMcoz6jD6IWxpnGE8W7jXuNP JhYmSSb1Jg9MZUxXmOaZdpn+aqZvxjKrMrttTjZ3N99o3mn+cpnBMs6yg8vuWlAsfC22WXRbfLS0 suRbtlhOWWlaRVtVWw0zqAx/RjHjijXa2tl6o/Vp63c2ljYCmxM2v9ga2ibaNtlOLtdZzllev3zM Tt2OaVdrN2JPt4+2P2Q/4qDmwHSoc3jiqOHIdmxwnHDSc0pwOub0wtnEme/c5jznYuOy3uW8K+Lq 4Vro2u8m4xbiVun22F3dPc692X3Gw8Jjncd5T7Snt+duz2EvZS+WV6PXzAqrFetX9HiTvIO8K72f +Oj78H26fGHfFb57fB+u1FrJW9nhB/y8/Pb4PfLX8U/z/z4AE+AfUBXwNNA0MDewN4gSFBXUFPQm 2Dm4JPhBiG6IMKQ7VDI0MrQxdC7MNaw0bGSV8ar1q66HK4RzwzsjsBGhEQ0Rs6vdVu9dPR5pEVkQ ObRGZ03WmqtrFdYmrT0TJRnFjDoZjY4Oi26K/sD0Y9YxZ2O8YqpjZlgurH2s52xHdhl7imPHKeVM xNrFlsZOxtnF7YmbineIL4+f5rpwK7kvEzwTahLmEv0SjyQuJIUltSbjkqOTT/FkeIm8nhSVlKyU gVSD1ILUkTSbtL1pM3xvfkM6lL4mvVNAFf1M9Ql1hVuFoxn2GVUZbzNDM09mSWfxsvqy9bN3ZE/k uOd8vQ61jrWuO1ctd3Pu6Hqn9bUboA0xG7o3amzM3zi+yWPT0c2EzYmbf8gzySvNe70lbEtXvnL+ pvyxrR5bmwskCvgFw9tst9VsR23nbu/fYb5j/45PhezCa0UmReVFH4pZxde+Mv2q4quFnbE7+0ss Sw7uwuzi7Rra7bD7aKl0aU7p2B7fPe1l9LLCstd7o/ZeLV9WXrOPsE+4b6TCp6Jzv+b+Xfs/VMZX 3qlyrmqtVqreUT13gH1g8KDjwZYa5ZqimveHuIfu1nrUttdp15UfxhzOOPy0PrS+92vG140NCg1F DR+P8I6MHA082tNo1djYpNRU0gw3C5unjkUeu/mN6zedLYYtta201qLj4Ljw+LNvo78dOuF9ovsk 42TLd1rfVbdR2grbofbs9pmO+I6RzvDOgVMrTnV32Xa1fW/0/ZHTaqerzsieKTlLOJt/duFczrnZ 86nnpy/EXRjrjup+cHHVxds9AT39l7wvXbnsfvlir1PvuSt2V05ftbl66hrjWsd1y+vtfRZ9bT9Y /NDWb9nffsPqRudN65tdA8sHzg46DF645Xrr8m2v29fvrLwzMBQydHc4cnjkLvvu5L2key/vZ9yf f7DpIfph4SOpR+WPlR7X/aj3Y+uI5ciZUdfRvidBTx6Mscae/5T+04fx/Kfkp+UTqhONk2aTp6fc p24+W/1s/Hnq8/npgp+lf65+ofviu18cf+mbWTUz/pL/cuHX4lfyr468Xva6e9Z/9vGb5Dfzc4Vv 5d8efcd41/s+7P3EfOYH7IeKj3ofuz55f3q4kLyw8JsAAwD3hPP7Cg0KZW5kc3RyZWFtDWVuZG9i ag0xIDAgb2JqDTw8L0Nyb3BCb3hbMCAwIDU5NS4yMiA4NDJdL1BhcmVudCAxMDAgMCBSL0NvbnRl bnRzIDMgMCBSL1JvdGF0ZSA5MC9NZWRpYUJveFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDIg MCBSL1R5cGUvUGFnZT4+DWVuZG9iag0yIDAgb2JqDTw8L0NvbG9yU3BhY2U8PC9DczYgMTA5IDAg Uj4+L0ZvbnQ8PC9UVDQgODUgMCBSPj4vUHJvY1NldFsvUERGL1RleHRdL0V4dEdTdGF0ZTw8L0dT MSAxMTAgMCBSPj4+Pg1lbmRvYmoNMyAwIG9iag08PC9MZW5ndGggNDYzL0ZpbHRlci9GbGF0ZURl Y29kZT4+c3RyZWFtDQpo3mSSz27UMBCH736KOTqV7Hoc589yg91VVQ4tdK32QDlEWW8VtHFCnBZ4 DSR4XsYJjXZBUeTYsb/5Jr98ZQgNsCwvpCkhR6kQQWRGQaEVDI7p0xcte7gAzxSUBuWqhGyVSQ3i 74x2P9Dby3XIoQ6A0xVqWrnaITyFc9ZJjQP7uOx5Z9mltYZO2gMVMmkki3lQgKikySHNUOpUZWBb 2vPEpFJxUtPEfmP89nk8Nt4l9gstpJObmAcilKXUGlBlkmATIZ7GeFrEpzQiPvFfiTArI5HvEiFL /vb+Wqw/7KDx49Dtn+ux6Xzy2b5nGDEFCJQmXYHdzJBJZqHxQzfA3o1VcwzQH10VHARHd/XSiLoP QmF0FaesAheYXjpbtAy/Iy3DXd8N4xtY31yR3vbuZqupTn/sfrTOj1D5PUySsjQmjVytVLlw81dJ M0m+OL/vhp8BrltyjIBq6jKaLYD/mjz3KviGvAru2s6HcaiWz6RAl5I6EfNAwVIAK0CDZzEUrzGg nrm/E6FNTjHcJ0jcZu866DxgCu5774Zm0jzSX+Z8NTRdmIrZi38yzc9gBb9NZM59aEYHG1KFR57C 6MIINUUTHpOJsrXsjwADAB3ywykKDQplbmRzdHJlYW0NZW5kb2JqDTQgMCBvYmoNPDwvQ3JvcEJv eFswIDAgNTk1LjIyIDg0Ml0vUGFyZW50IDEwMCAwIFIvQ29udGVudHMgNiAwIFIvUm90YXRlIDkw L01lZGlhQm94WzAgMCA1OTUuMjIgODQyXS9SZXNvdXJjZXMgNSAwIFIvVHlwZS9QYWdlPj4NZW5k b2JqDTUgMCBvYmoNPDwvQ29sb3JTcGFjZTw8L0NzNiAxMDkgMCBSPj4vRm9udDw8L1RUNCA4NSAw IFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dF0vRXh0R1N0YXRlPDwvR1MxIDExMCAwIFI+Pj4+DWVuZG9i ag02IDAgb2JqDTw8L0xlbmd0aCAxODAvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmjeVI3J DoJAEETv/RV1VBOGnmGG5ajEGG8aOvIBuAQTIALG33dcYjB96KVeV91Iowa5OFE2RawVa43AWUZi GP2JzFRoqFygJUZqtcpSuMwpg+C7ebr0apgPMaoB+l1D5S+bQuMy/HtNMs60/zEroVDE+k85+yAb vZyDT2OYJFKpF5NMccQO0njmQoqZY0j1GrSBPGi2bce+O96rse5ajB2K5WEb5LtiLldaCz0FGABQ WjcPCg0KZW5kc3RyZWFtDWVuZG9iag03IDAgb2JqDTw8L0Nyb3BCb3hbMCAwIDU5NS4yMiA4NDJd L1BhcmVudCAxMDAgMCBSL0NvbnRlbnRzIDkgMCBSL1JvdGF0ZSA5MC9NZWRpYUJveFswIDAgNTk1 LjIyIDg0Ml0vUmVzb3VyY2VzIDggMCBSL1R5cGUvUGFnZT4+DWVuZG9iag04IDAgb2JqDTw8L0Nv bG9yU3BhY2U8PC9DczYgMTA5IDAgUj4+L0ZvbnQ8PC9UVDQgODUgMCBSPj4vUHJvY1NldFsvUERG L1RleHRdL0V4dEdTdGF0ZTw8L0dTMSAxMTAgMCBSPj4+Pg1lbmRvYmoNOSAwIG9iag08PC9MZW5n dGggMjM5L0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFtDQpo3lSNy07DMBBF9/MVdwlIdm3XjmOW hKjqphLFUtdV4latmgdJBOI3+GIcg1DQLGbsuefMG0lcQCazXOfIJBdSghktYJXAEEgtFw0dHtCS QK4ldzmMM1yB/b5i+hC3q2LMUI2QqcYq/mxeJc7jf9fixole/jJPnlbe60j6Uzyk17OZ/TQBpSSP Vme5scLANzFyJi6E0PBVGiL4QXf70HfD9Ihit9myotzvSoV7fyXG15kFixbnFPxzQuzMsnlSCa5D f+s+m9BOOLY13kNbd8PXmASKSyvd0iASs236W5iR43Tp2hQtPX0LMAAVvVGJCg0KZW5kc3RyZWFt DWVuZG9iag0xMCAwIG9iag08PC9Dcm9wQm94WzAgMCA1OTUuMjIgODQyXS9QYXJlbnQgMTAwIDAg Ui9Db250ZW50cyAxMiAwIFIvUm90YXRlIDkwL01lZGlhQm94WzAgMCA1OTUuMjIgODQyXS9SZXNv dXJjZXMgMTEgMCBSL1R5cGUvUGFnZT4+DWVuZG9iag0xMSAwIG9iag08PC9Db2xvclNwYWNlPDwv Q3M2IDEwOSAwIFI+Pi9Gb250PDwvVFQ0IDg1IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0XS9FeHRH U3RhdGU8PC9HUzEgMTEwIDAgUj4+Pj4NZW5kb2JqDTEyIDAgb2JqDTw8L0xlbmd0aCA5NzkvRmls dGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmjebFTBcts2EL3zK/YIpSECgCBF5ubaHo87TSatOc0h 7gGmIImNRLIEGNUf0n5vFwBJibZHM4JIYd++fft2/4441BCl2ZrKHDJOGecQp5LBWjDodSQu/zhG X99BEzHIJadFDmmRUgHx+IS3v+K/H65NBpUB7j+mwjd3Dxx2Zol1kWMb/Tbf+bmMPpSlxMhyi4lk 4pDjcGDenOYZCJ7SJGEplEe8sosoY2wNZeV/SChPEblr1cGAajZw1XV9q6r9qvwLL4ucMmQcDgY8 ETSXDpbxgBePGBVeRqBv5N9VzJMsoZJcrygnn+/u4+vb3z/flmL1Z/mLg5SIJx1YhmogcyFntG/k PwznhcTI61VMM+JDPwKclAG71zCh8MwTCwc+pjkVApIcJbtgxnPHjDSbsZoXqSXnNB+FcXVwdzs+ q/Kr6nca7h++vAeBL3+Coal/6N7U9hkcYswZwogUeVC2XiPOjZMBM1bq2A0GGm1Pbf/duPhPGG4w eIykax+WCBfkUiZz8iwoGaRIaIpSsCCEgDrIcHDMjIX7Lz+yKQu+HJpqrzdQN46vnARf9lCgVEX2 qofn9GLZyMQ1Ulw2Eh6u/riHG90d2uejbiy87KwosLBs0VkHnM4p8mWFCeGMncWttYEXAkKjbN02 p3qjx2ROOx4kn+m/KR5fcfyGT/XhgAihBx6jfBeN5Y6s0mVoRh7QggmxfV3ZwzNcNbaOTde227rZ gbKwb7EDu141A7YDPTFZs/AzGA6GnuRuZnjGloKnI2Oc7UnvNMWiyBVmFaSqhl5ZjXltryr9pKrv oEJKNSrOJcVFlGEOFOE8iKPv0b/OKeZU22oPXdtb77yM4hZZh5i52+SRaLqjcNrrBuEtJvMuFYzi SEnv79wRvVlyH+cEGW63dQVtj008qcaiB6d3e9V1ugmuD3soWSS/6BpB33prbby1EET1Wr2Hk4aq HQ6bcXJGEM9JnjlNG40nQU8vmx+WrtdVbXQQ7wlHF4efmHbog4oJ5VjchYozq6AioqjNptfGQLt9 VeDjKrBCq7MiuDJPpvoWrcXG4lo79/UJHen5TVINwZdc0HWR5m+0lfnSiMKlZNvXpU3yBULoukIW lzKdhV4ITOGRXOHyh7bTSK3tveJzv7LkDWmCaYmTwjguvhaUdjCOXNMGned2ZckrC72oaVv/g3SO bWP3KI1T6HFFPQAtJmEFn4Tl68XMcFKuYoFHCzttZ1GOWpmh17BRVr29C9M0o+nlKhy7HhbC5KSw CQWapsRdIkl91LDt1VF/dGs2xynhzOPfltH/AgwAXwkLawoNCmVuZHN0cmVhbQ1lbmRvYmoNMTMg MCBvYmoNPDwvQ3JvcEJveFswIDAgNTk1LjIyIDg0Ml0vUGFyZW50IDEwMCAwIFIvQ29udGVudHMg MTUgMCBSL1JvdGF0ZSA5MC9NZWRpYUJveFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDE0IDAg Ui9UeXBlL1BhZ2U+Pg1lbmRvYmoNMTQgMCBvYmoNPDwvWE9iamVjdDw8L0ltMSAxNiAwIFI+Pi9D b2xvclNwYWNlPDwvQ3M2IDEwOSAwIFI+Pi9Gb250PDwvVFQ0IDg1IDAgUj4+L1Byb2NTZXRbL1BE Ri9UZXh0L0ltYWdlQ10vRXh0R1N0YXRlPDwvR1MxIDExMCAwIFI+Pj4+DWVuZG9iag0xNSAwIG9i ag08PC9MZW5ndGggMjYwL0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFtDQpo3lSQS2/CMBCE7/sr 5giVsrGD7Ti99aWKI8ItFy5RCDQVSRqclr/fpZSKygc/Ztbz7Q6k0YCsy9l4OM1KayTWKOSZwqGm 7FpoaXWDjhS80Vx42MJyhuT3Ju6VqOlDdKgi9M+Klbw8LzV28f9fVxlbWvx57gOlIRipDFsJyjwr SThvCoLpHZznLFcWoRXHjlgpEUNFyek0QzjSZHn3Okc8NmP1Vkc0XRzL/b4cm7671UrhpWu+GFXZ fnxGdPWI9eRQb7Dpx/V0Gt7pKdBwnkzhuHDwjq0wm1yxzeAKw/bS7iAMTuZgkJhcszlhWiGc+UtV 1VI6bzUee+lzQd8CDADwtVT0Cg0KZW5kc3RyZWFtDWVuZG9iag0xNiAwIG9iag08PC9TdWJ0eXBl L0ltYWdlL0xlbmd0aCA0ODk5Ni9GaWx0ZXIvRENURGVjb2RlL0JpdHNQZXJDb21wb25lbnQgOC9D b2xvclNwYWNlIDEwOSAwIFIvV2lkdGggNzUzL0hlaWdodCA1MTIvVHlwZS9YT2JqZWN0Pj5zdHJl YW0NCv/Y/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkIDAkJDBELCgsRFQ8MDA8VGBMTFRMTGBcS FBQUFBIXFxscHhwbFyQkJyckJDUzMzM1Ozs7Ozs7Ozs7OwENCwsNDg0QDg4QFA4PDhQUEBEREBQd FBQVFBQdJRoXFxcXGiUgIx4eHiMgKCglJSgoMjIwMjI7Ozs7Ozs7Ozs7/8AAEQgCAALxAwEiAAIR AQMRAf/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEAAAAAAAAAAQAC AwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFhEyJxgTIGFJGhsUIjJBVSwWIz NHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV 5fVWZnaGlqa2xtbm9jdHV2d3h5ent8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEi EwUygZEUobFCI8FS0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N1 4/NGlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMRAD8A9VSS SSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJ SkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKS SSSUpJJJJSkkkklKSSSSUpJJJJSkkk0hJS6SaQkkpdJMnSUpJJJJSkkkklKSSSSUpJJJJSkkkklK SSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJ JJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkkl KSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSTFYfUe tXV3uoxwBsMOeRJnyUWbPDDHimfAd2TFhnllwwH8HatsZW0ueQ1o7kwFi5v1hg7MRskHV7hp8gse 6+6+z1LnF7vEqCzM/wASnLTGOAd+v9jo4fh8I65Dxn93o6dX1hzWvBta17O4Ag/erZ+suMOKrD/m /wB5WAkoY8/zERXHf97VmlyOCRvhr+7o9Tg9Zxcx/ptllnZru/wWguFDi1wc0w5pkFdV0nqP2yiX wLmGHgd/A/NaHJc77vonXH0I/SaPOcn7XrhZh1vo6CSYJ1eaSkkkklKSSSSUpJJJJSkkkklKSSSS UpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSk kkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkyhbayph e8hrRyUiQNTopmlKoPy8mwkVMFTOz7JLif6mkfMobvthMnJcPJrWR+LT+VU8nxDDA0OKX92q/FkG InqB5/2OiXgAkmAOSqp6nSZ9IOu8C0e0/BxgKq6tz9bnm49t0AD+yPb+Cc/kVPN8VltijXjLf7F8 cIG5vySHqeRPtx9P5TwD+DXKTOqD/C1OrHdwhw/6Ov4KuVByqf6V5qJsyEh2MQy+1jI+WvqXVoya r2b6nh4mCR2PgUWVhAOY/wBSpxrs/eA58nDui/tDOHLqz5bD/wCTV7F8ZwGI9wGEuoA4gxS5aV+k 356F2E6yqusWB0ZFQDf36yT/ANA6/ctGq9lzBZWQ5juCr+DmsOcXimJdx1H0Y545w+YfXokSTJ1M sUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKWXO9Y6W6lzsqsl7Xkl4MaErolmdeyfSxBXAJuMfAD UqrzuOEsMjP9EXE9i2OUnOOaIh+kaI8Hm0kgElgu4skkkglii4uTZi3tvr5byOxHgUNJOjIxkJA0 RqCqURKJiRYOhe2otbdUy1v0XtDh89URcx0jq7sVwoyHTQdGk67T/cumBldDy/MRzQEhuPmHYuBz GCWGZjLb9E9wukkkpmFSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSl JJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkk kkpSSSSSlJJJJKUkkkkpSSSSSlJpToORd6NbrILoiGjkk6AD4lCUhEEnQBQF6MrLqq27rHBrR3Jg fiqT3DJt9Qg+lX/NhwIl3O6D+CdlJc/1r/dbyB+ayezf70QwPJZfM80cgMYio/iWWMQPPuwIWV9Y rsinppdjWGm11lTBY3kb7GtPY+PgtU8Kh1nBf1DCdjVvFby5jg8zpscH/mkHt4qiCOIWz4TEZIGX ygi72p423qvVWG5n7Rs9Sgt9jpBcCWyQHYzNBu7kLR691fqQsvox7Gs9DJYxldTXm97Qxtrz7Xj2 gEzopZP1PyLtzzkVmwkEvIvc48d33v7NHIWzj9NrpzcrMeGvsvfLHR7mtLGMc2fPZKM54wQQAaG1 dXQyZ+XBjKIEjEfLw16tP7XOxep5vUMDOLbqWPpcW1X1sdtc3Y18gGyZIPisXo3UusZWdg02ZJZW KnHc8E7wAJ3e/wBx8ytgfVlv2PJx7PQc6671am+mSysQGCG7hqGoA+pmHU/Hcwts9MBt7bWSLNdX e0tIdromCeACYJGpNenbRMcnLCOQaer5fTt6Wv1T6w5FXUMimlrw1jfRYyDJJbY51zePolgHwWp0 PPvzcV7r2BllLhWYdun2MfJPj7lDqXRLcrKfkV2tZu9MNa5pIhjba3AwW8+qp9H6ZZ05lrXOYGvI LaqgWsaY9zvc5xl3dQZpYZYajQkBHz8UZJYDhjwACdR730t0Snxcl2JfvAmp+lrR/wBUB4hMVAqn iz5MGUZIGpR79uzAYiQMSLt3qMqi9s1ODo5A5HxHZFXM+9jxZU4stHDxz8Pgtzp2Z9qpJdDbGHa9 o8fEfFdN8P8AikOa9EhwZR06HyaOblzj9QNxbaSSS0mBSSSSSlJJJJKUkkkkpSSSSSlJJJJKWK5f rGZ9pySxv83SS1vme5XTuOhXFvMucfErO+KZCIQgNpkk/Rv/AA2AM5TO8Bp9WKSSSyHVWSSSQSsk kkklj3XV9J6m3NYWluy1n0mjgjxC5RWcDPtwbXWVtDtwgtPHKtcnzPsz1Pol837GtznL+9DQeuPy /teySlc3/wA5syf5uuPDX8son/Oh25v6D2/ne7Xzj2rUHxDlz+nXmHMPIcwP0L8i9CkgY+Zj5DGu qsa4O7AifuRlaBBFg21iCDR0XSSTGEUKlLcFj9Y643FmjHIffwXchv8AtVP6vZWZfmWC259jAwuL XEkTIVY83j96OEXKR3I2DYHKZDhlmNRiNQDuXpUkklZa6kkkklKSSSSUpJJJJSkkkklKSSSSUpJJ JJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkkl KSSSSUpJJJJSklB1jG6uIaPE6KrlZ9Ta3Cp82HQR2UeTLCESZHYWujEyIAG7ckJ1z3q2zuDnbuZn ut2l4fW1w1kAqPl+ZGbiocPCvy4TjqzdpEkklYYlKvmMe+r9GJe0tc0ExJaQ6PmrCYpsoiUTE7EU kGjfZp1Wttbubp4g8g9wU7zHkpW4Yc51lTjVa7lw1B8Nze/5UHfY2wVXNDXkEtLTLTHMTGvksnPy 88epFx7ssSDt9jg9exsnGYzJozcppvyaqzW14DQ2x4a4MBGmh0lNgdSxqMCzMD83LiwVW49gFttT 2zI2Nj71qdUwDn1VVh+z0rqrpImfTcHx84VkV1sLtrQ3cZdAiSe5VaWQcNHXv0bYzA4oxkLIOtUN OgcT/nTiuMfYs4T445/vWX1XO6pZm9TZSy1jKMUCsCzZAkuN20cmWwPJdcVn/s4ftK/Mc4OZfSyk 1EfulxmZ7yoxkhEk1WnU31ZMWXFEylwDYUJHi14gfDo06Ptf7Mvsy7H0s1vrtZYLHtYfftBNQEAe MrI6H1DLy8nHpvybn2WMN5LLanNDQdGvY2vcDwDqtajoeVVTbR9vtNLi1tLNrHBlTQW+mRYHg88w hM+rhoyPtVObbXfs9Pc2ulo2kzG0VgJhnACYJBMvlIGzLGeLgyi43M3H0nTRw8zLzR1TMp+1W1Vt fa1jv01gGjNA2sxpuMRwi4vUsu3ot+Qcl1l9l1JJAdUWb3hjmNe/2xp+bwtbK+rzH5Yy8W52Pa82 G15l5PqBrXbNxhp2giYT/sCgY1mC15GE6xljKCJ2lrg97dx1LXQlPPhMY33jdjtuze/gMY0NQYk+ kfo/N06+bgYXVsm/Jxh69oFj2vIdbulrrm1hpAA12zK7ArOu6Dhm2m2hrKHV2sseQ0EkV8NbP0eO yu2F77GU1/ScdY5j/eqnNTx5TD2hW+lLM2THMgwHCK1B0pZ9gB2jVx4A/itbo2K+ut9r+bNQE+J0 eikS8B7pmO3+1aLQANFsfCvhU8Mxmy+mQHpgPHu5vMcyJR4IbdSpOkkttqKSSSSUpJJJJSkkkklK SSSSUsksDreZksy/SrscxrWjRpIkn4Kh9vzoj7RZH9Yqjk+IwhOUOCR4TVtzHyM5wjMSA4tdXc6l 1evGDqq/ddHybPiubTmSZOpOpJTFZnM8xLNKzoB8odHl+XjhjQ1J+YrJJJKBnWSSSQSskkkklZMn TJJUUycpklLBxa7ewlrgdCNDK7Do+W7KwK7HmbBLXnzBXHq/0nqrsB7mvBdQ7UtbEg+IlXOR5gYs lSNQkNfA92pz3LnLjuIucTfiR2euWP1vrDsX9Wo/n3CS7s0f3qpk/We1w241Wz+W/U/cFjW3WX2u ttdvseZc5Wua+IRMOHCdTvLw8Grynw+fGJZo1Efo9z4sHOc5xc4y5xJJPclWul57sHKFoE1u9tg7 7fJVUq2F9ja2iXOIAHmdFmY5yjOMon1A6ebqZIRljlGQ9Nfg9+DIkd06ZogADsnXTPMqSSSSUpJJ JJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkkl KSSSSUpJJJJSkkkklKSSTJKXTSoXWtqrL3cBZYzcgWb90j908KDNzOPFICV69ujJDFKYJHR2Ex0C qV9Roc0b5Ye4IJ/EIz8mkNkvbHxT45schYkCFphIGiC499rrrXPd4wB4BDUnkFziOCTCZYMiTIkm ze7pRAAAArRZXum5QYTVY6G8tJ8fBUUyfhyyxTE4/UIyYxOPCXogZ1TrAoyLaH7mHTu08FbdVotr bY3hwkLX5fmo5gaFSG4aOXDLGReoOxSJJJKwxLQhZGOy6va6QZlrhyCO4RkyEoiQIIsFQNahznjK pk2MNrBqH18x5sJmfhKqv6pjs+k20HwNbx+ULbhItlUMnwyEjcZmPgRbNHMB80b8jX8XGx8ynJHs Ja79x42u+MKZV7LwMfLZttBkate3RzT4tKzrcDqlBjHe3JrGgFgh/wDnDQqjzHw7NDWA92P9Xf7G WE4S68B7SP8A3TJQKp3Z+XRlVYd2MG5GRPpMDx7o8wI+9WmYfVbjD2147TyZ3uHwjRUhynMTNRxy JGh0qmYjgAMjECQseoGx3FMLrWVN3PMBVzm1dmvPxELXxujY9T/Vtcb7f3n8D4NV702eA+5W8fwT JKN5MggewHF+OjGeZxxNCJn47PNsOXkPDaKtD+cf9Y/FavTultxj6tp3XHX4FaAaAnhXuU+E4cEh Mk5JjaxQH0YsvMymOGI4Inet/tUAnSSWk11JJJJKUkkkkpSSSSSlJJJJKUmJhOq2bl14lBts1HAA 7lNnIRiZE0IiymMTIgAWS8zm3uvyrLD3JA+A0CAnJkk+OqYrm5SMpGR1JNvQQiIxER0FKTFFoxr8 h4ZUwuJ1HYaeajdVZTYarW7Xt5CRhIDio8O19EicSeEEcW9dUaSSSauWSSTEgCSYA1J8AkBeg17J JoWsp01+raGbgwQ5xcZgBoLjx8FxmV1jNzrS71342NJ9JtI9xaDEuO4Lf6D0jKGVXkt6hflVvptL anA+7fS8NEFx8Vow+H445IY82eAnxCMscYzJvrHjqraufNzEeXOeOCYxyiZY8kjEA9jw3bd+3dFP /elV/mW/+QRra2tFb67G213MFlbwCAQZj6QB7LlR0Lrcf0DI/wC2n/3LqjVZTh4FVrDXYzFrD2OG 1wMu5BVv4r8N5XlsMZ4STIyo3K3N+FfE+a5nNKGYAREbFRrVwcf6wXOs3ZdDMfEIvcLvU3GMd/pu luwRr5qfSOpZltpq6htY/Ib9owxG0mpx+h/WZ3+KxL682vDNuTgtOPh/a7a3WyQ5zrhYz1K4aWjT TXVWun14dvUMagt6de17XXTiMh7HV7S2T6jv3lTnhxCE9K3+XWuDxv7XQhlymUde3zafN4fk6HVe sXYubj4uPVZc7+dyvSZvLahIAiR9Ip2fWCp99FP2TLY7IdtrL6wAe5M7uANVXdH2nOr6e1rMRrLX Z1rpJfeWQGN3H80ansodLsycbF6XY+oX4dtFdbXMZNtNjmj3SJJY7v4KP2ocA9PqA71Imr1/h2Xj JPiPq0J7WALrT+LY6h1TNodkW4TqMqqgBttZJD6n7mg7tu6RBJPEQsz/AJxdYY+0s+y5hMPbVQ57 yGiGkNc1gB8dTKt9WzLHW9QZiY9doqxhTkWlzaiw2ixxLnu+kGiNFi9Pfn49+AfTuLLKmHHqdmbG PewjUbtA0/uKbFhgcZJhG6G51Ol6sc8sxkFTlV60Nta00e4+KudGj9qY8ifcfyGFSYXFrS5u1xAL mzMHwV3o3/KmOP5R/IVS5f8An8f94fm3OY/mMn9w/k9qkkkujebUkkkkpSSSSSlJJJJKUkkkkpSS SSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJiq p6hSCQQ7QxMJk8sIVxyEb7pjEy2FttMSqzc/Hd32/EKb7mOqea3AkNJEHyQGaBBMZCVDungkDRBD S6heHvFbDIb9L4qolKRWJlyHJMzPV0McBCIiFkxCdIqNeskkkglZJJJJTFbHTbGvxg0H3MkEfOVj q90g/pnjsW/kKt8hPhzAfvgj9rDzMbx3+6bdVOkktlz1JJJJKUkkkkpSYhOkkp5nrf8A4quj/wBr +K6QDVc31z/xVdH/ALX8V0oUOL5sv9/9gbXNfzfLf7L/ALuSgnSSUzVUkkkkpSSSSSlJJJJKUkkk kpSSSSSlJJJJKUqnUcI5mMagYcCHNJ4kK2kmzhGcTGQsSFFMZGMhIaEGw4eH0BwcTlkOA+i1pMH4 8ImR9Xqnumh5rH7p1H962ElB9ywcPDwX49ftZjzefi4uMjw6fY18TGGNjspndsEE+PdB6h0yrMZJ 9toHtePyFGyszHxRuueG+A5J+AVQde6eeXOb8Wn+COSXLiPtTlECvlKMcc3F7kBK7+YB5/JxbsW3 07mweQeQR5FCWr1nqGJlMYyk73NMl0EQI41WUsTmIQhklGEuKPQuzy85zxiU48Muo/ash5P9Ht/q O/IiIWR/MW/1HfkTcP8AOw/vR/NkyfJL+6Xh6X1/Y8UFklocXOn6Q3u9q3KvrDazKqqpqFeONrA3 UPAIjQypfVvDxcjo1Dr6m2FrnwXCfzitc4WIbxkek31Rw+NdFa56cfvWcEE1kyf9JtcnzOA8ly+P JjM+DCI6nSyA2PXv/wBI/wDzisjMseOp0XtyX2B1wpvZ6m4Nlh21+kNOfcXH3D4LUQ/s2P6/2j0m euBt9XaN8eG7mFHy3MDFKZncxKEocO4PEK1tqTxA1wgRIIN+XktkUU5FT6b2CyqwQ9p4I8ENmBh1 2NtroYyxgLWuaA0gO5GnwVkplXE5AUCQO3mycESbI1Q5GNTk0upvYLK3xvaeDHw+ClVTXVU2qtoY xgDWtboABwAppBwPBnshxGqs1vXRPCLvrW7WuwMO4zbRW87g8lzQZc3gnTVSvxsfJr9PIrbbXIOx 4BGnCMpUUuyL66GFvqWGGBxAmBPdOiZyIiCSegv8kSEIgyNAdSiEcaLU+rbWu6lLuWscW/HQfkK1 6vq7g/ZmV2t3Wge61pIJKtYXS8TB3Glp3O5c4yY8FocvyGWGWE5VUdTrq53MfEMU8U4RErl6R282 6kkktZylJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkmkJKXSUQ9 pJAIkcjwlPISUukol7QJJgDun3DxSUukmkJSElLpJpCUhJS6SaQlISUukkkkpYrHyCDc+OJK1ysj IAFzwPEqh8R+SHmWxyvzHyRlNqOE5TLMshtrJFOmKCVkikkUkrJJJIJWSSSSUtBJgak6QtbAwzRL 3/TcOPBZLSWuDh2M/ct3HyKr27qz8QeQr/w+OMzlIn1j5QWtzcpAAD5TuUoTppSWq0l0kkklKSSS SUpJJJJTzPXP/FV0f+1/FdKFzXXP/FV0f+1/FdKFDi+bL/f/AGBtc1/N8t/sv+7kukkkpmqpJJJJ SkkkklKSSSSUpJJJJSkkkklKSSSSUpJMU0pKXJAErFyvrAG2FmPWHgab3HT5BWup9RpopfWHbrXt IAHbzK5pZvPc5KBEMUh/WI38m/yXKxmDPJE1+iD1Z3XPutdbYZe4yf7kMp0xWUSSSSbJdSIAAAFA LJJJIJWULGB7HM43gtn46KaUBGMjEgjcaqIsEHro810TqVHTan9M6gfs9lDyWOcDDgT8Fqft7o// AHLZ+P8AcrOThYmVH2mllu36O9oMfBA/YnSf+4lX+aFeyZ+RzTllyQzQyZDxTGOUTDiO5Fhqwxc1 jiIQljlCIqJmJA140x/bnSCYGUwk8DX+5J3W+lN+lksE8Tu/uVHNw+mNLsarD9Cx5FdWVsDWeo4b gwGd2o0kNjzlCxulU4ePdk9VpZYxsbGEB5mY07apTw8pAwJjnEJixcocRvbhoNrDjy5MGQ+5i9+M hCGMCWt/W3Yo6z037Ll5FPp5j8djXekS4CHWMrkxH7yrD62VlwB6bT/n2f8AklDpY6PnYubj49Qw rLWMaXhk6Cxtn5pH7irY/SMC7LtxmZ5NuOQbAaHAa+B3rX5CPwz2JccRcCSfeAMog7WR0svP/FYf FsfN8EeONgCsZPCTVmr8Hd6rdjYORcbXCqllha0mSOYA7rlMTq9VeNZj42TVQb8rIPrWbiWNLyWu YwN9xI4107rr8u1tuVbaydr3lw8YJXK4eLn5+PfU2t2G2vKuyMfIeYeLvUJZDB+aASHTysXD7VTJ GgmOorrWlOxk9z9XW/BtWvS7PRv0ZXTh0yyjFyX2Nx6tjrGl7rRv03TtcZnwGngubbk3jqNNv23J 9LCDrH3erke15G2Gv+y7mENJJ9vC6ig9RzMazHza3YVrNrTdS9pDz+c6skEgH71zjMXLxr8mrHpv NTcizY4NyXSJ+kXVX1gnzhT8oYxM7Pqu/mEt+t0GLmRKUYivTR6EbdKfSvqRlV3Y1zftmRm2OLbQ 6911rRW4Q307MjHx+ddACupXGf4tcIU9Fps9XIDw0ssxLHk0sJeXbmVvktJ+K7NakZAiwbDkyiYk giiFJJJpCKF0k0pSElLpJpCUhJS6SSSSlJJJJKUkkmkJKXSSSSUpJJJJSkkkklKSSSSUpJJJJSl5 19YM/Mx8/qLicuw35wwenmrMvqrbkPqxnV1PqqewBh3vduB7QvRV599YuhdZfm9TyH9NGf097rb6 QMn03NLqaazYyttL3m1vo+wz34SUiwD9bLOs59mC9uFl5Dcd5xcmoPeMVj34tTn2utndFb3kbTz5 re+smScfNpuuwb31sAox8qm4NreclzKH1XVyNJeHDQ/R7LLxB9YxlM+t7MN7nXxjWdMcZvOANhrs 7AXb5cWnsYVn62P6y/Nufj4Vl1dGF6WCGt37szLsbWHu2kgeiGTJ4SU8lX9aRd0J2DYx4r/ZDsGz dZLfWGO7IZdtiDvAA8V2Fv69nZn23MyMXpfRsOhzqcV76i572OufY51MPdta0ANCqdX+q5xek5Nd eGy9lPRRjse1jXPdlVjY1wYBuL9vDoW5Z9XrbcqrquBm29OzXY9dF4a1r67GN9zfUqsH0mzoZBSU 8tkdQoyR0YfaupdZwX/bwDhi6rJeK31CsXBrqnONYO0uPK3eq9RrwPqnTTiOyMO/qLm4eEMtzvtF dl7iC6x1jnOBY2XSTpCLX9Uc2h2NfjdUNeZj2Zdj7zQxwec17bbPZuAEFuitX/Vpufk4GR1e5uee nttit1TW12WWwN72e4e1ogD5pKeazeo5df8Ai+6vh/bH2Z3SLPshzGPO9zPVrdVZvaZ91TwDr4qx T1bKybukdHzb3jqOHmvxOpBjnMNrDi5Dq7vaQdtjYd/W+C0up/UbEzDmsxbRgY3UceujIxqa2hhf VZ6jLQBtG6Parub9VsHL67gddk1ZmBuaS0CLGOY5ga7+ruJBSU5XS+hYg+s3UqfXzHV4AxLcdj8z JcA54sc7cHW+4EtGjpQrcezF+sOBjU9QyMzrd17r8473ilmD7iWPx97q2DVrWaSTqumxultx+p5v URYXOzm0tLIgN9EPA17zvWT0v6r9T6bmXZFfVQ8ZV/r5QdjM32SdWG0uLgA32t8ElN/q31j6b0ey uvMc5rrQXN2tLtAdeFR/5/fV3/SWf9tuW7Zj1WEGxjXkcbgD+VROHigT6Nf+Y3+5PEsQHqjIn+9X 7GKUc1+mcQOlxv8Aa4Z+vv1ej+cs/wC23LOf9cOjPeXb3+4k/QK2surGst9lTA1ughoQfs2P/o2f 5oWdzPNcpklwyxZCIHQjINf+a2cWHmoixlgLH+bP/fOT/wA7ujfvv/zCm/529G/ff/mFa32bH/0T P80Jvs2P/omf5oVb3OS/zOX/AMNH/esvBzf+dx/+Fn/vnK/529G/ff8A5hS/529H/ff/AJhWr9mx /wDRM+4Jvs2P/omf5oS9zkv8zl/8NH/ep4Ob/wA7j/8ACz/3zlf87Oj/AL7/APMKX/Ozo/77/wDM K1fs2P8A6Jn+aExx8f8A0bP80Je5yP8Amcv/AIaP+9Twc5/ncf8A4Wf++cv/AJ2dH/ff/mFN/wA6 +j/vv/zCtX7Pj/6Jn+aEvs+P/omf5oQ9zkf8zl/8NH/ep4Oc/wA7j/8ACz/3zlf86+kfvv8A8wpv +dfSP33/AOYVq/Zsf/Rs/wA0JfZ6P9Gz/NCXucj/AJnL/wCGj/vVcHOf57H/AOFH/vnK/wCdXSP3 3/5hSb9a+ktMtseD4hpWn9no/wBG3/NCX2ej/Rt/zQkMvJA2MOUeWYf96r2+cO+XEf8AqR/75q1f XvBr0NjrB/KYfyqwz/GD0mYeHx4taf7k/wBno/0bP80JfZ6P9Gz/ADQp4c/gjoIZjXfKD/3DHLlO Yl/lMQ8sZ/75L/z++rv+ks/7bcn/AOf31d/0ln/bbk2Masd2tNb2HlpaPw0WtQ3p14muque7Sxs/ dCvYOc5XKNIyjL90z/sa2Xluax7ziR34D/Fyv+f31d/0ln/bbkv+f31d/wBJZ/225bf2PF/0Nf8A mN/uT/YsX/Q1/wCY3+5WOLD+5L/H/sYuHP8A5yH+If4uH/z++rv+ks/7bcl/z++rv+ks/wC23Lc+ xYv+hr/zG/3JvsWL/oa/8xv9yXFh/cl/j/2K4c/+ch/iH+LxnUvrN0rK63gZ9T3mjEn1SWEHXwHd a/8Az++rv+ks/wC23IPWqKW/WfpLG1sDXbtzQ0AH4hdH9ixf9DX/AJjf7lBhOLiy3GXz6erwHg2+ bjm9vlanEfqdfT/Xl4uH/wA/vq7/AKSz/ttyX/P76u/6Sz/tty3PsWL/AKGv/Mb/AHJfYsX/AENf +Y3+5T8WH9yX+P8A2NThz/5yH+If4uH/AM/vq7/pLP8AttyX/P76u/6Sz/tty3PsWL/oa/8AMb/c l9ixf9DX/mN/uS4sP7kv8f8AsVw5/wDOQ/xD/Fw/+f31d/0ln/bbkv8An99Xf9JZ/wBtuW59ixf9 DX/mN/uS+xYv+hr/AMxv9yXFh/cl/j/2K4c/+ch/iH+Lh/8AP76u/wCks/7bcjY311+r2RYK25Pp udx6jXMH+cRtH3rW+xYv+hr/AMxv9yr5nQ+lZtZryMWpwd3DQ1w+DmwQleH92Q8eK/2KrONeKEvD hI/a3K7G2ND2EOa7VrhqCPIqa4vMws36nvGb09zsnpljgMjGsMlknRzSPy/euuxMujMx68nHdvqt aHMcPAps8fCBIHiidj/FdjycRMZDhnHeO+ncFKhZGVRjMNmRYyqsfnPcGj7ys/6xdcr6Ng+tt9S+ w7KKvF3n5BZGD9UreoEdR+sNr78iz3DGBLWMB12nv8h+KMYDh45nhj07nyRPKeLghHil1s0B5uhZ 9dvq5W8sOXuI0lrLHD7w2FD/AJ9fVv8A7ku/7as/8gsq/EwPWeKsaplbTta1rGxA08NUbHsx6Whh xMewDjfW0n74VEfE+U4jGUMgA/SsG/pTbPw/m+ESjPGSf0aOn4ty769/V8VONV5e+Pa307Br82rG s+uFL3Fxy3ifzWteAPhoj5FePkWb3Y9LNIDWVtAQvseL/oa/80f3Kvn57lsh+XMAP3cgjf4M+Hku agNZYST+9Ayr8WoevdMOvqkk8+x/9yb9vdL/ANKf8x39yufY8X/Q1/5o/uTHExf9DX/mj+5VjPkf 83m/8Mj/AAbIhzw2yYf8SX8Wp+3emf6U/wCY7+5N+3emf6U/5jv7lb+yYv8Aoa/80f3JHFxf9DX/ AJo/uQ4+R/zeb/Hj/BPDz3+cw/4kv4tT9u9M/wBKf8x39yX7d6Z/pT/mO/uVr7Jjf6Gv/NH9yRxM b/Q1/wCaEuPkf83m/wAeP8E8HP8A+cw/4kv4tT9udN/0v/Rd/cl+2+m/6X/ou/uVr7Ji/wChr/zG /wByb7Ji/wChr/zG/wByXFyH+bzf48f4J4ef/wA5h/xJfxav7b6b/pf+i7+5L9t9N/0p/wA139ys /Zcb/Q1/5jf7kvsmN/oa/wDMb/clxch/m83+PH+CuHn/APOYf8SX8XDszm29XblWvrsxKY+zs3WN LCRD7Cz0SHO8Pdor2T1LpOTQ+i2wljxBhrp+PCu/Zcb/AENf+Y3+5L7Ji/6Gv/Mb/cps3Ncnl9sH Flj7UBCPDMAUPCt+p7ox4ufxkyjlxWZcV8Erv7XKwLujYIeKrnOc+NznNMwOBo1VOndQxGda6hc9 5Fdu3Ydp1/Bb5xMX/RM/zG/3LF6ZRS7r3UWFjS1u2GkAgfBS8vPlDg5siGWvbjxXMWRxx20Wcyef nmwyyZcUpmZ4TwS34Tvr2dH9s9OP+F/6Lv7kv2x07U+qZP8AJd/crH2TG/0TP80JfZcb/RM/zQqn HyH+bzf48f4M3Bz/APnMP+JL+LW/bHTv9If8139yb9r9P/0pH9l39ys/ZcbtSz/NCs9R6RRg2V1u rYXOrD3e0aEzoNER9yMTIY81Rqzxx6/RafvwkIHLh4pWQPbl0+rLoP1o6Vh3Wi+4tqe0Gdjz7mny afFbX/Pj6tf9yj/23Z/5BV/q50XCsY/KuoqeCdjGuY0jTUnULb/Y/S/+4eP/ANtM/wDIrY5T2fYh UcgHTikCacjm/vBzzueMkaHhiQL+1bpvVsLqlDsjCs9SpriwuLXN9wAPDwPFcL9ZvrH9aOn9Uuyq nhtXTjZFLMbKdTdW6HNF1kGqWiPcCO69AqxsfFrLaK2VMJktraGiT3gDyXlvVemnrVtuD0UY3Us3 Je45N9VGXTTVJLnuffblvrmdNoYVIavTbxWRuhxb9aeh+pfUvrFZmfYcyz16XG3Ivuvxsuqz3HRl b7w2sAOcIaBxKDn9WzcWnqWfbm3enj5eWxtIyqsc+nRtLWVMfRYXn3eKr/Vt/TqOt4rH2UYfU5LX YL8TMruktLXtrfZlW1EfyoKr5ubkWjrnSWA/Z8jLy632DAyMpzTYdriy2pwYD8kEulT1LqbOqdG2 Zz7KMvLfRcxuTVlMc1tLrILq6a9pBhbV31gb0zI67ldQe92D0045YxgBLRZW0u2jSZc5cf0265nX Oi4lr7bGnqN2RX6mJfihnq1WbmB2QXbhPAmQup699Wc/qOF9YKKH1B/VhjjH3kgN9FrGu3w0x9HS JSUtkf4wOns6dm5lOHlutwWMtfjW1Opea7Nwbb7/AMz2/SVzL+uPTsOrHdfRlC7IpOScZlDn21VN 0c+5rfogFV+vfVvN6m/qBpsrYMvpYwa95Mi0WPsl0NPt9wWZ1j6o9a6rbj9RyKOnX5xxvsuRRc64 0s2ve+u2l7QHEw/3NcElOyPrt0d+ecGgXZDhQ3KNtVZdUKXVm5ry8cS0d+6bpn146N1F4YG34ofS 7JpflVOqZZXWN1jq3HRwaOVW6X9VMrp93VNr6jTmYOPh44aCyH01PrcXMg7Wku0glDyfqfmZeL0P FttYyvp3T8jBzHNJJLr8ZmNuq9uoBaTrCSm1/wA+umvxsq2rGyvWx8c5deNbS6p91IMepVv5aCdT 2CQy+ode6X0/qmNkP6JgW1OvzS4M+0AAewMNrHsDOXbo1EeKzejfUrNxvtZyKMDEdbh2YlTsQWvc 91og2vdb9EafREofUPq19bMvoXSOlFuDYzp8DLofZaKrhS1rMeS1m4jTc5vikp3PqT1DqPUug15f UHGx77LBTe5gqdbS1xFdhYIA3BbyodF/bH2OOsMxq8kOIa3ELzWKwBt/nADPKvpKUkkkkpSSSSSl JJJJKUkkkkpSaAnSSUttCUBOkkpaAknUXODQSeBqUrrUqZJpCpPznE+wADxKE7Kvd+dHwVWXPYRY FyrsyjDM+DpSEpCzaLiy4OeSQdD3RMrK3ANqPxISjzuM4zM6Efo3qo4ZcVfj0bj7GMEuMBDbl0OM bwPjp+VZpc52jiT8SmIVeXxCXF6Yjh8WQcuK1OrpuzMdv54Pw1/Iq2Rmh7SysaHlxVRJRZOdyzBG kQd63XxwQBB3WTJ0xVRmCimTlMklSYp0xSSskUkiglZJJJBKySSSSmKSSSSVkkkkkrFOx5re17TB aZCYpIxJBBGhCiLFHq9HW8PYHDhwkfNTWZ0i97mupdqGQW/ArTW/hyDJjjMdQ5OSHBIxPQqSSSUi 15nrn/iq6P8A2v4rpQua65/4quj/ANr+K6UKHF82X+/+wNrmv5vlv9l/3cl0kklM1VJJJJKUkkkk pSZJDyL68el91phjBJKSCQBZ0AXuqrurdXa0OY8FrmnggiCFzH1NL8LI6l0Sw64lu+mdSWP7/gD8 1ZH1qsJMYunaX9v8xVKeo49XUrup14h+05DAyw+qY2jbGm3+SFNGMhCcSPmojzDUlzGIzhMS+Wwf IrYtY6v9dMq64b6OltDKWngPOk/fuK6yNIXJYXU6On5GVk0Yh9TMf6lxdaTJknT2afSW7hdZx8nE dkP/AERrMWsmY8OwmU3P3OkIgDXt1X8tkhI8MTxZJkyPi4ubjOxsh9ZHtmWHxBVeQrvUeoHMeA1u 2pn0Z5PxXLfWm670sTDpeazmXCt7hp7dGxp5uXPQwQzcz7eOdQJkeIjaMRxE+L0XvTx4OOcbkABw +J0Dff1vo7HFjsykOHI3AqP7e6N/3Mq/zgh1fVzo1dYZ9la6BG50knzMqf7A6N/3Er+5Pr4f35g/ SA/aoHm+2IfWSv290b/uZV/nBL9vdG/7mVf5wS/YHRv+4lf3Jj0Do3/cSv7kP+Dv/Kj7IfxT/TP9 T/zlft7o3/cyr/OSPXej/wDcyr/OUXdC6OOMSv7lnH/mwcC/NZiscMcONlLmllgczlha7unRx8jL 5RzJ1raHXZBnzUdzhHnxOl+3ej/9y6v85L9u9H/7l1f5yEzpHQ7G7mY1ToG4gamD8Cs71/qqGtfZ iGpjq22sc6l/ua9wYwtDQSZJRGLkpXUeaNeEEHLzIq5YBfjJ1f250j/uXV/nI2V1bpmLg4uUGPy2 5RsAdVY1rR6bg3ux3isZ7/qq0lpxi2wNLxW6i2skAgaeo1o7hFudhdU6Xj1YJrwq+neqbm3u2NAt cHBzSN08aq1yOD4fLOIzjlqQ/wAvQj4Vw62wc/8A6RHKSz4RExhIAzw3KvO3RwOtdNzb3UjHtoiu yz1XWtc0CtjrDI9Nv7vih/tvpA/7WVf5wQeidGNN4yrbse7FfTaz9G8u3CytzBHtHMog6D0j/uKz 8f70viOL4bjyiMeMCv8AIcMhfW+I7sfwzL8QyYiclGV/5awa8KC/7b6R/wBy6v8AOCX7a6T/ANy6 v84Jv2F0j/uKz8U37C6R/wBxWfj/AHqjXw7vzP2Q/i6H9M/1P/OU/rnSGgk5dengZP3CSqHQd2Tn Z3UQ0im9wbUSI3AE6/kV/wDYfSQZGLXPwn8quMY2toYwBrQIa0CAB8AjLPy2PDkxcvHIZZuGM55e HSMTxUBHxCo4c88sJ5jCsVmMcd7kVra6RIHJSVrpjsNuV+ut3VuEAHUBxI1MKnjjxzEbEeI1Z2DZ yT4IGVGXCLobpei4Jy8sPI/RUEOf5nsF0Ob0nEzXB9zXbw3aHAkaKzRRTSzZUwMb4NAH5EVb2DlI Y8XtyAnZuVjdws/NzyZfciTChUaOzXwsOvDx20VyWtky7nUyrCSSsACIAAoDQBrkkkkmydSVkto8 E6SKGJa0kEgEjhOGgcCJTpJKYurrcQXNDi0y0kTB8k8J0klLQEoCdJJS0BKE6SSloCSdJJSkkkkl KSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklLFUsx9odtmGEK6Vn5Be65zTJjgKpzsiMYAu5Hp+1kw i5dNEJTJz5pllNsKKZOUyCVJk6ZJKySSSSlkxTpikkKKZOUyCVJinTFJKyRSSKCVkkkkErJJJJKY pJJJJWSSSSSsUkikklJjZT8aze0TIgt8Veb1kfnVEfAz/BZhTFTY+ay4xwxlQ7UCxTwY5myNe9u9 V1HEsGlgafB2n5UcPa4S0gg9wuZKQJHBP3q1D4nL9KAPkWGXIj9GX2svrA4VfWTo9z9Ky5zd3mSB /wB+XSBwXH9Rwm51IY5xa9p3MfzBVNtv1jx/YNuSG8WTBP8A0mpQ+ICJmeD5jxb+FNiXJe9jxAZI xliiYET0vUkEE+b3o5UlxFXW/rXUZFDHgfmvII/6tXKetfW+8E1YNDo5G4A/cbVZx89inoBLi7cN /k15/DcsdTkw13OWI/MvVpLmf2h9dv8Ayup/zm/+lUv2h9dv/K6n/Ob/AOlVL94j+5k/8Lks+4z/ AM7g/wDD4fxemSXM/tD67f8AldT/AJzf/SqR6j9dv/K+n/Ob/wClUvvEf3Z/4hV9xn/ncH/h8P4v SkwuK+uf1u6fh5A6aXPse07rK6RvdxIkaaD4rRPWeu4+Pa7qlFeO5w24zWauLjy7R7hDQvP7rrek /Wq7qmVRddjZNcMtraXw6GfDX2H71d5OAyXMg7XGJ9JJc3m6E5cvxCZEeKXtyBB/qiTru+snRqcB mf6jn0WP9L2NlzX7S6HNMRoFdf1Xp7MzEww4vszm78dzBLC3UzunyXLdaN/UOg0WM6YcJr80EMa3 3PaWPmxzWtEc8p8XoXU+m/WzB6fYXW4tDnnFyA0wK7A52p4EOmfNXPZx0TdEcZq+2zXjy0K7H1dX ZzfrT0bGvfRusvNJi59LN7GHjV0hWq/rF0/BvxA5zrKOqexmwSHNJa2deCC5ctjW5nRemZnRrqr8 bN9c2NuroFzbmbdnp+8gQeZRM6vqNn/NyzMrf9oFjjfLNu39LXt3BoAb7UpcvjkDE/KRIb/MKUMU cc4ziTExJIN9hYe7vq9KwtBDm8teOHNPBC536zf03pH/AIZH5WLoMSxuRQcYz69Mup8XM5cz4jlc 99Zv6Z0j/wAMj/qmLmsXLHBz0oH5fbzGJ8OCTuw5qPM8nDIN+PGJjtLiDv8AdJLuksp1AsmKdIpJ Q5VQvospL3Vh7SC9jtrmz+c13Yrk+qY+HZ0SvPucc3Ky6K8fF9djQ8kvdYbBAMENcZPgury6PtGN bQHmo2sLPUb9ISI0lZzOgj1nPvuNrK6fs+DXtAFDCzY4jX3OPirPL5YwFmVVK66kebXzYzI6C7FX 2YdFxMI0DquLS3F+247N1FYAY2NzpENEn3Lmn2gYlNddzb32Y+AQOfRNVjG+m4NP5xfu8V0vS+h5 eA5gtz3ZFVNPoVVNZ6bAOznDcdxCT/q5jP6VXgEtY8CkXXsZDrPR2xuIIOu3xUsc+OMpXPjuQ1Hb 69lksU5AVHhoHTxaebjZGT9YMTHz3VuFmNcB6LXNiHM197n91LqOJjdL6dbSzdY7M9jnkgQBrpor 1PQMLH6jVnY+6s1VvYay5z92+NZe4xws3qF11rM2p9n2uvEq3vtLQ1td86Vs2cw36QJPxTuWxTzz icMxH2RA+oGOvFQ2BG5G5bOLmI4IShzAlLBklKU4RN2K+h6Op0J7X9Loa0H9GPT1/krQVHokfsnG IAG5gcY8TqVeVHNfu5BLU8Ur87ZbxnXEOHGdYRPSPQLJk6ZRpUUmVussZWzVzyGj56Jitf6vYL7L /tT2kMr/AJskaFx7j4Kbl8Ry5IwHU6+AYuYyjFjlM9Bp4lvXfVzEsraK3Gp7QAXDWfiCh0fViqu5 tllxsa0zsiJjzlbY4SW39zwcQl7YsOIOb5jhMfcNFQEJ0klYYFJJJJKUkkkkpSSSSSlJJJJKUkkk kpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpZNtEz38VJMXACToga69FOfm CLviAgI2S9r7SWmRESgrEz17s624i3cfyjyUUycplEvUmTpkkrJJKL7GVgF7g0EhonxcYA+9IAnQ aqXTFOhVZOPd/M2ts5+iQfonafxR4SQSASBuUpCmTWWV1gF7g3cQ1smJcdAE6aQd+6VLnfrf1DqW FXR9kcaqnl3qWtGsiNrZ7LoGWV2ND63BzTIBBnUGCPlCRAIgiQj8p1G3Qs3LZY4ssckoDLGP6Mti 0OhZGVk9Louy/wCfcDuJEEiTtJHm2FfKFbjVvd6jSarf9IzQ/PsfmoG6+nS9m9n+lrE/5zOfulO4 BL5Tr+6dD9O7Fly3klIw4IykSOHWIB6eH5J0lFj2WND2ODmnggyFJRkUaKQQdQskkkglikkkklZJ JJJKxSSKSSVikkUkFMUkkkEqUVJMikLJNc5jtzXFrhwRokmSuk1e7ao6nl1OBc82N7td/fytGjrO PYQx4NbjprqJ+KxE0Kxi53Nj04uIdpasGTlcc9a4T3i9RbdXUw2WODWjklZOX1p7jtxhtA5e4an4 BZ77rrGtY95c1vAJmEOFLn+IZJ6Y/QO/VZh5KMdZ+o9uiWyc5rqL3F1jjNDz+a/w+DuFnVB1byxw LXgwQdCCOxVw9k2cz1a/toP6QQ3IHn+a/wCfBVz4VzfEDgyGzvAn8Q5vxnkgK5nGNtMgH4F5Sz64 5x6jdViuxKaaLRTsyXOa+2CQ5wcNGjTutiz6x9T/AOczuiUCllTsY2Me9riRZs3DcQ8S3d4Bc7lf VfqNjs6jHOO7Hz7W2+rZuFle1xdAhp8Vp/sfqFPX29VodU9lWKKKw9xDi9texpdDTpPmt6ccHTh+ U156NHjxAekj5dGtb9des69LdisHXBkekaw13o7D+cPfP48aroXbxW0WFpsgby0QCY1jmFyr/qt1 Yj9onKb+2zf6pt3EV7IjaIb/AAiNF1WM19rDdkNllDPUyG1yePzG+JcdAmZfbiAYVp83n/BhzcMz GOOiZWDW9/wbGJW3Hx/XI/WLxFfbbXw4/F3HwXP/AFm/pnSP/DI/KxXLuv5FtheenXAcNaAQA0aA D29gsXrvUbL8npznY1lRqvDgHTLjLNBoFkQwc1k5yWWcQIiGWMfXHYwIGluziy8th5WOGEjxcUJS JhLUggnWnrElk/tu/wD7gXfcf/IpftvI/wC4N33H/wAis3/RnNfuR/8ADI/xdD/SfK/vH/wuX8HV TFZf7byP+4F33H/yKY9ayP8AuDd9x/8AIpf6M5r9yP8A4ZH+Kv8ASfK/vn/wuX8HVTFZX7av/wC4 F33H/wAil+2r/wDuDd9x/wDIpf6M5r9wf+GR/in/AEnyv75/8Ll/B1Ell/tq7/uDd9x/8il+2b/+ 4N33H/yKH+jOb/cj/wCGR/in/SfK/vy/8Ll/B0zqsXqPTMPB6RmfZQ9gNbvY62x7dTuJ2ve5s+cI 37Zv/wC4N33H/wAioZ/Ub3dGzW2dNyALqixl5adjAeXE7IVvkeR52GaABMMZnCWQDIOGXCdLAOrB zPxHlJYpCzKZjKMbgR82mhIdboXR8x31ew8pm1zTS1wYCd0R8EyXQPrVlYnQ8PHb0nJuZTS1ouaH bXAD6QOwhZ1nWrn2veMG0Bzi4CDpJn91Hn/hWT3DLEPmlIyEpx+3UreT+Kw4eHKflAAIhL7NA6CS AP2y4Bw6XfB1B07per1Sh7LLuk5Dqw4bmgTI5I0B5VUfCecJA9sD/Dj/ABbJ+LcmATxk/wCBL+Dv dI6MLwMnKE1H6Ffj5nyXRMY1jQ1ohrRAA4AC5cfXHNGg6HliOPa7/wBJp/8Annnf+UmX9zv/AEmt jB8PlhiIxiPE2LP4uPn+IRzTMpSPgKNB6lKVy3/PTL/8pcv/ADXf+QS/56Zf/lLl/wCa7/yCm+75 e3/ODF95xdz/AIp/g9TKUrlv+emX/wCUuX/mu/8AIJf89Mv/AMpcv/Nd/wCQS+75e3/OCvvOLuf8 U/weplKVy3/PTL/8pcv/ADXf+QS/56Zf/lLl/wCa7/yCX3fL2/5wV95xdz/in+D1MpSuW/56Zf8A 5S5f+a7/AMgl/wA9Mv8A8pcv/Nd/5BL7vl7f84K+84u5/wAU/wAHqVXy+o4GEGnNyasYPnYbrG1z HMbyFT6L1i3qjLXWYluGaiAG3AgunuJAVP622YlH7NtzcPHzMWzLbi2+vWLHVi8FrX17tB7w3d5K OUTE0dwyxkJAEbF0P+cf1f8A/LPE/wC36/8AySu03031Nuoe22p4lljCHNcPEEaFeX4eP0vC6fgZ f7Pxci93RGurrtqY5tmTZfVVUX6akufE8ruc3pvXPseHj9GzMfpPoM23VsxxbUdGw2trnN2taQUE uhV1PDt6hf05j5y8ZjLLa4Ihtk7DuIgzB4Vpzg0EnQDleY9IP1pyvrf1OqrrFVd5b6H2w4rXMuOH t9RjGb/aazfrrqul+sOX1DpH1PyG9SzRkZ15+zNyq6tmt7tgIqZu+gwk6eCSnpG5eM7G+1NtYcfa XesHAs2jk7hpChjdRwcskYuRVkFurhU9r4HntJXnvTOq9NH1c+sv1d6e978TCxL78B1gexxotrcX Ni1rXeywnWO60Pqn0DJGV0rqtXT6OkY9GGW5D6ntc/L9VjNpe1jWgAEbtdZSU9uMik3GgPb6obvN e4bg0mN23mJCZuRS+x9THtfZVAsY1wLmkiRuA4kLy/F+s+A760V/WV+Q6t92W/CfSa7BWOnua2ul 5sLdmlrd517rSuvu6N9Zut/WSoPtxqsqnG6nS3X9Xdj0llzR41PMn+SSkp7+m+nIr9Sl7bWSRuY4 OEgwRI8CiLmP8XDmu+q1TmkFrsjKLSOCDfZqunSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUsg ZjXGrTXXVWExTMkBOEoHTiFJiaIPZyUyu5WO0tL2/SHPmqSxs2GWKXCfoR1DchMSFhRTJymUS9SZ OmSSssvqbd+TW4UNu9Kuxv6SuxzQ55rLXDbU8GNq1EipMOT25idXQI3rfRBFinDxxZZ0jIw2MDPR a4Oc1zmCXh1jobsDhG7j8Vn9OpyKs/GsaSfVcdrXS1pArdoYnSBPC6dmNj1MdXXW1jHkl7WgAEu5 JjxUGYWHU9r66K2Pb9FzWNBHbQgK9H4hCMc8RA1m4t+8o0Sfrros9skx1+VyesVX32VfZbHsa25o Li47TZMBrR4DuR/ejXurdgW2OxzaaQ82tyS4lrg3UMJa7d5bVqPrY+N7Q7aQ5siYI4KZ9ddm3e0O 2nc2RMEd1AOcHDigYmsRvQ0T5kbr+DUm93H6Zivxs6yn0abHMayx98bHt9QOG1rQ1wP0T3C2SmFb A91gaA94Ac6NSGzAPwlOVDzOc5p8ZFHhiD5ga/yC6EeEUskUkioF6B+KwuNlZNVp5czv/WbwVD17 qdMlo2j/AA1clv8AabqW/j8VZSTvcvSQ4h+I8is9vW4HgPhsfMMWva9ocwhzTqCDIKdBfitBL6XG mw6kt+iT/KbwfyqP2h9WmS3aP9K2Sz592/P70eAS+Q8X9X9L+1PGY/OOH+t+j/YmSSBDhLTIOoIS UbIFkkkkkrFJIpJJWKSRSQUxSSSQSpMoZF7MfHsyHgllTHPcG8w0SYmFRf1hg9rKnbwXBweQ2Npe D9HeT9AxAU2Lls2UXjjxC6uwPzQZxjuXQTKnldTrourphpL+S54ZAifo6u/BJnUmPY9zanNe1jHh jy1u4WTtAIc4SY7o/dM/DGfB6ZVRsdTX5p9yNkXs3EypUdUZfkCplb/TcCWWbXQ6C0T9GANeZQbO uUtde1rJdTO0bgN0Eg/AaaJ45DmTLhGM2ACdtATSvdhV26aZQpuZezeziYIkEgj+qSo5ORXjUWX2 fQrBcY50VaUTGRiRRBqmSI4iBHXi2SFSqe1jjvG6t4LbG+LTysrpXXaepWvpFZqsYNwBMgtmJmB4 rTKMZSxzEhpKOoXZ+XlHixZY1Y1B7FcYfTBxbf8A5rf701lXS663PNl5DRJAY2f+qTFMRIVz/SvM 9x9jmS+DcpwmoEHoSTVoa7uiXEt9e9nhuawT8PcjWW4ldTaMZ59Od73PIDnO8wDwAqVvSqXuLmON ZPYCQqt+DTjUuuyMgV1MEucW6D8UMvO5s8fbMtJEaRjv4aNTBymblZcY5aE5R/T9wCNeRdP1Kzpv bPxCo9e6Hn5OV091IrIxr99021tLWyzsX+Swz1rooft9ew66EVc/e4FQ6/8A8t53nfZ/1S0fhfwv J7kpZRPFLhIjxCrEgYn7LWc58VyiABxw+YbTEvl16PT25mLVlfZHWA3SGktBczeRuDPVbLN0a7d0 p6svGuutoqeH2Y5AuaPzS7gE8dlyWHiddza2Mx91OFTk767W+mR6xY0Fzw6wO9oiIaVbw/q917Gy Mj0c1tDH7D6jWNh59xPtHEE9+U3nPhXI4fciObjDJGEZRjOXF6jIA3wRP6J+Ua/Y6HKc9ny44T9k yEtzCq26WXp0xWG/F+uOAG3hp6nj6FzW1kPjxG1sn8VvCnI9IXOpsYwgGXMLYnxkaLLz8pLFGMxK OWErqeOyNNwQQCG5i5mMyY0YSjvGVddqrQsCkVXv6jgUWenfk002QDsssa0weDDios6n0214rqy6 H2O0axtjC4nyAKr8Et+E99mfiHcNlMUB/UMKvJOLZc1l7WCwscdvsJjcC6ApdOy8TqORZRj31h1N gqeXuDRudEbZPu57J0cOSRqMCf7USywiCZSADrdH6YMtxut/mWGNv7x8Pgt/LwsfMw7cK5s0XMNb 2jT2uEaImPQzHpbSwQ1ggIq3eWwDBACPzbyPi4nMZjmmSfl2A8HzjJxfrl9XcU9MxhXndLLz9nsc QHhpJdsPub4/3KgzL+tljgxnTqnOdoACP/Si7/rucyik4+0PfaDzwBxK4Hq1nWas6qzB9ZrRAqdT u1f3Ht5PGih5rm4S5ipYMOU/pSlGXF+EgL+jf+GcjPNDhjmlgviMbMeE19La31j9UdZyBaNlg2b2 js702SPvXU/4ttaM6f36/wAjl0WN0zFyMam/qOHQ7NsrYckmtpPqbRu1I8VHqF2D9X+lZfUacVja 8es22VUtbWXbfgFr5ObjPCMYiRpHfwefhycsfMSmZiWsvl8XUhMmreXMa4t2kgEtPaViZP13+ruH kZWPm5H2WzDtFNgsa7VzmeoNu0O0IVVtu6kua6J/jB+r3V2YzBcMfMynbWYjtznbiTA3Nbt15XSg ykpSSdJJSySdJJSySdJJS0BYH1gxvrHmXCjDxOm5WAA1+3ONu71mkkHaxjmwNIXQJJKfPsP6q/XD GfgWWUdJyXdMx24+P6j7jBY8WNt/m9HiOy6DIo+uOZj4uO6/EwDaLB1G/HD32MAcfT+zeppLm8lw 9p4XQpJKeR/5jWCh+LVn2U049ld/SLRrdj2taW2lzjG9thMuHdamH0nNymdPyevWMtz8Bz7Gtxtz KN7mmsOc15Jc5rSYOi2kklOX1T6v9P6pYLckOD/QuxXOYdpdTeA17XaeUjwKsjp9DemjprC5tAo+ ztIPvDA309HeMK2kkpzr+h9Pv6MeiPr/AFE0jH2AwQxoDRB8RCXT+iYOAzIZWHWDL2ev6p37tlTM cTp3YwStFJJTQ6J0bC6J06vp2AHNxqi5zA87j73F51PmVfSSSUpJJJJSkkkklKSSSSUpJJJJSkkk klKSSSSUpJJJJSDLJFDo+CzlruaHCDqFQyqPTIcwQ3v5LP57DIn3BqAKpnwTA9J6tcpk5TLObKky dMklZJJJJSyYp0xSSFFMnKZBKkxTpiklZIpJFBKySSSCVkkkklNZ2LtcX47jS46lo1Yfiz+6Cl9p NZ25LfT8LBqw/wBrt80dI6hP9y9Jji8f0vt/is9utYHg8N4/Z/BaZ1HCUqlmD7Fj2ZGO2z2ifQqY bN0mPbX/AHLnrut9ar6JYw1ZX211uyrKdjlhax7wdzmODdzmiQNo1UkOWlkF4yJC610I+i2XMCGm QcPjvH7f4vWkhNKoUdVoHThm5Xq41TIY92Uz0nzIZuLO24lc9j/WnJGJgWX5Ld7sx9eadgkUA3bT Ab4Vdk2OCcrobGv5fYyHLEVfUPYFJZvSc1+ZkZ59X1KK72NxoAAFbqKrdCBrJetJRziYmj/K18TY sMUkkkxciy6PtOLdj7tnrMczdExuETCoHpbRkUyH2t3vsttLyPpb3AbQ4d3dgtRMp8XM5cUTGEqi eLw1kOG7GqDCMjZDQysB199LiSWV7mtgxtBbzzJJcg/s7KZj2tLmWPsrpp2hsCGSHH3O592hWomT 489mjGMQQYw4dCP3Zcf57q9qJJPf9opxzgWep7ccQLwBLKNno7xPbf8ARU39Nf619nvd9AVgHbLd dzAGOYNB/qVqpk//AElm6CMdK0vuDv8ARHsx8Wt07HONhU1OBD2sbvBJdDg0AxJP4IttVd1b6rBu Y8Frh4goiZVMmSWScpy+aRMj9WWA4arTh2c7D6LjdPL34hItfpush0D93TborZsuZ/OVyP3q9fva YP3SilMiJ9JREvwP2hOUzyTM5ZJcZ3JNjTwP7GDLa7CQxwJHI4I+I5UlGyuuyN7Q6OCeR8CoelYz +bsMfuv9w+/6X4pcMDtIx8Jaj7R/BZxZI7xE/GGh/wAU/wAUsBc39bzP2RjvdWC55rP0XEbY3R81 q9SyM2rBtNLNtwHteCHNGuvMfiFymdk59zKxmS41lwY93ntkaaHhT8tHJjl7gNUJASj6tSO4bvJY MXMzjxmE4iXqw5DwykAN+E7hun6w2VVUNoxqawGy9ob7ZBI9o0gaI1/1rz7csFoFdboDgWtL9eTJ CxrbLLMDqd1gG+jDpOO4CNv6Wxm4R3R8i7KfnRkUMFhDWOqDQQW7dv0ok6d0/wBUBYkRxXdSIOwP 7Wx7PJZ55sH3WBlghk3lQ3oVLp59HVw/rZdZe2rO2Mx3ODWua2NrnENbujx7lboyKHO2ssY537oc Cfyrha3V2Wene6umt5Ac92O28NMw0CvY7lxA0W79W8GqvIyrHUscaXNGNkDEbiuLXMl8DY13JhMy 44mEskpSMttdb7alr/EMccHMwxYscMcDjiaifO/ybX1ty8ujLw2UX2VNOJWS1j3NE7n6wCofVjMz L7sxl91lrRjEhtj3OE+rVr7iVp9WycZuDZlX4VGTbi0kVusDjoyXAGHjxUemZGNZgMyacKnFtyqm +o6oOGhIfA3OPcLZyfEOXPw3hETZj7PFX6YjbzGP4dzA+Ie4ZDhE/d4b/RtxutvyKxk5FvR8e+qp h/WrLK92xo5hzCflKp9AfknCxH0dFoPpBtT8n1K22BzPZY4g17g7yla+V0rK6hkj7fc13T63bmYl TS3eR9H1nOOoHgFF/R8nHz35nTMkY7chwdlYz276nHhz2wWlrisf3YDEIeniq/0uHy33dj25cfHR 4dul+afqWLjVOyTkZ1EuxasqpllVHrVtNgosY27LHoCtzgNHa7vx5HDx2ZfUX1Y+ZVTYOo0PZaX9 PYdo2e9m0+4js2v2H4rusLo1OdZnHKy7cf1hU5r6doc2qkP/AEU2NsBaX2b+OVU6X9UcGvNzTb1b IrGReH4j6XV7i3a0TaX40B0jstPBmxe1CpRjYArbXZzc2LJ7k7EpUd99H0GhjmVMY95sc1oa6x0A uIGriBpqiKLBDQJmABJ5KHdk1UM32vDG+JU5IAsmgwgEmhqWN+Di5D991TXuGgLhOi4j65/V3rOT 1Wm3p2ObMYVtbWKoaGPk7pEiJ01XZ1dUwLXbW3N3HsfafxVre0dwoZY8WUGiNTrKO7b5PnM/J5Rk EeIgGPDkBrVo4WVRQzG6blZdT+ptpYbat7fUcQ0Bz9k7onvC5H679FwsbpTsTGysyzqfVbG4+FjP y73Me97275rNhZsa0yZELSzXnM+tFeIMW3Ew8W6vJsy68W132nJ2FjP0zKyxrK2n3OcdeOFf6R9V qMLMf1HOybeq9QJIqysqCamH8yloG1nOpHKt5MQgMdE+qAlr/FpmRlKRNaknTRofU7Cwc3p2H1UZ GacuoGvKpuy77GsvYDXax9VlhbofELA6i/MvyutdIz+omv0srFD8inANrr6jSbTVc3EG6NWiSdQI 7rsXfVfCZ11vWsW23FtdP2uipxbTkGIa61nEjxVQ/UxlRfk4HUszE6ja9z8jNDxYbpPtbdXYDW4M GjYaIUannPqZ1fKOddVb1J9lT+pXN9A9Pvh+4hrT6xltAmPYfor0ccLl+mfVHrHT8gWDr1r6H5By snHbj01i17iHP3OZqN0awuoHCSl0kkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJ JSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKTOaHCDqE6SW+6mll01MYC1oaZ7KmtHLqdZ X7eQZhZxBGh5CyOdhw5bEeGJAqm3glcd7KkydMqrMskkkkpZMU6YpJCimTlMglSYp0xSSskUkigl ZJJJBKySSSSmKSSSSWtm21V0Pa/IbiOsaW13PLRtcRoQH6EjmFg/Zsstg/WgEHkbMaPyLezen4Oc 1rM2ivIYw7mttaHAHiYKqj6s9AJgdMxifAUsP/fVNinACjd/3Iy+y1k4km9K8yGjf0/Ey+knFd1F t1ePssyLAWbT6bvUBc1mjB7ey52ro00dKs98Zdzd4cyAK3nJsbZqf+Hghdmfqz0r7PbjN6fWyi/a bWMr2BxZq2dscI2T0/FyDSMikOOM7fS0yNpjbxp2KnjzXBpISIJJuqOo/HVgODW4ERIA9O8f7Po5 H1VwzgDPwjZ6v2e+uv1I2yG4uOBpJW8qleCMZ9luJDTc4Osrdw4gBszyDAARWZLS4V2NNVh4a7g/ 1XcFQZRxyM4ni0F99tbDPjnwgRmOA7D90+RSJJJKuzKTJ0ySQsmTpkkqUH749kbv5XH4KaHbX6jd m5zQedpgkeE9vkjGuIXtfmo7NHCvybLrhubDrC9hduMsaRW7YJ01b+M91UzL7m5dzd1gb6ogtc4A BtdB2gb2N9xeVpnp+MINbTUWkOaWEiCBGg41HKhZ02ixxc4u3F4eToe4MajyjxhaWLmuWjnOSiIm PBw8Oo213N7MRxzMa63d2wxcgjp32h7H7hvOwb7H+1zgIBJcZA4lYZ+s+cA8PoO7Fpt9V/o2MY+8 DfTX74LJYAYPiAFv349FWJa31XY1Rl7rGu27BoTtLpDRouHyarxS7PPrWYeXbZbRdadzixrQ0Oe0 NG0lle7zChHt5JZZiNiU7iDvrrTJhgJ5sWLJlGGJB4p9NB+D1HT+sZt9l32utjaqqq7N9O4iXt3l rtx02jxVZ/1iLW5ZbbW91djfQZ+d6bvS8JDv5yZnuqnQq23WZODjvsFeRiH7ZbsIay50NZsLxqfT d200VP8AZ9N+BldUreQyjLdVQB9GyvdjUh3/AIEpYY8PEeKFH0aHXU+Hi18oyCUoxy8cImYEo+ni iDoepd/E6gc/qtmKy4W4f2ZtzXs9suc99btRr+aqP1pprY/ErqaA5+8Bo+k4jb8yi9Kwhg/WbLpD 9zDjeowRG0WX22beTxuUvrB/y10b/jXf9VWlijx5zjjIiHsymOHS+GHFqB3plwZRyxhzHtjJOGQD 1m/mPD8x10vRw8jBz6xWb2P/AFloY1riSSGkhrCDxHYI11PVW5rTbuNggB4ks2jTniFq9f6RnZuW y7HAezaGEFwG2Cdde2vZSvpfR6dDzuNbAN3jIku+bpVaMuKJOlgXXht/B0/iXxccry2LLHHhyHNx 45wr5TPXXw793IwcDPzMw1zt9O2u3ILzp+jsbZ25JjRaPWun5uKy7Jxciw49zg+7HJkMd+c9rjrD jyE/ROj52PnjJtIbUAYIIO/cNNPx1V/r2BkZ2K1mOZex24sJjdpHdNOU8QjY4erPllhlz2LIJYzE Rh6gPT13/lo85k/tQYVDr3u+zukV6nv+9/BdP0ef2ZjcfzYiPDssHI+rnV68Ou41vtDQ5zq2gu2D nSOf7K6HpVF9fS8c2VvbDBO9paRPjIRyRl7PEAeHj3Hy7FHP58EowjDJilLinpD5qJ/l5tlMUO7K x6H1MteGvvdsqb3c6JjRTJA5PKrmMgIyIIEtYkjQ1po0bGosabqEj56FNxqnJhMXNkNmCeB8ELOn hsqhr4vY05VL6fUY8OYBq4HQR4rmOpZzszILpippitvl4/NVmvc2QxxaCIIBiR5pla5nnZZoCFcI /S8Wty3JxxTlMni/d8GMJtoJgiT2RaKLMi5tNQlzzA8vMrp8DpGPiNDiPUu7vP8ADwTeW5XJm1ie GA3l/Yu5rmceLQjjn0Dn/Vip7X3vLXNbtaBOg5K6BMBCdbeHF7WOML4uHq4+bJ7kzOuG+ikkklIx qSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJ JJJSkkkklKSSSSUpJJJJSkkkklLHjVZeRYLLSQIA0C1CshwLXEHkGFQ+ISPDAdCfxZ+XAslZMnTL NbSySSSSlkxTpikkKKZOUyCVJinTFJKyRSSKCVkkkkErJJJJKYpJJJJWQc5zmdOzXMJa4Y1pDgYI Ow9wjJnNreyyuxofXaxzHtMiWuEHhS8tOOPPjnL5YyjI+QLHngZ4pwjvKJA83zz9odQ/7k3f9uO/ vXoTHOdjYjnElxxqSSdSSWBc2cXo4+sQ6T9gZ6Xo+tv9W7dPh/OR2XSkthjGtDGVsbWxokw1g2t1 MnhbHxnnMOXFihAESNZNq9Eho5vwrlM2HJklM2Pk3uiN1iovYx7Sx7Q5p5B1CkUlhWQbDsEA6HW2 v6VtX8w7c3/R2E/9F2pHzlPXkMc4McDXZ+47Qn4dj8kVRfWyxu17Q5vgU7jEvnF/1h8317rOAx+Q 1/VPy/Tt/LRkmQfTvq/mneoz/RvOv9l/9/3p68it7tmrLO7HaO/2/JI4zVxPEPDceYXRyC+GQ4Je Ox8j1SJk6ZRsikydMklSZIrm+v8A1jy8XOb03AqabiWB1th0BsIa0Nb31cP7lY5Tk8vNZPaxAcQH ETI0BHux5c0cUeKV9gBuT2ehuqqurNVrG2VvEOY4BwI8wVC/Hpvofj3N3VWtLHs4lrhBGkHhYn2X 65/9zMYf2R/6SS+y/XP/ALm4/wDmj/0kphycdP6Xh01Hqlp47Mf3gnfBk1/qjZ2xRSKRRsBpDfT9 Nwlu0CIg+SGcHEOKMM1N+zNDQ2oaNAYQW/iFj/Zfrn/3Nx/80f8ApJL7L9c/+5mP/mj/ANJJDlIj bnMO/F80t++yvfP/AInydvlG32u1Xg0uzftLGD7Ta1tJfJ1aDIHhyVR6v0p+T1Pp19eTi7MSwuum +sECWHifJC6fj/W0dQxTfl0OpF1ZsaG6lu4bgP0Y7Lm8j+kW/wBd35StP4X8OhKU5nOMhETjvGeI cM4mJGrm/E/iM8QhEYuESPERPQ3Egh72yvY1rg5ljXTtfW4PaY0OrVjdW0yGHxZH3FW+i/8AIeJ8 bf8Az45VesfzrD4Nn8VlTwxxc5kwx1jcsYvx2/Fk5/KcvwyGWWhkYTNOjR/Ms/qj8imoUfzLP6o/ IpqkXZx/LHyDj/W3KyqcrDbTdZW04jDtY5zRO5/YFQ+q+Vk3ZGY266yxoxpAe5zhPq1DuVo9Zsxj hWZV+HTkW4tBFbrN40YCQDse1N0h+McGvJoxKce3Kqb6jq9/BIfA3vd3C6TJ8RwS+G8IibMfZ4q/ TAt5/H8O5gfEPcJHCJ+6Y3+iZOL9ZumZmQRkgm6lr2TXUw+tVW0Hc5jvVbJ3Gfo+HgszrmQashjH 9RtyfQ/T4rqvQf6drTAF21gLG6jUkyuj+sFGVkYAxsYGbram2uDg0tr3gvdJI8OyoWMbZZ1K3Gqb RQMN2PQ1pa0vefUc5+1p9vaC5Z+PmMmXFhjMCYwAwjwxA0Nb1/IupmjGE5+rg4yD6pb0L0X+13Ud Cuy7eqHMsYGPstxRSdswCxst2xr+cFnZF2eOo12PyMrfik0Ok4u8WZGw1taA3aQ7b/rqrtuKP+aQ xmViq1+PULXbdrS9uyS4ga8chByvq7a/MGS70jLHvfurcJMtMnbe7XUxHmm48cRxmXDEmUx6qj26 InlJ4eEzn6Ym4CUh9ot1OhZF2RVkPtuutdXc6gtvFQLXV/S2+g1ogkrYx6DkXspB2l5iTrC5bpHU a8a/7JVLhlZD7LHuH51h/NAPEr0HoGAzb9sfq4yKx4RoSoRy3HzPCKMb4jXSIbWeWTl8AllhKEpR 9PFVkn+XV0MDpuNhs/RibD9Kw8lXUwTrZjCMAIxHCB0DhylKRMpEyJ6lSSSSchSSSSSlJJJJKUkk kkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSS lJJJJKUkkkkpSZOmKSlis3KAF7o76qVzn15JIJkGfvQ7bDZYXkRPZZnNcxHJEwrhlCdU2cUDE3uC GCZOmVFsLJJJJKWTFOmKSQopk5TIJUmKdMUkrJFJIoJWSSSQSskkkkpikkkklZJJJJLxPT+pW5H1 nZlZDAyx80FvG1usN17yu0Wd1boOD1Ootsb6VpIcL6wA8EeJjX5rM/5s9abo3rl4aOJDv/SquCOH NGJycz7U4jh4ZxlIcI2oxtdzfMRlkHscqMcOEWISiLl1J2ekKS5s/Vzrn/l7d/mu/wDSqX/Nzrn/ AJeXf5rv/SqX3Xlv/FmP/wALyf8Aetf3sv8AmJf40f4vRJLnf+bnW/8Ay8u/zXf+lU3/ADc63/5e Xf5rv/SqH3Xlv/FmP/wvJ/3qfey/5iX+NH+L0ahZWywbXtDh28vguf8A+bnXP/Ly7/Nd/wClU3/N zrf/AJd3f5rv/SqI5blgbHO4wf7mT/vVHLlIo8vIg9DKP8Xb231fQPrM/ddo4fB3f5/ep13V2EgS HjljtHD5Llc7pXW8aylg6vkWmwmQxriQA0mY9VV6cLrFoc89TyC+mt9wNjdzQWAGGn1TyHDsrkfh WLLiGT71jNixKMJjqRqK8GE8xlgajil/dlIEfSXR7VMuMvo6w54bX1O71BOrHPcwkEM01dE7tNYV 6rofWLBp1u4PH0mFrg4fEeoos3wrHhjGU+bgBL+pM/kCvhzspHh9iQl2Mo/gb1el9ga99jxXXWx1 j3kEgNaJJhslcv8AZ+nH6xW9X/amL6bg302PpyHubDWtcRDWBroGh1V3G6J1epmUbOoW5u7FuaMc tcdznMIEDe78iw/2J1n/ALgZH/bT/wC5aXwjlMEceWUM4kcgOIziKBiaJFTH4ub8T57mIZYRGOuH 1gS1N97iXt7KwwtIcHtsa17HCQC1wkHXVRU7GOZVjMeC1zcakOaRBBDACCoFc5ngIZZxjtGRA8g7 uCRnihI7yiCVkydJRMimuLXBzTDmmQfMIv23L/0h+4f3LM6ycodNuOJPqwNW/SifdHyVH6svznY9 v2ncaw4ekXzM67ontwpIynGJMZmOuwNMv3SM8Ms8jE8EuHhO+ruW3W3EG1xcRoJj+CyOrfzrP6v8 VqLL6r/Os/q/xShImfESSd7cn4uAOUoChxR0buI7dj1nkhoafi3Q/kVPr2fk4WK1+OIc920vInbp PBVrE0BZ/Ja8fAiPyhGsrZY0ssaHsPLXCQfkUslDITWh9Vf3tXS5HJGMcUpx4xD0yHfh0cP7dfm/ VvMtvEPbXY3cBAcA3n8Vc6NU1/ScMuLv5pmgcQOPIhS63k9MwqR022m4tyMdrianMYGtsBENBYeI Uek5/SjgWVMFtFeBU0+pc9hBG5tesNb+8tQ8jzUeR4owIvIcvpI+SUQBTn5PiHJZefmNACOAQI0B Em59npDt2xu7xIk/eVKAOFT/AG10n/uXT/nhGx83EygTjWsuDedjg6PuWZkhnq8kcld5CVfi3sZw g1Aws9I0mSSSULM8tRf/ANkBcKWgutLNoHGsb/j3K9T6SKG4VTaXbgB7j/KOrvxXI+hSLfWFbfVI g2QN0fHlHoyL8ewWUuLSPuPxHdXOW5uOKfEY2CBEnqEfEx97jj4PQccQKJu6evyn3sxnuxxutA9g I3An4S1c3j9f6rbe0tAfXkFnpBtTtRBc709xA1aO5Wv0rqozd1b2hlrADAMghAwfq1ThPwLKi0Px Gxc+Hk2H03Vy2X7W6unhdByubDPHKWkr+XT+XV53JjnCXDIURurrXU8rEyqGVWMqZAscx7S5z9S1 zWw4TtHujy5V3pOb9twmWPc11w0uDRAa4jdt+IBChldGqyLrLvXtrdYdxDdhaHem6mfcxx+g4jlT 6X092BQ+t7xY579xc1u0QGtraIl35rB3TpHGcYA+YV0+1brbS+s3VeodJxDm45x/RqH81aHututJ AZRUGFsF373u/qrYYS5jXEbSQCWnt5LM6p9X6+pZ+NnnLyMe7DDhQ2r0XMDncv2302jdGkrUAIAB JcQOTyfuQmYe3jEa4vVxaV5DxV1K6SSSiSpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkk kklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkxTqDwSwgckaIE0D10U52SQ695G olCUn12M0c0jzUVhZLM5GQokk15t+NUADdBSZOmTFyySSSSlkxTpikkKKZOUyCVJinTFJKyRSSKC VkkkkErJJJJKYpJJJJWSSSSSsQkkUkkrFJIpIKYpgnWD9c32t6O0Ul3qPyaWNaxxrc4ufG3eOJTs cOOcY3XEatU5cMTLs6t/UMSi11Nz9j21OyCNrj+jYQHO0HaURl9NlTLmPBqsAcx86EO1BXAZN+Ez JGRfj34zaftmHbW7Lutm6quu2toeHgw53tgHVbXVTTg/VuhuT6GMXgW24uXvyiXRuLGB9geS0x3g KzLlojgAlK5nt9tMMcxqRoaC3VvzekZVFORZlV1VOmxjnuazc0NLCD6nYeopY1XTcttpxMht9bmG k+k9r2sD9XatnV3PuXDU9NfjdMyHWmtlr6avUxnY1tL2sN1Y0e/a1xLo3HXiJXX/AFZb6decyysU 5X2ux2RUAGhu6PS2x+aa4gqTLx4cZEMkiImgNvFWOfHL1RAsN9/TaXu3bntc1xdWW7W7Ce4huv8A alGdQx7Wh8uc0aWcO+MthFTKnLPllVyPp+Xw8mf24EEGIIO9ufb1WnCyRj23tc8xpO14nxj2/kWf 0/qV1n1pzB9qe6h7A2lvqOLdzQzdtbPkUHq/1evu6g7IZY30rnAkGS+Y1DRGv3rP6TjUjrrKfVll TyWPAPuLNQFZhlMcU+ED9bHhJ263oG9D4byeWBkM85zw4/dMKvhlR0Jq68Le0c4uMkknxJlMsP6x W1UX1S3NsuuqsLG4lxraG0w5znt9Rg/PXM4XU8lhbbnftOyluCy+3ZkOBkvIN388PYRpH4KPHyvH HjEvpWvbu50s4geHh2fQSVEWMLnNDgXMjc0HUTqJ+KxM+3GoGBW/qVmFRse94dYTc8OA2e9zXzDu Vk9PzulXOzMl/U78Wy201Vvde2bWVjbW9w9LzMeSbHl7jxWf8X6LjmogUPtD0/WMe/K6dbTjn9I4 CBMSAQS2fMKl9XMDMw6bvtI2CwgsrkGImTp4q10KyyzpdBtyW5loBbZkMJLXOBMwSB+RXlFK48UN N25j5mX3c4QBw5CJ2fma2fnUYGHbl5DorqbJ8SezR5k6BZNufV1CurIqBbLSH1u0exwMOY8diEDr NV7uqVet1Ha+t3r4eK3Fsva1rfbvc2rlwceSsy/Huf1I2MzzXmZDQ4xiWUNeGaEuZdIdp3Csw5eP AJcWpHFxUartt+Li/E5meGUT6QJDx28npXdSxKMiqh7n+oKmbwGOLQLTtrJcGx9IeKFZ9aei1lwf c9uzdP6G2Pa703e7ZEB2kzys3OvFHVXOLbnj0cJs1iapdbYB6v8Ane3zWXnU5lmHY/0mtx7Dk4zL C/Uk5frk7A3tsIUn3bGceOUyRYEdx/e7eLYwZM0sssWOInKVSiAD/dr/AJr1H1owm5GTjZH2rHqY cdlYFlkO3NmfaAfFT6V9X/s+NmDNfj30ZVLGtZXZv3RYyztHgsPrmVh5xoyabDuLdj6iNWgGZP3r o+nMrZg0Nrd6jAwQ/ifkrGT4xzH3cYeGMRXACLEhXW2XL/xc5fCcfNGeQ5ZzkZwmBw322a//ADe6 N/3EZ+P96yet9OxOmMb1HppGPdjOb6tbXGHNcYEif966crlfrMLRh5Zc4gG1sVzOgDXbnf58fcPB L4PPNzHMiGTPOUdBKE5GQmCaIIPgs53FihhlKOOMZDUSjEAxPm9GL2DGGQ/21hm93kIlZWf9Z8XG pZZVXbY91jK9j6bq/pEA6ur5EzHdEpFzuk1NZZv3EMcCdxgjYGj2j86Dr+RcbY+lhY+5rbwXua5r rS39I4RW8jdIDXQZS5X4VimMxnkv2TkqI68A2Tn5qcRHhFcQGp8Xuq+rYtjxW1t4cQT7se5g0G76 T6wOyp5f1jrZjOfi4uTdeI21OouZOuvu9MjhUPq86r9sbapAGC31ALfVBsFu0ukEjUAaIHVm0UdT 6plZOMMutjarNrMh1TmN2tYZYzxcqccGMZTGpGhEgWNbO3T82SWbJ7YlcRZI66V1ej6d9YsdmbQ6 uvJa/cB78e1ognUOcWABehVPbYwPYdzXCQR4LyroNDKuoZfp1tx2tZW11AvN7g8F5JduMtkOC7z6 uZJNVmO530IcweR5Vnk8kceU4RfDICQs9aa3OY5TxjMa4onhNdncSTAynWk5ykkkklKSSSSUpJJJ JSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklK SSSSUpJJJJSkydJJTEsDgQRIPZUcvGFfvZ9HuFoKFrd7C3xEKHmMMckDY9QGh6r4TMSD06uSmTnQ kHSE0rEbqySSSSVkxTpikkKKZOUyCVJinTFJKyRSSKCVkkkkErJJJJKYpJJJJWSSSSSsUkikklYp inKp9VuzKMY3YoZ+jBdZva+wwBIDK64JJPnp5p2PGck4wBAMjQvZBNAns3hj5BAIqeQdQQ0ws3q/ RsnNvwjcCzDxbTfawhzXOsaIpg+AJkrA+s+W+/Nx8hrtouxMd5DHbmy5k6ObofipdAys+rG6hZiU nLuDKttRdEg2amT4Lbn8EOLCc0c3rA2lUQCdPmv8XIj8X9zP7BxacVcQJJ08KXt+qGRa66r1xXjV 2HJwzJtsflED9NkusBmIja3RW7um9a6h0DLw+ovodn5BcKiyRUxpgATt3eP3qP7W+tP/AJTj/t0f 3pv2v9aP/Kcf9uD+9Uzh5k1csFxIIPvY7H/O69W+J4hfpy6iq9uf8Gi/6n5tNGUyh+O831V1tDGG mHMubaZ9z+w5n5LoOn9MGHZfc66zJvyXA2W27Zho2saAwAQAsz9r/Wf/AMpx/wBuD+9L9r/Wf/yn H/bg/vTZ8vzMwRKeHXf9fj/77wTHJhibEMn/AIVP+DvrJ6z15vTLa6W1erY9u8ydoDZIHY+Crftf 6z/+VA/7cCp5x6znuY7J6JuczRrhbtMHtoVHHkMl6ywkf7fH/wB82uX5vlo5Ac2PLLHrYjin9Oj0 OHYzJrZmgk+q0FgP5oP5o/isDpmFjM+s+TQwHZiN9SvXu8N044G8ozc/6zMqbRR0hlQaA2uXgtbH lKt9C6TdhC7KzHCzOy3b7iDIA5DR96fLFHFiyyzTxynKIhihjyRmRrueA6ABZj5qYyGHLceLFkMj l441cTsDxdWv9YsbJyOoYLKaLL2upyWWit4r9r/R0NjhA3AR4rO67gZlmHffX0y2hzcX7M0VZDHN 9MfRaamSXRK69JVocwYcFC+DxPdMsIlZv5vByOoZPo9OpxXY+Vf9qr9MjFaC5vtE7iSNszysivpn 1ipfjZNjRfhdOO7G6dY9nrCG7GnfUwMLm/mj8V1h8EtEocwYR4REa3ZPj27Klh4jZkdNq/b3RYt5 yMeu81vpNjQ707ID2zwHAEoidMoCbJPizAUHKzek5eR1arPpyTjNrodSdjWueS5wdxY1zY0Wdn9O y2dTx8m7Ldktrqe2HtY1w3kcekxo7d10pWV1X+eZ/V/ipYZZbafLw7a15ud8WiI8tIjrIX9fBC7o 2VdabvtQbVdbRbbXsBJro2OrrBnT3NJnzVd3QM29poGWxuIy17mVGqXtLnOc73h+skytizKbj49Z I3Oc0Bo+Sotyc1z3FgPv9x2tkfu+fgpYZckoTj6aFSFgdNPyKpc7i5XPilj45ZojUY9SOLX9mzB3 1WwzWxoseHtne/T3T5dlrUUMx6WUVzsrAaJ50Wf6/UvB3+Z/sWbk9c6jTmegOGloLS0bjMH+KhMZ S04rdLlue5n4hKWKMMh9uJyfrfQPp46vSlUfrF0LOyum3VY+MH3vcwkSwOJaRzucOyD6/UfB3+Z/ sWR9YAP23nf8fZ+VanwTk/dzHIMnCcJjIVsfAuJz/wAX/VcMcMgJ3E8eh+j1LMG/Hx6DdWGlgABk GHRr9Eqh+x8Y4dGI9znNxrBbW7QO3NcXjsg9Gstr+rrzUNTmwdJ/wQU/teZ4f9FVOcwz5bmJ4oTJ ETvdfy3LNh+LYZ4oSy4pcRH6EbH2s6OmCrPuzrLn3W2t9JgdADK92/Y3bqdTyShZHQcS3BfgMc+m m5/qZDmnc+w8ne+zcddNU/2vM8P+il9qzPA/5qr8WW746OnXtt9jJ/pPlar2slf3e+7YdgYrsuvM LAMippY2xpIJaezo+l81cx8i7GtF1LtrxpPOh7FYWD1TNdk3MyfTspqhu6tjmO38n6T3yAFr1va9 u5plpRz48uDIBKfEQImMok6AixvqG5y/M8tzMZRx1/WhIUdfB6Xp3XqbtteR+jtOm780n+C1wVx2 BiUZd7aHPcx7p1ABGn5F17AGgAcDRavI5smTHc6NaCQOp83O53FjxzqFi9TEjbyZpJJK21VJJJJK UkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSS SSSlJJJJKUkkkkpSSSSSlJk6SSkFmLVY7c4a+SduPUxuxrdDyjJJntQBJ4RZ8E8Uqqy5F9LqXkEa H6J8QhrYsqZY0tcJCyr6vRsLJkcg+Sy+a5Y4jxDWBP2NvDl4tDuEaYp0yqswUUycpkEqTFOmKSVk ikkUErJJJIJWSSSSUxSSSSSskkkklYpJFJJKxVfMxDktaBdbQ5s+6ogSCIIc17XNPzGnZWCgX5uH RY2q+5lb3/Ra5wBP3ownKEhKO4+qRAz9IBl4BpdVGH07o2+rDxnnErqqqddXvIY1zaxJcddCsX6p X5Zzb27B6FrJtcGBoBBBbBAEfBaf1iyarejZDAHidn063sbAewmXPaGrn8DpvVzj2voa6uvJrGzW PUkh4Df7IK0MuTPPlonJPJxSnkBMydRUf7Wb4Xj5KUeaiDy8SRiAka4gSTrb3AgiRwksP6rYXUMS m5uW011uI9Kt3IIncY7TotxZ0hRq7VnxRxZZQjMZBH9IbFZMnTJrGpMnTJJUmTpkkrFIpFV+ofZh hXOy62W49bDZYywBzSGe/UOkdkYR4pxjr6iBoLOvYaKJoE9k6SodEwq8Tp9YbWyqy79Nc2sBrd7x JAAA0HAV9OzwjjyzhGXHGEjESqrrrWqokmIJFEi6WTJ0DMNAxLftG70Nh9TZu3bY1j0/d9ybCPFK MdfUQPSLOvYdSm6BPbulWX1X+eZ/V/io/V/0g3MZj7XYovmh9WlJaWMMVASBtOjtfpSpdV/nmf1f 4qfNh9jPLHfFwgakcJ9QB1j0Ouzm/FJcfJ8VVc4+Pdhk++2hnbawfeVoPaGPqc0AAEsPkHD+8BZ9 v9Jo/q1/lWle0uqcBq4CW/Eaj8UyJqUQdjcT5S0KOTjZ5uVXOOQEdzwagM0J+LjPube6prrW/ReQ JHzRGuDmhw1DhI+acqE2DWzrxl1idxuOxeQpzOsnKfWHWusrDiapcYgHt/rK0vq3m51t+Qclrchj vc6y9jbD6k8BzwT8lmfs7rLMi54ZYHw7fYJ906aEcyrnQMfLw8mx2RXZXU5kRtcZdIjRoPaVd483 CZY5SvvAl0Och8NhhyQI5SBlGMhGoRJ13A/J6V97n1isNZWwO3ba2NYCYiTtAQ0B+bi1jda/0hMA 2Asn4bwJTvzMRhY19zGusgsG4ag8QquQ5JSJycRl14t3Pw448A9qIMDfDwCxpvVJUx4SLgASTAGp JWT1bKqy+n2sw7mudWQbQHASwc8pkQSQzYcRySA2BIBlWgtt22v6R0i27D22WW5QJfa1tv8AO+rY 4CW+Kr9J+s3VMjqeJjW+j6V19ddjRSwaOcGnhvgVgBmaOmn9IBiOtBNe8avAI3R8Ctn6rUdMusry LPtJy8K1rtrNhY4tO9kSJOgXRclzmA4pQz4xOUQTLMRZ4idBVeLkfGfgeXBIczy/M3xZRj9mPp9I jZN34ah27XPqyLHVEsLXugtMRr5Lq+k25N2GyzJ+mZ1iJb2K4f65YVuD0wdassIsx8iq5mCY2uPq tcPVjU/BbNTLj9b+m5l17rPteDe9lGgrqH6v7awPEkkk/wAE34f8PlGHvSy17kch9utjj1rzIYOd 5mMyIRj8tevv5eD1iSwOrfWf9j5F1mbj/wCS6q/bmV2Nc45A/wC05qJDg5wI2/3Kl0z67W3UU15m Bac6zR7KH4xZuJ0Dd2VvOkdvkp2o9YkmHCdJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkkl KSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKQ7Ka7Pp tBREkDEEURY8VA1s5mdSytzdggGZVVa2Tji9kTBGoKzrca6rVzdPEcLJ5vBKMzID0HXTo3MGQGIB OviiKZJJVGdSYp0xSSskUkiglZJJJBKySSSSmKSSSSVkkkkktXJ6hj49vpP3F8btBpEOMz8GEqGN 1XFyKn2yaxWNz93AAAJ9zZHdVer4Iycmp7qy4NDvogmQK3n3EDs4gAeZUOmYltNN32uuxjLIduB1 gBunsse+fJaQ5flPu0ZmUvdIgeEEXrKiIjqxcc+OqHDr/It0dTwzY5m+NpADokOnwjXRY3XPq5mZ 3UTk0WN9OwNDg8n2wNugjjurWPjXMtDrKrvQLiXPZZZue9xEPcxzg5oaNPFbSr81jx4ZR9ok2NbI kNPLY9abPJ81lwzM40JVw6joXF+s7PT+reSyZ2MrbJ7w9gRunnb0bpz/AN2vH/6Qaz/vyH9bP/E/ l/Bn/nxiJgmPq9jOAksxa3ADmWsDv4KWP+48HjzEx9sYtLIf12Y9faB+tkukmTplntwLFRlVOr9T q6Xgvy7RuiGsYOXOPAWPVV9cM5gyftVWCH6toLQSAeJljz+Ks4eTlkx+5LJjwYyeGMspI4j1oRBO jFk5gQlwCMskqsiAuvO6ejSXPfs364f+WlX+Y3/0km/Zv1w/8tKv8xv/AKST/uOP/wAWcv8AbP8A 71b95l/mMv8Azf8AvnoUlz37N+t//lpV/mD/ANJJfs363/8AlnUP7A/9JJfccf8A4s5f7Z/96n7z L/MZf+b/AN89AUywD0363/8AlpV/mD/0km/Zv1v/APLSr/MH/pJL7jD/AMV8v9s/+9T95l/mMv8A zf8AvnoEy5/9nfW//wAs6v8AMH/pJDuxvrNjs9S/q9FTBpueGtH41ox+HxkajzWAk7Ae5f8A0FHm iNTgyj/F/wC+ekTLk/tXVv8A54MT72f+k032nq3/AJf4n3s/9JqT/RGT/PY/8XJ/3iz/AEhD/Nz+ 2H/fPWFZvU67X2sLGOcNvYE9/JYv2rq3/l/ifez/ANJrQvz+pY/1coezqXrWuy7Ab8V20bfTZDDs DeFJg+DTlkETmh6v3Yz/AO6jH82n8T5uOTlpDgkKMZa8J/KTYupu+00fo3xtr1g+K0lgdB6t1W7r GLVdmX2VvfDmPse5pEHkEwt8KD4lyJ5ScIGfHxAmwKZPguYZRnyAVxTuvohqdsrc2NxrcW7W8xy3 n+SQosy/UeWNqslrgxxIEAkA/veBSu2CxzbAS2xoIa2ZLmmD9H4hZ9dBxr733Uvs9XZZXWN72h0u BEjcJDQ3lLFgxZYznK+OQjKA/eMiBKvUPl1vs34zlECI2gTA+Aj8t+YpuX9Sopc9rmvJrc1pgaEv jgkgabgiUZLMio2ta5rQXNgiT7TB+iSs3N6ba++/Yxxrt2kEBurp38xIghXOmVvqxnB8gbyQC3b2 E+2BA3Sncxy3Kw5SOTHPiyEwscWtGIvTobtdCeQ5DGQqOv5uZ1ih3UsqmnHn1Wv9LY5rvzmh4dAB PlwsTIp9K30nOJLHGsyDILZmAfgulqouryar5s9U21FrwH8VuNji4OJgRoNyodT6f049Uxm5L8j7 RnOe+wVNbsa8+6GFzp5ctLlOV+HG4ZJS0hxb6+gXOXl0Y+Y+LfFcEcceW4OCPEDxQB+Y+kMsr6z0 3dJqx763G+9r2tfUxrRsIa1m7USeZWCbK62OLy6CIBaJEyD7vJdP0zpNWNRZiEPc19NfqF8fTcH7 2sLZGin03oleDe642G0kFrWkQAD48yqfP5uShzUvahx4xRJjOhO4iq09NNz4RmzYeRyDJlMM8qOO MoA0Qdb728oy2mxhDHOLmmTp7YPzmdPBdX9VvVwsY5NNm2y08iD7RpBlE6n0qvPawbvSfXO10SIP Mj5I+DiMw8ZtDHFwbJLj3JMqjm5iB1wxOLbQy4pfbo28uc5uUjDNMZMpmZSAhwxrWq30+qLr9llv SuoWWOL3uxriXHn6Dlb+q/1fxTkYmZWz0nUhr2vL3EkgDcGtLoPOqz7egdJtLi+gu9QkvBssg7ud N61eifU/pl1teTt/R0ukV+taXCONN+gUvKSiZxhGWSR4uM0Kvz9XRx+biYwlIxhEcPCOteWnVo/X Z+Ix/X8fBwqG2jp9d/UMt27U2PcxjPTHt3xrv5WVTUKOrVGt2BQ9vUqDXYR+iArxHuD63B+lZI9w n6S9Nb0bpouy7zjsdZn7Pte8bxZ6Y2sDg6RoFQt+p3QbepUdQdi1g4zHNZjtYwUkun3ur26uAJhb DkO0zdsbugugTHE+SkmTpKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkk kkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlkzmgggiQVJJI6qcj MpFVvtENIkIGi3HMa7RwB+Kg6ilzSCwa+Szsvw/ilKUZAA6gNmHM0ACCa6uMmKsWYV7Xw1u5p4IR GdMsdq94b5DVVI8rmJMRA6d9mc5sYF20kxRb6hTaWB26E+Pi23nTRvdyjGKZnwAXK6oL+OIjxE0E KSs3dPurEs/SAeHP3KsZBg6FLJinjNSBCYzjIXE2skkko1zFJJJJKySSSSVikkUkkrFJIpIKcz6x 49uT0TKppaX2OaC1o5O1wcQI8gq3QuqdPv6Pj0m9jLK6m1WVvcGuBaNhkFbRWTl/VfomXc6+3H/S PMucxzmyT5AwrmHNgOD2c/HHhmcsJ4wJGyACCCR2YcmPJ7nuY+GVx4JRlpp3BbmPn4horL7q2uLG 7ml7QQY4Oqc52FH9Iq/z2/3rJr+qfRbw6y2lxfvc0ne4fRcWjv4BOfqZ0GCPRfqP9I/+9Onj5Djk DlzXZ09qNf8ASWYp8yccTwY/lH6Zvb+6x+sPVumPybOnZPTvXqxrZa4XvZJAifaPNa3TOpU9UwLM luP9ndXaK4Dy+Zbu7gLM6n9WLMzqF+TVlUsrtdua1wskCO8MK0Oj9PPTOn24z7mXPsuFg9MOgAN2 /ntatTn/ALh9y4cRgckQOEA7E1dBzOSPPfe/1ol7ZJvTevlbKSdMucegWTQFJMklYpJFIoJWXMV4 rOuddzHZhLsbp5FVdEkAkk6mI/dK6dYH1e/5W63/AMe38tiv8lI48PNZIHhnGEBGQ3HFKjRa3MRE 8mGEhcTKRIOxoaNv/m30T/uIz73f+SS/5t9E/wC4jPvd/wCSWooqD75zP+eyf45ZRy+H/Nw/xQ8j 1qjpmBltopwaiNoe8uL9ZPAhwjhRb1mljG4TMCn7C2w2Ch3qbt7gGudua9usBdTkYWJkua7IqbY5 n0S4SuUz7bD1t/6JrS2zaGho1A0DvjGqlx85n/zuS4i9Zl0uX5XkM2KUDymOUoYpGXFURI+f7ej1 WJi9NofVk04VVdrRua4OtMEjzsI7obupdOYxzzk1lrAXODXBxhokwGyToFJzbn4Wyh4qtdXDLCA4 NMc7TyuHx6Q/Mx6Krsan7ZQ51N4wWh+5zzj7P0bnbZ190og5OaPFmymXBoL10caEcfLRAxYxHjFm upe1bmY14rtosDwNjiAddlo9hc3kTIOqE3rnSCxzzl1Max5rd6jhWQ4ciHwsn6v9Pz3YuNmWZVbm uxhRsFIa8BgLWt9TcZ2uHgmfZfX03IznOqzMjFva7Kc2prX2UsDS6t+5v0wx3IQODGRXFxcMuDT+ tsNu9rhmmJnShOPHr4aGte1O5jdR6fluLcXJqvc0S4Vva8geJ2koPWM9+Bi+rW0Oe5wYJ4EgmT9y p9BqoyMrO6tQAKMl7asYNG0enSNpdp+8+Vr3U1X1mu5oew8tPCrZIxhkoWQKsHe+obvLZBcZ5I8U b1A6hpdH6jZ1DGdZa0Nex207eDpPdU+s/wDLXSP67/8Avi2KaKaGCulgrYPzWrH61/y10j+vZ/31 WOQI9+dafqs3/QLH8QlGQuEeGJyY6H+EGpV1nqB6vm1sxHbq66x6d1rW11xveXu1dG5scD4onTOq dSuyX1tGNkMfYLHCvLbY6qs7WugNZqPBZxwKsPJ6jfn2ev1H0WOY9kgvuyBfWK2D92IbHkj41lHR er41OS2H/s+mgCts77TZDo8eJKknjxmMuGPETGNb0aA21a0JzEhxSIHEb+pLby+u1N6zSxjrRRje tXlMH0S/9CGnnXbvVbpfVb78PFpfdY7IblN9VzjG6t1tzAJnUeyCj14HTsvreRTSC+qplj8whx/n 8h1ft3eTau3CpdLxqPsXTs8SLjlGkmdC317XjT4lIRwiAABEgI796kQm8nFZIok7eYBesW99WI23 idZbp5e5ZOFhXZt3pVwIEuceAF0HR+mWYJtNjg42EAbZ4E+PxTPh+KfuxycPo9Q4k/EMuP2pY+L1 +k19XUSSSW046kkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUp JJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUsnSSSU4+V j3faXe0kPOhHmtZrQ1oA4AhPATqHDgjiMyDfGbXzyGQiD+iKWKrX4NN7t7pDuJCspFSThGYqQEh4 rYyMTYNOFk0mm0s1j80nuENaXVHgVNZGrjz8FmSsTmcQx5ZRibH5X0dHDMzgCQskki42O/IftboB 9J3goYwlKQjEWSySkIgkmqQw4mAJJV3F6a95D7vaz9zuVexcJmNJBLi7ufBWYC0+X+HgVLLqf3en 17tPLzRNiGg79XNyOlNcd1LgyfzTws22t1T3Vv8ApN0K6SAq+Rg0Xnc8e4dwYKPMcjGWuICMr17I xc1KOk7lH8WljdOquxPUMh7p2nsIMLPex1b3Mdo5pgroq621Vito9rRAWT1PFtba68Ca3RMdlHzf KiOKEoR9UABKvxLJy+cnJISOktRbQSSSWY3UNBPqXtIjbZp8C1rvylFQmEjKsbGhYxwPnLgfyBFU mT5vOMT+AWYflPhKY/5xeTyaes/84w8Cwt9UbHidgqkaTxEcrX6z1ynpfptcw2226tYA/wCiOTuY x61Csf60122dKLaqza4W1HY1rnyGvDiCG128gd2kJ+Kp5IRkLG2mjZ5zmZZMcKjGBxR4dBu5Tvrr ZbZbTj0V0vq2zZd9oeCHa6Mqx933/itmzr2IzpjeosZZfU57agytpDy9ztgDW2+mfpLgvs+Zdk9R qrwS2x7a26Uma5aYMNw5E86BvzXX9XdHSOl4jiW3ZF+HW0ahw2ubY4w4AiA3uFaz8vijLGBEjiOu vhZaGPLMxkSRoNGL/rLnN6jXR+y8kY9lbnBjmsF5eDy1vqwWgcrYwct2XSbXY92Kdxb6d7Q1+neA XaFcjmUur62zIHUcqzAwG+hmZxewuqstn2g+nECG7/CV1+BUKsVjW3vy2mXNvscHucHa/SaAI8FX 5jHGMYEADiA2v+XZmwzkZGydD1pOUikUiqrYWWB9Xv8Albrf/Ht/LYt2/JxMTFsy8v1DXWWNioNL peSPziAsbpef9XKM7IfT9tNnULWlwc2ra0lxiIdx7lq8lyeefKZzGFjMIiB/uSsudzXO4MfMYozn RxkmQ/vDR21FFvrFV1lYMhji2fghLLIIJB3GjoxNgHussvqv88z+r/Faiy+q/wA6z+r/ABTobtD4 uSOVNGvVFuH1/sf6tt9f0/0XqTs3Rpu26wue6d9WOr4763v6iyk10nH/AEFQJ9Nz/VPutnXd3hdL R/Ms/qj8inCdDNKAIjXq30B/NuDFGYgZXoBWtOHi9L6vg9Td9mvYelW2PufU8e9rnj3MbpG0v10Q GdH6rdV9ityK6sV+uc6kEW2vIE7XH6LXABdFCEQG5HGljdT2lp/8yUkOYmeMem+HiuusOvnVrJ4I AwlrQkYnX9GfTyunLwej5nTcwMwsgDpJlxxLAXuYT/o3+BPitdOmKgyZJTNyq/L+WrYhAQFR2WWJ 1n/lrpH/ABln/fVtrE6z/wAtdI/4yz/vqs/D/wCdl/sc3/QLFzf83H/aY/8ApB2djdxdtG4xJjXR JOkqdtkBjABJEa8qOxkAbRAMgRoD4hSUqazdayph91jg0fMwiLJAHXRRoAk7DV6L6t1tbhOeBq95 k/ABa6r4OIzEx20s128nxJ5KsLo8EDDFCB3jEA+fV57NMTyzmNpSJCkkklIxqSSSSUpJJJJSkkkk lKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUp JJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpMnSSUiux6rm7bBImQg/s3E/cP 3n+9W0kyWLHI3KIJ7kLhOQ0BIag6ZigyGnTsTIVhlbKxDAGjwAhTSSjjhH5YiPkFSnKW5J81oTpJ J61SSSSSlkHLLW41hdxtKOqfVHtbiOB5dAH3qPPLhxTPaJX4xc4juQ4SSSS5110LpGUzwcxwPxBa R/FFQr5FtDhxvId8C138YRVJP5YH+r+0rcfzZB/W/wC5CypZ3SOn9Qcx2XWbDWCGEPe2AYn6Dm+C upkwSMTYNFeQDodXIH1T6ACXDGIc6NxFtsmP7aJZ9XelPrprNTg3G9QUw98t9YbXkEun+5aaZP8A eyfvy08Ve3D90NXG6ZgYuGMGmhjcaINRaCHTzv3TunvKWB07E6dj/ZsOsVU7i7aNdXGTqdVZSTTO RBBJNmz590iIFEAaClikVTb1Kv7blY1gFTMOuu11znQCLN/M8Rs8U3T+pt6h6llVLxjtdFN7oDbm 93MB1ie5CRxyAJI0FfjskTjtff8ABofWLq2K3Ht6Ydxue6t5cANrYkwdZ4KxMCoftWjHLgLG3taT I2S1wkB8widbyca3qhdZj2Vmt224EgF4aYDhz9JsR5KHT8nEt6zVcaDW22wFte7cGvdwfoj85anL fEeY5fAMUBHhFk2L33H1bWX/AIv8jzMY8zPHl9yWAzsTocQrhNfk9zluDsq1zTIL3EEeEoKcJlky Nknuba8RQA7Clll9V/nWf1f4rUWX1X+dZ/V/inQ3c/4x/uU/34uhR/Ms/qj8imoUfzLP6o/Iqd3V q67W17J9xbYS+sbYB7b/ABEawnYsGTMSMceIxFnUD82+JxjCPEa0DeWZk9XxWZ7MOHGxjgXOH0Ro ZHnoVYt6gGYgyWskF7WAFw7u2TNe9ZteDi9R6lZkGWOrDHODHEhxMj85jSPoqbFyuWIlmnA+1jJj OQI01ESP+cyRlgkJwyE8UoE4q/f3gfwdxMUuB4pKmUhZYnWf+Wukf8ZZ/wB9W2sTrP8Ay10j+vZ/ 31XPh/8AOz/2Of8A6BYOb/m4/wC0x/8ASDZZ1zDfm/YwHB27YHmNpdxHMrRPCymdHxf2h9rqJMP3 kHVgdMmO51+5ap40VbJARMeljUHcebcyTwSI9jiMQBxGWxl1ru03dSxgCZ3AOLZaWnUa/vdwtro2 V0uxmPc6mz13vYKyNR7yGtefdHeVy12LmG07N9hL3OfLW7eWNkb9PoyOey6TofSxl9OxK7N4cH2C 4ABobUC2OB9Ka2huvErdwcnysTjlCUTrcxxcUgAD+jp23crm80/bIIkOgrQPSY3U8bJuZTWHbntt eCRAimwUv7/vHRXFgdG6XdhdRY57HjfVlOeSS5oL72Or11EuYJW9KuZYxjKoGx/a5YXSTSE6jSpJ JJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkk lKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUp JJJJSkkkklKSSTFJSiRCyerZNVgbUw7i10kjgaQpdUzHA/Z6zH75/gsxZnO83fFihr0kW5y3LnTJ LzAWSSSWY3kOVIrDhy17D8tw3fgioeUHOxrQ36Wx234xoptIIBHBEqQ/zcfCUv2LY/zsvGMfzKky dMo2RSZOmSSpDuFjq3ipwZYWkMeRuAdHtJGkwURRSCnjc/C6k/M6n69+Pk2U1Y1npPoIFrh6prY1 vq/S58ZW10e7OzWVZg6jTlYjgdzWUem6YiC71HbS08iEZ/QsK3qx6pfuttGw0scfYw1zDmtHfXvw p1dF6fR1F/UqWGrJtBFpa5wa8u/Ocydsq3kzwlGutDUQG9Cx4ebBDFIG/E6cX8vscfC6XXmZZs9S zKxsa++ux2Rq8+n7W1td+e0OJO4ntHiqf1cxRa/CqFVtOXhs9XMuI0nc9raHseNHFsGRrC3j0Wxl dONjZt2PiVB2+tgZve5zi/d6rmkj6RmFbwen4nT6fQxK/TYSXO1JLnHlznOkklCeaAjKjxE/LpVb /NtZ1ZoT5jSJyTERHhI4zVHoPBsDhMsU9Rvf9YaaT61dAFtbazVY1ry0N/SFxbtInjXT5raTOY5W eAYuP/K4xlFdLJFfgnHkE+Kv0TwrLL6r/Os/q/xWosvqv86z+r/FRQ3aPxj/AHKf78XQo/mWf1R+ RZl3TMiy02cTbYSA4g7DLm8PA+kAVp0fzLP6o/IpqXl+bycuZHHVyFG297cZwiJdAHMsxcx2PjNa Nrm2Ofa3cRAO8idjhMEjgqeLj5deV6lv0DWRo9ztZEaPe5X0iny5/JKEocMAJ8d0D+meI9VwxRBB s6V+DEoXU+oYnTKMV9tNl7skPPteGAbHbe7HeKJvYXbA4Fw5E6hVfrDg/bcPDfXdUw4zbA9jyQ47 nbhENI4HchS/CceDJzHDzABhwn5jWrT+L5M+PluLBxCfEPlFmmOF13p+Za+o0WY+2t7/AFHWtcAW NLgI9NvPxWY7Kp6t1rHZjs9SvD3OfdrtG7sPMwrfR+jY4Lsl+Ti5OI6q1haxznFxc1zI1YBz5o+N Z0nFr9PGsopZyQxzQCfHnVXOelynLZJfdofrDCUAYy9ML0lY/epp8gOb5nGPvc6gJiRjMVKYGo1/ dbgAAgaAcBJCrysa122u1j3RJDXAmPgCpMsre4tY9jiHFh9w+kOW/ELE4ZE1RJ/i7nFEC7AA+xJV VZdYK6ml7ncNC6vp3T2YTHNrc474JDiDB+QWd9XsUMfZc57C8gBrGuBIE6kx4wt0LX5Dlvbh7kxU 5d9wP7XJ57mfcnwRNwj22JUVhdZ6y6txxsV3u/PsHbyHmtXqGSMXEsu7tHt+J0C4wkmSdSdSfND4 jzMsYGOBqUhZPYLvh/LRyEzmLjHYdy63Q87KszxVda6xr2n2uJMEaz+C6Zcz9WmNOZY88tZp8yF0 yl+HmRwAyN2Tux8+IjOREAUBtopJJMrbUVKS5b6ydRzsXqQZQcg0ihr3Mxtm4EueNxDjuMx2VSjq OXk0MyKM691dglpJAPwILZBHdSxwSMRKwLWSyCJovaJ1xhy+o/8Ac2//ADh/5FR+2dS/7m3/AOcP /Io/dz+8FvvR8XtU0hcX9s6n/wBzb/vH/kVVp6r1TIy3CnOv+zUbmWv9sPt0hrDt4ZrJ8dEfu0u4 T70exe+SkLjRldR/7m3/AOcP/IqbcjPJE5l/+cP/ACKHsHuEe9HxewSVPpFtl3S8O21xfZZRU57j yXFgJKuKE9mVSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkqfUs5+JXWyhgtysl/p49Z0buguLnkcNa0 Sfu5KBIAJOgCm097K2l9jgxo5c4wPxVY9X6SCQc3HBHI9Vn/AJJU6uj45cLs4/b8oa+teA4NJ/0V f0ax/V+ZKtiigCBW0AcANCpS+IRB9MCR3JpdwK/bHSP+52P/ANus/wDJJftjpH/c7H/7dZ/5JP6N P+jb9wS9Gn/Rt+4Jv+kf9X/zv7E8Hit+2Okf9zsf/t1n/kkv2x0j/udj/wDbrP8AySf0af8ARt+4 JejT/o2/cEv9I/6v/nf2K4PFb9sdI/7nY/8A26z/AMkl+2Okf9zsf/t1n/kk/o0/6Nv3BL0af9G3 7gl/pH/V/wDO/sVweK37Y6R/3Ox/+3Wf+SS/bHSP+52P/wBus/8AJJ/Rp/0bfuCXo0/6Nv3BL/SP +r/539iuDxW/bHSP+52P/wBus/8AJJftjpH/AHOx/wDt1n/kk/o0/wCjb9wS9Gn/AEbfuCX+kf8A V/8AO/sVweK37Y6R/wBzsf8A7dZ/5JL9sdI/7nY//brP/JJ/Rp/0bfuCXo0/6Nv3BL/SP+r/AOd/ Yrg8Vv2x0j/udj/9us/8kl+2Okf9zsf/ALdZ/wCST+jT/o2/cEvRp/0bfuCX+kf9X/zv7FcHit+2 Okf9zsf/ALdZ/wCSS/bHSP8Audj/APbrP/JJ/Rp/0bfuCXo0/wCjb9wS/wBI/wCr/wCd/Yrg8Vv2 x0j/ALnY/wD26z/ySX7Y6R/3Ox/+3Wf+ST+jT/o2/cEvRp/0bfuCX+kf9X/zv7FcHit+2Okf9zsf /t1n/kkv2x0j/udj/wDbrP8AySf0af8ARt+4JejT/o2/cEv9I/6v/nf2K4PFb9sdI/7nY/8A26z/ AMkl+2Okf9zsf/t1n/kk/o0/6Nv3BL0af9G37gl/pH/V/wDO/sVweK37Y6R/3Ox/+3Wf+SS/bHSP +52P/wBus/8AJJ/Rp/0bfuCXo0/6Nv3BL/SP+r/539iuDxW/bHSP+52P/wBus/8AJJftjpH/AHOx /wDt1n/kk/o0/wCjb9wS9Gn/AEbfuCX+kf8AV/8AO/sVweK37Y6R/wBzsf8A7dZ/5JL9sdI/7nY/ /brP/JJ/Rp/0bfuCXo0/6Nv3BL/SP+r/AOd/Yrg8Vv2x0j/udj/9us/8kl+2Okf9zsf/ALdZ/wCS T+jT/o2/cEvRp/0bfuCX+kf9X/zv7FcHit+2Okf9zsf/ALdZ/wCSRqcvEyP6PdXd/UcHf9SUL0af 9G37ggZHS+nZMevjVvIMtftAc0+LXj3NPmCiPiI6w/FHB4ukmPCyca7I6dlVYeRa6/DyDsxbrPdZ W8An0rH/AJwcB7XHXsZJC1jwrmPJHJHijsVpFPO5RJybSdTvI/FDV5/Tcm3JeSA1jnE7vI+SDm4n 2VzQHbmuGhPiFiZMGUCWQxIje5dTHlgeGAOtNVJJJV2ZRAIIPBQcUn7NVu1cGAOPmBBRkDFBFbmn Xa9/3FxI/AqQfzcv70f2rD/OR/uy/YlTJ0yjZVJk6ZJKkydMklYpFIpFApWTSqPXc67p/ScnNpDX WUM3NDwS3kDUAjxWc/p/1kvzMbPORiNfQxwaxrLQxwePz2+prHZSwxcQ4jIRGoF9SGOWSjwiJkfB 3XV1lzbHNBeyQxxAkbuYPmnWY/PzOm4rr+rGu3dYyusYrSD+kOwSLH+J8VzNfX3Mp6WCbicHc/KG 7+caaHXCPd7uO6fDl5zGhsRsCtR30+qJZ4xNHQn7XuFl9V/nWf1f4qXRbvW+3WBxex2U41kn8011 kR96j1X+eZ/V/imcPDMxPRp/FZcXJ8XeUXQo/mWf1R+RTUKP5mv+qPyKaiLpQ+WPkFkikkUl7znT ukdSo6sL7foNc4vtke+Z7TOsrbzR+qX/APFv/wCpKOgZv9Ev/wCLf/1JUuORlmxk/vRH4r+bzzzR MpAAiHD6dNnL+q8fsGsu4myf84rk8nCprqwmU0tm7Dovsd6AuO524EaDSdvddJ0hmXZ9VHV4Yach 4tbXuMCXOImfIKrk/V3rOZbjVY9AsdiD0aC8saw1tbs/we+wk8yYjwWkZiPN8zcgOLNk066Hs5XC TgwkROmOGo/it9W66qsXqGYyllWRjtcxrm1+mYDBZ9E68rr/AKtfVXpnVOkY3UeqUMyH57Kst9Rn YbHMA37eJIPZUugfVXrVGDlYudiCpxpeW2C6t/q2ubta3axrdo+P3rr/AKt4mRg/V/p2Hkt2ZGNj VVWskGHMYGuEjTspcOA+5PJMVcvT5AMGfOOCMIG9PVXdyui9K6d0v63Z+N07HZi0nAxnmusQC425 ALvwXTrB6VjdXf8AWTqPUs/GZi0OqqxMXbYLDY2qy5/qmANsiwaLeKttVwPrHmmW4TR4PefyBYZW l9YI/aTv6jZ/FZpXP85MyzzvWjwjyDvcnARwQofMOI+Zdb6tT9rt8PT1+8Lplk/V/DFOH65/nL9S f5I+j/etZa/JQMOXgDuRxfa5POTE88yNga+xSYp0ystd5rrQ/wAtu8sar/q7li3YWdTa5+BdW2qx xfZj3MJbvdy5rmEOEnWFudXE9bf/AOFqv/Plyyur/aG4FrsffvbtJ9L6ZYHA2BnPu2TCuYjpEdwG vP5i5WFkZOPl5WE79cyi828itv8AN1l8E7jtlwDRrorVrM/KLaXV/ZaTPrvDg5zmxGyst1bPcn5e UMCrGuvpdg1n7HibnfaXg77bXtLS3c/3mA8lxP50BapapZS12WnfRzB0HpH/AHFr+5Xaqa6am1VN DK2CGtGgACLtUg1M4j3W6sAEK5+WXijFYA8gON9gOxoJjQDVzvJHe6uqt1trgytglzjoAFPHey6t ljJLHgOaSCDB8ilaQHoOhgjouADqfs1Mn+w1X1R6J/yPgf8Ahar/AKhqvKlLc+bbUkkkgpSSSSSl JJJJKUkkkkpSSSSSlLLtAf16XamjFHp+XrWHf9/pNWosx3/Lt3/hWr/z5cq/N/zE/p+aY7ttJJJZ DIhyczExGh+VfXjtcYa617WAnwBcQpstqfWLWPa6siQ8EFpHjK5LpHSML6xZXUOpdVa7Ic3Jdj01 73NaxlYBEbCD+ctjpvQaejY+YzGusfRcHOZS8gtZofo90aDdz8ty+IHGcsvfjw8UeD0Hi3EZX08Q 2h1voriGt6hjEkwALq5J/wA5Wb8rFxqvWybq6aiQBZY4NbJ41cQF5j07J+qo6c2jMwci/qR3D1K3 ENLiTsgeqO0fmrX6tRl4/wBQcSrMBbaLWw130mtJeWA/2UuFu5vg+OGXHDjyR48ww/rIxHEDfrhR NjTq9vdk4+PUb77WVUiJse4NbroPcdEQEOAc0yDqCOCFxXV77q/qtn9Jynbsnpz6mBx5fSbGmp/3 afJafVuv5HTR0/CxhQyzKqB+0ZTnNpYGgfS266pU1D8OmREQPHKc8kR0iYQjGYn9RK3o0lndGzOo ZdLznVVNLSPTyMewWU2tI+kz3Fw+abrvWP2VjVvrq9fJyLG049M7Q57vF3ZCmt93yHN7MalMmvTI Efbs6SSwaes9Ww+o42D1umgfbpFF+KXbQ4R7HizWdUJnW+vZfUupYGBTjE4Tmiuy0vaIMyHBpO4m NIhKmX7hm1Nw4REZOPjHAY8XBd+b0aYkNBJMAckrM+rnWHdZ6YzMfWKrNzmPa0yJb3E+MrO+szT1 Dq/S+iWPczEyS+28NMF3pgua2f7KVarcfKSPMSwZD7ft8ZyH5uEYwZSrvs72Nn4OXP2XIqyNv0vS e18fHaSpfasX7R9l9Zn2iN3o7hv2+O2ZhYzPqb0rHzcfM6ebMOyh0uDHFwePB3qFyx+uVZh+t78n C1ycLFbkMZ++GO2vZ3+kxxRoM+LlOWz5DHFmlw+3Kf6yPCYyBoCWpFHu9icrGbkNxXWsGQ5u9tJc N5br7g2ZjRLIysbFr9TJtZRX+/Y4MH3uIXMjKpzPrp03KoO6q7A3tPkTcoYfTcf6x9W6jl9ULraM O52Nj424ta0M5d7IOqVK+4QhUss5QhHFHLkqNz4pSMeCI07dXqaMnGyaxbjWsurPD63BzfvbKVWV jXWWVU2ssspIFrGODnMJmA4A6cd1y31fP1Vp61PRs2wOyGFgw9tuwloLy4usb2A01/KjfV22urrf 1jtte2utl1Ze9xAaADbqSUqRl5EQ94j3B7eOGSEcuM45njmIUQe17h6hVx1DAOR9lGTUcgc0727/ AB+hMrF+s/XKG9BybOmZVdtksrc+l4eWCwxMsOkgGFA/ULoZw21ND68kAfrQe4u3Dk7Sdn4JV3W4 +VxRxjJzM54uOUscBGHEQYgEylZGnqDv5OZiYjQ/Kvrx2OMNda9rAT4AuIQGda6PY9tdedjPe8hr WtuYSSdAAA5c99dq6cbpvTK8ovyKashguJ+m9jWndxt1IVPo+R9R8rqmNTh9PyK8kvDqXvc7aHM9 4J/Tu8PBKtGfF8Oxy5X3z70/5w3ijExAh1PEQXr7+rdLx7XU5GZRTa2N1dlrGuEiRLXOnhGx8vFy mepi3V3sGhdW4PE/FpK4LrV/QqfrZ1E9Zx7MmstqFTaiQQ70q5Jiyvsr/wBVKaLeu2ZvR8W7F6Sa NjvVJh1m782XPn79PmlWi7J8Mxx5YZuLJE+1DLxSjH2iZAHgBu717PXU5eLkF7ce6u51R22Bjg4t d4O2nQpMysWx9tdd1b30fzzGuBLJ/fAPt47riOh229O6pmdU3fqb86zEy29mhzprs+TjB+K0+i/8 tfWT4s/JYkQx5/hscfukTMo44QnE1+kZRjKJ8uK3b/bvRP8Aywxf+3q//JIjuq9LZSy9+ZQ2m2RX abGBri3Q7XTBhecdKzPqfVg1s6pg335gLvUsrcQ0iTtiLmdvJdtjdE+r/U+kYbRiu+xNabcepz3h zfU9xktfP4pEV3ZOc+H4OVkOP7wIcZgZmEKIAOsPVr9ejeb1voz3BjM/Gc5xhrRcwkk9h7ka/Ows Z7K8nIqpfZ9Btj2tLv6ocRK5L6q/V7o+Sc26/H32Yua9lDt7xtazaWjRwmPNaPWen9B6dXndV6kP tNuUIY24NeQ6CGspG0bUqFsWXlOVjzHsQnmlLQVwRuUpVQjr2Or0QIIkcJ1j/VKrKq+r+IzKkWbS Wh3IYSSwf5sLYQaWbGMeWeMSE+CUo8Q2NGraPWwP2XfZ+dSG3M8n1OFrD8nNC1lk9b/5IzP+Kd+R ay0fh/yT82CaO94qpstifTaXR4wJWBm9WdkU0B2K6v1XDa528RLS/l1TQdB4rZ6pVdd03Lpx/wCf sosZVBg73NIbr21WEOj5tGUcmvFc6Kq/RY044LXsdZIsIFUAtcAdkk+K0hhxZcU4zIuQIFmvJEZm EhIdDbm5XWqce22nYXPpMElzQPoNsnmYh3grGHljKFpAA9Kz05a7cD7WukGB+8l13pDHdReat225 wssaNrWNGxlbgPziSGKHTqLKReXtLPVtL2tc7eY2sZq6T+6sfmcXKQwVCveiAJHi/S0v0/b0dLFO ciCflO2nRB1rrLOlV1k1+rZaSGNnaIbEkmD4qfSMxudiuy2gtFrySw/mkBrSJ78Si9Q6bidRrbXk tJDDuaQYIKniYtGHQ3HobtrZwOeeSVQ4gIkDc7t6X3c4IARl78ZEmV+mtQlTJ00pjEpMknAJMAE/ BKksU0rT6Z071Xete39GPotPc+aNndINj/Ux9rTwWcDTwhWo8lmOP3AP8H9LzYDzWMZOAn/C6X2c YpFW3dLz2/4KR5Oaf4qo4EEgiCNCCq88c4fNEx/vCmaM4S+WQl5G3C+uFp/Y7sGv3ZOe9uPQzkku cC4/ILaa0NaB+6I+5OQCRImNR8U6UpgwjED5TI+d/wC8kRqUpdwB9jm9ddgV4Pr5zS5mO9ttLW7p NrNWCGc6+KwLejUY1vQqrmRfePRy4J120OZHMabiuwgEa6piByRMcKTHnMI8Iv8AS6/vCh9i2WES Nnw/ByPq/j1YtebjUgiunKdWwEkkBtdQGpR+qX9DZluoyMq1ltPseG0hwnnncFR631nJwcttGO1g G0PcXCdxMjy8Fk5+VZn9Wsf6BrfkvEVmdwL4hXeRHKynKfNCVT4eHh3He1vPfB+fz8vjHLjGYcMs kuOVXw7DzL1+NdgZOKLcK19ra3Cp29mwyGz4lTMrHq+rOU7pBx8/1cN/2n1GbHNkjZt/lIH/ADQo /wC5uT/nN/uS5zleShnnEZzjAqojGcnT962tyXMc1Pl4Sli4zWp4hH8Kd7VMZ8Fg/wDNHH/7m5P+ cP8AyKnZ9Sm1tY9+VlBloljtwgj7lB925Q2RzUtN/wBRL+LZ9/mAQDgGu360fwdslVOqX1Y+BfZc 4Mb6bgJ7kiAAqFH1KbkWiqrLyS46/SHb+yr+P/i1gi2+x9xadKbXgt+PtCmw8py3FHJHLkyiB4uG GAi+HpZlTHl5rLRhKEMZkKuWW6vrQDS+q7HM6LQHDVxc5o8QXGF2nQsPIo9Sy6vYHhuyee6s9N6P jYVTRsa6xo+lAgeTR2C0IVjHyxOefM5NJTlKfCNhxa6tXNzIOKOCAuMQI8R3NdlQlCdJXGopMU6Z JTzH1gx7GZhvOrLQAD4FoiFQxahdlU1O4e9rT8CdV1+XiU5VXp3N3N5HiD4hc/g9Pvo6zXU9pLay Xb+22DBWRzHKEcxGQHFDJMX4a626vL82Dy8oE1PHA14jpT0rGhrQAIA4CmmTrXcpSZOmSU891UT1 t/8A4Wq/8+XIBarPUhPW7P8AwtV/58uQixWYfLHyDBMeotRt1Vl9uO0n1aQ0vafBwlpHiFPYVI41 XrjI2/pQ0s3eLSd0Hxg8Ke1OJHRZSLaUg0om1PtStVIbKarA1trQ4bgWg/vDUIzG6hAy8Wy447q4 Dqb2Wa6DaJa8f5rlcY33D4pE6BNOr0T/AJHwf/C1X/UNV5Uei/8AI+D/AOF6v+oaryqy3Pm2VJJJ IKUkkkkpSSSSSlJJJJKUkkkkpSzHf8u3f+Fav/Ply01mO/5du/8ACtX/AJ8uVfnP5if0/NMd22kk kshkeWu6b9ZOjZmTd0JlOXi5lnqux7TBY930iJezT5/JaHSMXrooyrerXtsuyB+jxmRsr0OgP+1b KSVtvJz08kOGWPHxHhEsvB+skI7Wfp0cj6q4OV0/odGLmM9K9heXMkOjc9zhq0kcFC+uHTc3qXSP s2FX6t3qtdt3NboA6dXkBbiSV62sHN5BzX3qo+57hy1rw8RN/Z9Xmfrl9XsvqdTMjpzd2UB6VrJa 3fVIeNXQPa4A8q11bF6g/HxmMwMbqVFbALca4htoeABNdjpYPPRbiSVr489lEMMCIyjgMjC7v19C QQdOlPO/VbouV0+7LyLaRg05O30sEWG7Zt0LnP1BJVv6x9Jyeo0Y9mG5rcvCubfSLJ2OLT9F0arX SSvW1sudyy5gczpxivEUBw0bsnTubecGD1nrHU8LL6niswMfp7jY2kWNtfZZptMs0ABCsdF6dm4v WusZV9eynLfW6h+5p3Bu+dASRz3W2klaZ87OUJYxGEMcoDGIRuojj49LJNk97cP6n9Nzem9I+zZt fpXeq523c12hDY1YSFP6wdHy81+LndOsbV1DBcXVb/oOa76TXcrZSSvW0HnMp5mXM+kTmZEivSeL SQo9CHmsRv10zsuh2f6XTsahwdY2khzrB+7G+wK0zp2YPrbZ1E1/qjsT0hZLfp7mmNs7vwW2klaZ c7ImXDjxYxLHLFw440KlqTvd+ZeVwvq5m4P1sGZUzd00Mf6btzf0fqbnGsNnd9Jx7Imb0nrvTeo5 HUegeldXme7Iw7dBv/ebq0dyfpBdMkja8/Es0picxCf6sYZRlG4zjE36h3vqHlei/V/qX7Vp6tn0 YuB9na4V4uIwNkva5hL9pI0DvEqz0vot46h1z7fT+qdRe30/cPez9Ju+g7c36Q8F0KSFoyfEM2Qz vhjxwjjHDY4Iwlxjh1793Dv+qPSP2blYOHX9m+1hpc/c98OrJcww9x4JWfs+v7qx0/bj1sADPt7X e6AOfpTP9hdYklasfxDMARkEeYs8YOcGZjKqsG+wG7zn1j6Z1e7B6cMJv23LwrmWvc8tYHFg+kQX M5PgoY+f9fHZFTcjp2MykvaLXBwkMJ9xH6we3kumSStUeeIxDHLDhyCPFUpxNjjNmqIH4OJhdNy6 /rN1PNuq/VMquplTyWkO2sY1w2zPbuEHpnS+odH61bVi1+p0XL/SQHNHo2eAa50x8B4eC6FJK1p5 3IRIERMZ4oYTEg1WMVGW/wAwrd57ovRL243VsXqNWyrOyLXMG5pmt/DvaTCr/VfonVun2dUGc0uN 4Yym4uafUDBY3do4kaEfSXUpJWul8QzSjmiRHh5jg4hR04Krh10uhbxXSm/XrpWDXg4/TqHVVlxa bHsLvcS4ztvaO/gup6Tb1K3CY/qlTKMsl2+usy0Cfbw5/bzVxJIm0c1zn3izLDixylLjlPHGQkT1 u5Fxfqz0/MwWZ4yq/TN+XZdVq10sdEH2krH6j0/r+X9YDn5HTDm4eMS3EoN9VbdDo8gl3PMR4eC7 JJK04/iGSGbJm4ISnljwG+IUNjw8MgR9rXwLsu7GbZmY32O4kh1G9tkAHT3s01CsJJJNSRBkSAIg m+EXQ8Bdlo9b/wCSMz/infkWssnrf/JGZ/xTvyLWWj8P+WfmGOakkkleWuN1TFvdkeqxhc0gfRE6 hZ5BaYcII5BXUELN6l082H16RL/zm+Pmszm+SPqyY7JJsx/g3eX5naE6AqgXJUqW1vuY2w7WEgOP krWN0y21rn2zWAPaCNSqJ4KonHPHwSnHSRsA9abQyRnxCMtRpYdgdGo9QP3k187P9qs5GBjXtAc2 COC3Qo1P80zv7Rr8kRbceXwiJAgKlqXMlmyEgmRuOxabumYpoNQaGz+f+dPjKfEwKcUHb7nO5cef graScMOMSEhECQFAoOSZBiZEg6lYBOkoVW1XVtsqe2yt30XNIIPwIUlLF36NJHZcpdY+y1z36OcS SF1Jtr9UU7h6pbv2TrtmJj4rJ6p0x5sN9Dd276bB4+IVH4jhnOEZRF8P6Pn1Db5LJCEyJacWxclY fXeuDDyKMWm+ul/qUuyTYWg+i+wMIbu8pJPYfJC6/wBI68/qrbKqLnV+30XNadrDGskca6rbdhXZ rK6n4ttrQ9jt5BY0PY4OaZ9p0cFU5KEceaE82E5odYaCr78Wh8nT5yMMeDHKOeHFlHFUdTGummqX smSvx86mz07ttRH7svkeIJj8iGcYwHWl7geC4kA/JsAqscQiSJSox0IAsj8h+KyOUyAMI2JbGR4Q fzP4POfWe3JGdSGtBY1o9M7Q73E6jUHy0VY5HUz1ip1tQGTLBs2D6Jjy/Fda1jGANY0NHYAQmHSv tBd6eK19jpO4sB1PckhPhIH0gSPQcMbP2W6A+InHhhD2MRMYSgTOfCPV48J+rJJY3QPq19YB1c/a KX0107hY+z6BkQNh78/mrucboeLU5r7CbHN5B+jPwUg5DJOXpvh6ymOH+LR5nNj5c8MpwySI4h7M uMa9zQcvp/TLcxwcfbS06uPfyC6G3Fpup9F7Aa4iBpEcQitaGgACAFJaeDlYYoGPzcXzE9XJzcxP LMS+Xh+UDo18TDpxa/TqGkySdTr5o6dJTxiIgCIoDowkkkkmyeqkkkkUKSSSSUpJJJJSyaBM91JJ JSkkkklKTJ0ySnCzhPXLP/CtX/V3JixEyxPXLf8AwrV/58vTlqnidB5BimNUG1RLFG/p4yMqu65+ +qkTVREAWT/OEzqQOPBWdida2kHpp9iNtCW1C1UhdtY0veQ1rRJcdAB5ojG6iEPNwm5lTabDFW9r rWRO9rddh8iYlWWt1CROiQG50X/kjB/8L1f9Q1XVS6N/yRg/+F6v+oarqglufNmUkkkgpSSSSSlJ JJJKUkkkkpSSSSSlLMd/y7d/4Vq/8+XLTWY7/l27/wAK1f8Any5V+c/mJ/T80x3baSSSyGRSSSSS lJJJJKUkkkkpSSzM/rP2PqmB0/0fU+3Fw9TdGzbH5u0z9600l88U4RhKQoZBxQ8RfD+YUkkkksUk kkkpSSSYmAT4JKXSWZ9X+s/trA+2ej6HvczZu3/RjWdrfFaaS/LininLHMcM4HhkN6P0UkksfpPX b+qZd7KcMtwaHvq+1usbJeyPb6UTrPikmGGc4znEDhxi5EkCr233Pg7CSzesdZb030KmUuysvLcW Y+OwhpcQNSXO4HmodL62czJuwcvGdg59DQ99DnB4LDw5r26OGuqVLhy2Y4vdEfRV7i6Boy4d6vS6 dVJc9/zubP2n7HZ+yfV9H9ob2xu3bN3p87PNXuq9ZODZRi42O7NzsqTTjtcGAtbq5znu0ASorjyX MCUYGFGXFXqjQ4dZcRuo8PW9nTSWVh/WDGv6dkZt9bsd+CXNy6D7nMewagEfS8iqmJ9arLL8VuZg PxMbqB24WQXteHz9He1sFkyEqKRyXMHjqH82al6huBxenX1aa6Xo9Akkkk1lJJJJKUkkkkpSSSSS mj1v/kjM/wCKd+Rayyet/wDJGZ/xTvyLWWj8P+WfmFk1JJJK8tUmTpJKYkAiFkZPR7A/djQWn80n j71sJQos2DHlFTG2xG7Jjyzxm4nfojx2OrorY4y5rQD8gipoTqQCgB2Yyb1UkkkipxPrIyx5w66W tNltj2DcwWf4J7xoa7TG5omGrO+rlU5dI2MYDRZZQQxm5oPpNb7vRrduAcZMmZXVOrrc5rnNDnMJ LHEAlpIgkeGhUGY2NW8WV1MY8N2BzWgHaPzZHbThTxzgY+Cum/2orW3D/ZTvtTMAXVl/oOJu22eo ILG/6fvulbmPQKMeqgGRUxrJ8dojuSnFFIuN4raLnDabIG4tHbdzCImTyGVAnb81UtCQCdJRpa9+ HjXuDraw8jQErC6u17c1wdIZA9Pw2x2+a6RZ/V8T7Rj7mCbK9RHMdwqnO4OPFIxHqB4jX6TZ5XNw ZI8R9J9Pk0ui4RfYMp+0sbIa3k7luALA6L9qZkwGuFLp9SRpoNF0AKXIiIwComPe+p7o5uzmNkS7 U08zquDguLcpxrgAgkEggmPbE8Rr4KP7Zwji5OUwWPqwwTYQwtkgElrd+2SO6zs/Byb8/J9Ct9L9 rDVa0A1EnWyx4e0tJ9rfa3WQPkGrpmbb0K7Fup33XVsi20MDQPTgPa2tm/ewe0gifArUGLFwxJOt xvXof5d2tZdezrGHWbGkPLqnhm0AGZdWzcDMRNredVfXNu6bmio3+iG+q8EVVtjaDfjlvs1I9le4 +C6RR5IwiBwm9SD9FBSSSSiSpJJJJSkkkklKSSSSUpJJJJSkkkklKTJ0ySnHvE9du/8ACtP/AJ8v RSwKFgnrt3/hWn/z5cmzsh2L6NhA9B9ra7nE6tFntY4f2yJUo6DwC2Q1ZFijsVjYm2hK1qHYg3ZN FF1NFhPq5BIrY0FxMck7eAPEq5tQmYVLMmzKAJusaGFziTDRrtaDoBOuiNjqqlBim1uoUw1SDdQm kqpfo3/JGD/4Xq/6gK6qXRv+SMH/AML1f9QFdTJbnzZFJJJIKUkkkkpSSSSSlJJJJKUkkkkpSzHf 8u3f+Fav/Ply01mPIHXXg6F+Izb57LLN33bx96r85/MT+n5pju20kklkMikkkklKSSSSUpJJJJTy v1opbf8AWLolLrHVNebAXsO10e3QOGonhLEoZ0j64M6dgb24eXjG66kuL2h8v9/vJP5g+9a/VOgY PVcnHyMp1gdi7tjWO2g7o1JjdIjSCE/TegYfT8mzLa+7JyrRtN+S/wBR4b+40wNEb0dSPO4hyscZ lIkYZ4ji4fSZymTGV/1bed+3H6vU9b6YJBaRdgN/k5EMhrfBhIXS9C6cOmdJxsP86tk2eb3e5/4l YmXhWdb+s+LccK6jH6cXC++9uwWFjiaxXzubuE/BdUkVvP5QceOP+Uy8ObPrfrA4I7fWX+E+fivq XWcnqF/2CzOuqvfVj5DcoUfZ9ujQysn4HzV3rrOpP6R0SrqO6nO+1sZY4Oa5wILmtfubuExBW1mf Vbp+VkW3i3IxvtBnJqosLK7fH1GwefJHyug4GTRh4/upqwLG20MrIAlnAduDpCVtg/EsBnhIHDHG brglcPRw0CZEUT0EQ4pwquk/XHAqwXPZXnVWfaWOe5+8sa8hzi8kzIUek4NXWs/qmdn2WevjZD6c bbY5notboC0NI/uXQZHSMbI6njdTe54vxGubW0EbCHgtO4bZ7+KrX/Vnp92dZmh99Dr/AOk1U2Fl dukfpGjn5FK2Ic9AxHFOcMpwRxyzAXLijMkj6xoW0f8AF9/yB/19/wCRqXWZ6h9ZMTouQ5zMB1Dr 7K2uLfVdLhtJbBgQtfo/SMbo+H9jxnPfXuL5sILpdH7rW+CbqfRsPqYrdfvrupJNORS4ssYTztcE r1Y5c3iPPZs4JEcnucEwPVAyHpnXg4mFi1Yv1gyvq9WXWdKyMX1HY7nOcKySGkNdO4Ag+Kj9ROnY ddebmMrjIZkW4zXy7SoCtwbExz35W70zo2H002PqNlt90etk3u32vjjc5S6V0nG6VVbVjue5t9rr 3GwgkOeACBta3T2pWuzc9GWLNjjOd5I4YmW3uShfHKQ8fxV1bquJ0nCfl5Rho0YwfSe48NasXoeF 1DKfm9f6g308jMpNeNQPzKokffA/1K0ut/V7E60aftN11Yx5LBS5rRJjU7mu10U+ndF+wXm77fmZ UtLPTybvUYJIO4N2jXRLox4suDHyshCVZ8n85cT8gOkInpfUvKkt/wDG1A774+f2ifyLW2vb9ccA 2cO6ftZPG4FxdHyV0fVTpYyfWDrvRFnrDD9Q/Z/Undv9Px+cK11To2L1MVutdZTfQSacih2y1k87 Xa8pWGxk57BKUgDLhzS5icpGOsPfAAFXrw1q822+nHd9asi+s3Yu5jDXJAc47mES3UauElBZjZfT /wBg5XUbxnYrnsZj4wbt9F1gaWOBH85s/lLqsTovT8XAfgNYbKbtxvNh3Osc76Tnu7kqrh/VXp2L kVX+pkXjHM41N1hfXV/xbYH4pWEx+IYP1nzAaD5bM4xxe0KP6B6kjo7KSSSDjqSSSSUpJJJJSkkk klNHrf8AyRmf8U78i1lk9b16TlN7vrLGjxc72tHzJWstH4f8k/MLJqSSSV5apJJJJSkkkklKSSSS UpJJJJSkkkklKSSSSUpMnQ7n+nU5/wC6CfuCBNAk9FDU0gzc+vDa1z2lwcY9sfxWVl9cusJbjD02 fvH6X+xU8rNyMsg2kQOGgQBKrrG5jn5zMhjkYw6d3VwclCIByC5/gndn5rub3/Ix+RavQs2+8vpt O8MEtefpc8FYZ8Bz4Lp+l4QxMcAj9I/3PPn4fJO+H+7PNxcR4Yj1Wd/BHPe3HHXCOKR9NDZupJJL YctSSSSSlJJJJKUkkkkpSSSSSlJJJJKUkkkkpSSSSSlJk6ZJTlkT167/AMKU/wDny5Wn1Ne0te0O aeQ4SPuKrt/5fv8A/ClP/ny5XoTydvIIKHag5OTjYlZtybG1Vju4xPkB3PkFbLUJ+Jjvvbe+trra wWseRJAMExPwSsdVUxaAQCODqE+0qt1l+dXgud09pdkToGtDjEEmA7TsqGXk9dZRi20Vuc+JyWbB rJc0D6JOvkEOJVOztThuqyxkdW/bQqLHnBbvDyK9Cdpc3a7Tjb95RujZPULnX151bmlm0se5u0e6 dB7W+CVqpt9G/wCSMH/wvV/1AV1Uujf8kYP/AIXq/wCoCuoHc+aVJJJIKUkkkkpSSSSSlJJJJKUk kkkpSzurYV9ppzsMA5uFuNbDAFtbwPUoLjwHbWkH95o7LRSQlESBidQdCpzcLqONmhwqcW216XY7 xttrd4PYdR+Q9tFaTZfTcDMcx+Vj12vr/m3uaN7f6ruR8kD9hdN/dt/7fu/9KKhL4fr6Z6eIX8bY SVf9hdO/dt/7fu/9KJfsLp37tv8A2/d/6UTf9Hy/fH2K42wkq/7C6d+7b/2/d/6US/YXTv3bf+37 v/SiX+j5fvj7FcbYSVf9hdO/dt/7fu/9KJfsLp37tv8A2/d/6US/0fL98fYrjbCSr/sLp37tv/b9 3/pRL9hdO/dt/wC37v8A0ol/o+X74+xXG2ElX/YXTv3bf+37v/SiX7C6d+7b/wBv3f8ApRL/AEfL 98fYrjbCSr/sLp37tv8A2/d/6US/YXTv3bf+37v/AEol/o+X74+xXG2ElX/YXTv3bf8At+7/ANKJ fsLp37tv/b93/pRL/R8v3x9iuNsJKv8AsLp37tv/AG/d/wClEv2F07923/t+7/0ol/o+X74+xXG2 ElX/AGF07923/t+7/wBKJfsLp37tv/b93/pRL/R8v3x9iuNsJKv+wunfu2/9v3f+lEv2F07923/t +7/0ol/o+X74+xXG2ElX/YXTv3bf+37v/SiX7C6d+7b/ANv3f+lEv9Hy/fH2K42wkq/7C6d+7b/2 /d/6US/YXTv3bf8At+7/ANKJf6Pl++PsVxthJV/2F07923/t+7/0ol+wunfu2/8Ab93/AKUS/wBH y/fH2K42wkq/7C6d+7b/ANv3f+lEv2F07923/t+7/wBKJf6Pl++PsVxthJV/2F07923/ALfu/wDS iX7C6d+7b/2/d/6US/0fL98fYrjbCi97K2l73BrG6uc4wAPMlB/YXTv3bf8At+7/ANKJ29D6UHNe 7Hba5p3NNxdaQR3Hql0Ij4fLrMfYrjalf+Wsih9YnpeM9t3qEaZFrDuq2bhqxjvfuHLgI0lbSSSu 4sUccRGP++tJtSSSSkQpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpCvYX0vYOXNIHzCKmhAiwR3 0UDRB7PHOY9ji14LXDkFR1nRdbdiY9387W13mRr96FR0zCodvZXLuxcd0feso/DJ8VCQ4e/V0h8R jw6xPF+DmdM6TcbWZF42MadwaeT4LeCQATrRwYIYY8MfMktHNmlllxS8gFJJJKVjUkkkkpSSSSSl JJJJKUkkkkpSSSSSlJJJJKUkkkkpSZOkkpys3D6t9v8AtnTrMdu+ptVjchr3fQc9wLfTc399D2fW 3/SdP/7bu/8ASi2Uk4T8AVON6f1s/wBJ0/8A7bu/9KJen9bP9J0//tu7/wBKLZSR4/6sVU43p/Wz /SdP/wC27v8A0om9L62f6Tp//bd3/pRbSSXH/VipxfT+tn+k6f8A9t3f+lEvT+tn+k6f/wBt3f8A pRbSSXH/AFYqa/T8d+Ng4+M9wc+mplbnNEAlrQ0kT8FYSSTFKSSSSUpJJJJSkkkklKSSSSUpJJJJ SkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKS SSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJ JSySdJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJS kkkklKSSSSUpJJJJSkkkklKSSSSUpJJJJSkkkklKSSSSU//ZCg0KZW5kc3RyZWFtDWVuZG9iag0x NyAwIG9iag08PC9Dcm9wQm94WzAgMCA1OTUuMjIgODQyXS9QYXJlbnQgMTAwIDAgUi9Db250ZW50 cyAxOSAwIFIvUm90YXRlIDkwL01lZGlhQm94WzAgMCA1OTUuMjIgODQyXS9SZXNvdXJjZXMgMTgg MCBSL1R5cGUvUGFnZT4+DWVuZG9iag0xOCAwIG9iag08PC9Db2xvclNwYWNlPDwvQ3M2IDEwOSAw IFI+Pi9Gb250PDwvVFQyIDExMSAwIFIvVFQ0IDg1IDAgUi9UVDUgOTMgMCBSL1RUNyA4OSAwIFIv VFQ4IDkwIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0XS9FeHRHU3RhdGU8PC9HUzEgMTEwIDAgUj4+ Pj4NZW5kb2JqDTE5IDAgb2JqDTw8L0xlbmd0aCAyNTI0Ny9GaWx0ZXIvRmxhdGVEZWNvZGU+PnN0 cmVhbQ0KaN7se2tz5MaR4Hf+CkTcl27HAar342LDEdJIlqWQvPaRG9pb2R84FKXhaoYjkxyN9e8v HwWgCkCjGyC7h/ZOzAS7AGRVVuU7s6r+fiarm+rMOt+YUDnZCCmr2hpReSWqu+szlX94c/bd76rb M1EFI5sYKhtto6o6PQH0d/D1kxf3rrq6ryT9u7+CN1+ey+qn+3KsDMePZ3/pYD67OPvk4sJAz4sf AZEGYMDAP9BBNyLgX+eFrS7eAMRPZ3UjhAD4K27p6uL92febL/5x+eaX19f/p7q4v7n96dW7y+o/ bm9+bba18jCNzdW2iRuAeHdf3V4/vH9793N1c1+9vAbYavu3i69xrBCrWjZKSFVdfH6GY6sOi0Qs mx+uf3n99rfrH6q/bh5eXVe37968vL6r3v5Y3b+/ebh6dX3/v6tXb+8f7qvLu2tY6eXr7cV/4/os r0/JxnplYWEwvsCxBQ77b0Jd2d8D5BcXGTWbkMhJHPs7PAj4JyutQxNUpaJulJfV1Rt6/+astrLx oaq9aQL+aBigliY22lQ1/gBdpXONgvHPamUIWAYYxVTaI51rqelzAASuqoFxOgCsNKKxMBndwDKc ahxA+CbCi9AAqaQghACHEAAHq4TuOBtV8WRwgldnP/4O+Y7re3GeVnP+4k+wvK/h6b8rXb2Hsapv q+//Jqof/hUWfA/rJS7CH2RktiRlEZVVogk2X5IUOJ8aPltXSRgRHmyAecB6FK3RKRg5uMbBImHe DvHbBh9EI6GPtjhfUOnG0VIsqmqtAv5IpZvoKvoDQ1hYS0RFuzoz9KtNI0EVBZIOBnUq59w/7ew7 NsgBF5SNuA4DghWzZQhAKJpocAUwpxpkJcKIBvGmh6szEAXfPQJ+mib14gfB04IWUilUDA/gICk8 FLdRihALP4kEPUn25z5dpDPIuglO+aqxQkKvkuDGCuCrBMYXigwrkKrRoEI4oVopXCboFiowP1yd ASLXfVMsQNyJH3AC3EpvCT4fqh2JkPCDSMAZuUVnlxpvwSL908weqT9wpuDOInwz4OwVjONiI3Xp RqVHJ/T95v9e3799d3e1rQO4ymvyh4UvQhIMdMeRnTUgk0aW1PCoerbxaF5R7xTaRW6D+ERUen5i M8Lw3CY6UMuTCSFggPUmDcNtJINPbcGg0xrzLCeZONXxR6Htw1maxsSeP8AeCBWAPZv/+hrDiLpR OMNGRq27+GETygijsRa+UnwBUcXLH3/PXzuRgOlEXhkpvVIR1yWFbaRk1F1w9f3m33/88ebq+pOL rW3C5vry6lUXLAmeCKwMEJEgUZcNhD2XOCH0AAa1QYJQ62jbeEoT1B8ur969fvitQsjxSLzmy18u 7x7eXN8+3NMC+6hIJVGsVQPDSbBD0Lsd37TxGqgFxmvnD+9+gDGqz9/evdlygDVvobSEtUJ4APZN 6ikld7s13C9TcD+p3263aXr2sxwKttYKvbTWAtRvQrAFR+5/+GrrNxet0QEG439HNlhAbKgaNTDE WiiMu5TTjSziD/Bg5JVen5131tAPrSEkLwYVHs04T6qVrha10OAkUS46kUW5jCRRX/zj5qGSKEsg 2gpVEYMQyyrJX1UnaWOzaQyFMiqCPdD7LBJGQk9gkZw7yGyKIiIfe79nOfM5r2cxWFcQubuB1wNn 2ErfJgKHt8PUa8w3FGUDs8GAdL8nCfnqs8Xbfu22XbrtVp47kbDQ0z27+Y1sAYgPchPyLl2aAsXO 5sv/2joIPjo70CeIud0DmYDZgUnIRVA1EkJbga5XYZ7G6QM4ffAHbSrhPWcj+BQtp4hkRKVwuG6u OFyR4ci8zZyrAOJgdCwgZopDkoOtBG9uiLSQEkFSIlT7AFRH99h942ic+sguGOcWvyTofKB2HELB D4JhJ/X5n2LOY+cRMVGXMRZRUd2JzObFCznS3FmGYZqICQ4EP9OLt4esHZwiyhV14bZgzwqtvWu3 O9n1TzDPEYuc4iwcEsSMRcCY3gVOyaAiG+PAIOSmihNL+AsJJagx8j6gBzAGZ8xt0GNHHoKepKDy YO0wBGkfMCZCu5Q9U4SbngIN1j8Zt0zpwarg/MCrGDthZzsFClVES9SaWduYNr2QFKQwuEwBCxti V/FLAu7GSEO0ehOIJ26/qj+3mY6kx7OYBtlYOVBwzgG+uXk5I0cGIlUI5BR4PpHLUU3hnUC/hn4K i3OGmxCkYXYArRgwjfbkzawlkYikBhw0DCViIo4DCwrCoeS4GFD4285d1q2/7DwuPB0hJJgShec4 2aE0GBhKkmNycqpGsfn28uZ2kbk3kgJWjcXcgQI4sitkRkF4ejNKD70Z5W/s6qjL0NXxSzaj2UDt OGRGqS0YdNLcP9t5jlikKdfTWnfFgjKi3rj/JReyyKJgaAFh//TSyUYptC6OGtmi9624WzD3ps5s mhSvcxc7nsGcxtoR0S5h4quynbCM4L2FxJxZDxJmrhdgOayIKGpFPkJ6qpZD1tz1qJHJWLInlvcd NJUFjMf15PBo/jHPz2DBPPs+Gd9XS5QVZJXNKHWxbmidVGGdXG6eOLe0biK3ZA/GuWXoy3ShN1Dz fnUyJX6O8x4VFz2yxgIzlF1aW9T7a4v70mYQMBjZeH2Q59lLo2MVip/tPHfXNzSkr6CLxkH0m5sE eRDT5s1FVJggaxi6KJtjMVdVYCx8aSy0SC973efcA0J3MAH7DYD2lPFo6xqhl9XpvVlQW/JmsYzs MQHPc+YzUoMnOAJXY+wgzuLi/PmLrw6ohxlNIaWOfqKQsM/4pZUfaPwOWvqurepnO8+Rh7cY/+pg RnxRzJc/v3p7ez3gDK6wGaeokJVXFuIXHQ+PX0w4NH6h4vmymOo5TGlcvLAY+5gInMuKF+z5/viX /zdXwaDjDCboshLuKO3x6EiKUIrmZSSa1N6UUu6bpKs0kNNMhUAMVolbuXFMwp0UVC0F6XhL40Zp fJsZYBq/k4J7E8xnMbsRgwPVOo0To5QyFRD/9N0h+mQ0+TbjQ6PljPRi/tQusMvPjMrys7TMPevs xunTM2MOySOf6zxHps5g2Gzc2AUp3kW+f/X2lzn1C9TfxlL9cIcSLYbAnyI8oQNfAjOgIbD2Sf/6 mF7jaaQBNI9ghgMzFR3E1wO9BiMgB+kUxWoUDo0mrJG0B9gAI+mwjRUOw5A5JXuUjq0xAB9+auOM 2SAnDDh+HScDnS8+/49DAh3Bpg2ibbc/y3PuabI83vjck50+90mOWIJVezBQRhR7gJlB/qM8KMDx VM1Azy2mnI1luWprZUV9JiUmCDjcEynKM22BrKuOzYY3H3xCY98XMczHo4LDI1/pDM75F4fseu84 aJFlN+6olWN3SO7+LCc54ggIP+5GWF9U8CZ3O+aln8MarOhY+3yjkec6zRFfIm0zW3DZwygxaco3 XS5wwHlIGcDf+FNUA1cmxM92nuNTkZzXQTibVy45P/v07upVYsoB58WMonoWHvnypYXAslU4pEDF BXSLh8b0P1OJ+llOfHzUg28XgYkMfnJjSbqyqikbKZzP7tHktc28rEsHGIHLRd2BTgjogOcc8yBd 4jYpGBuLH/pSJp4YqrnIMHmuUNKtEjpMq9CU4PEkYcuThYyCjq0W14r4VtELvpf02eXVzy9TkSe7 M1Rd3A3KtaL67wrzifcA8W0FxNBIDLy6NL5XZNIJ4G66OBoekE1FYZqPIyJ/9edfzSfwx01MAHOf IcG7O0tidJeH5ZBu8+S2B8IR4yovZOMyYQTZJIli6kJXA8zPmajx+o+zAWKZXIRlUt6aLuU4jI/w AQ+OuIbbeC7E4QEWfLD0gXK4mg1C/2RVD6joAGwaQpF/bwdXtF3W4qUnQNLB1SwkPELNZXIevEYt TDPq2qoHos027i3SkIJIkpT8y57xwg1UfBd9EDKXb3ijzB6A5z9A8V08bviP3T9U939N2fyoXh+7 f9SPf+UBxNznGl8UKPjN3CiTEBQOjAcSFCmkRgEdKjq2WIrfTlDhJgYeAIn/4SDiGN/rgvSCnyeg Sl7Wk+JRD2RZjEVxHkSMvtdjSa3nrdqHGGES4uMgz3mQZydDH0f4qI0ftfGjHD+/EQ4eZ2LAqbDg ICAxAZHHIONwaRDtfAQ4LkARN+4AKYPGKbbPc32Yu0ylPzVdwstKsB7v7BWBJxVFxSTQ+FSqbEKk MzCN0g73XPGCqgiVcya79Xlxx0eb//iu3SH9O/VV2viqCSJGU4mUVnHJ/cV52sYpitJahbJ0ao1s vDF0PFTnRX/fmEB3J60dLC80Smrc05Aho4QBuuAuPwznY9nBNBGvGirR6PyEdGhirDyNUuxBuMZ4 uu0Y8/nAKCIoPtzkB0eLoIfTgEDBUgoRgNkI3W5atKRXLekb4Y1G84A/SHiJBXLndePTiQHobiNv DZx/3u22GQesaElalKElbsU6b8qT0IoPNdT0W2NZ3VV312f88eXwGP6iMUYmK2RKoh0bWBuB0DUw AbddsNNYCmG4gCkT/TApfCBSiLQlLPHOhFJW8131m9utBFbIzQPdVgfKOdyAAQigd3d9gjZyQMBt 1X3YvO7OtX05WHfCqH2hgbrXG3iSeG2d/vIsQRmd7483NlqHyFtL0kXcAfp+89VWutDYze22hr8P 8BTh95qeXsMqdBM21Re0nLj5x7a2rnGbX+62Cs9Pba7v05t7WqhATdVG0VoAW5QdNsXopPiEUKiN 3MIfARoIY0siFb+/vKIhzeZn+LWA9BLmojcvX2+tg8E319UftzVdCt284y+EGvgVZkQ3Uc93h136 PTARdbdP9RNtpZSED4aIWNy9Y6OMEoVSg+5SwMBzYrtolCkZlIJ4K1rexpK3JIFCCcsS+GJbGyLr K6Cid43fXN62rZ+u21ZFpMMjKl7y3l2jfNDMqq7nu5cVsNlpsNybX0gwugGut2LzAw2SHX9orPTO Tt72UWS8vS52othf1WhNYqTyhked3E3NhaNk+lHQUOE2Lw0TMxqa4HQnHd9v/vx2a/Ak+Ob9Fk/g w4rxUW/ulq8ahEA+ftWHjrJn1bLbSudVa6mS5MCCQdkVaL/39OOsBnW82QLHFSh6jfvYEp75PYN7 MCBLCKKegh7qScih1ZgcWolkyr8F86Ng5REWqGIEzncvfqIXAbWBX6zQhKFFGM0/zBuWpcPskQoc Z0IXwG5va3YBIqnDZ5+ef7FFI+A29VYZBb8XiyXg8atXT7N4rcaLt9EnlZBiy+ZOfJYc4adbFyD4 25yn59ZB1lsNSmGBFE5DqLL5z0Uk0WP9ZvfQ5X0TFNjfafeyzZQlSDzfnD9gLAI+pLsgmJHk8gGE 38OK3yXS3LcrLWdnHVnYUDAoEn844qr5tETBnaH71nhlxnkYLbaBjPAUeMIH5dlQA2ucB2sFugjR OWgpmGu3ufq5qkF0Xeh8nbOmXQ6wvA2HDJ5xwWG+u9kGC9ZdRge6Dg8RRft2i4eTUeUNXizagEOE fAAAfsEPaAHwRK1D70Df2RJgJCqtxbUEAQwCnHgV2KrMv7yASAoCNZi41Wh1L7fBAVM39/dftRQd xoIdOfTgOGuf+NPxX/r57Ywr/ZjeUQP+/JoE436G4tKVFGcKAcVhoYni52+3dYTVvwZaaCJWbQzk ZbD6GmM6swHa4xoMRD82HQ7ChM4x0aFXCjWqz99unUEyvN8CpYjg/Axj0zN+Ry9zCb/IkETgNDJA ElU/7+eZyPvpG4hcaKSXbMEMMivKmBx4MTXIrHiNwtq0xuqvm2+BucLDCGDvgTBu86Z98TASqT6u 3Px1SxenAaWtQNMUX5x+IsmNJuRC9OkVkaedEaJTsdXZkELCm1+3jOBmDMUJyW/9jCco+mjOKxb8 LMSsvoGeWuvN7c8FP0FdkErUh29jQKeUsHwJsWdAAt1hJILYr69vgU0jIg1UbfNrsme0sGzVLaNi aLwI/AXyDuFk7/ocnu/bKGrhOvW2himCGzT0CtMV24G59qPvXgUgEOTaoN9Rbk0w6DsEtXAlkoTe bLpPiloOWlpC2kOBp+ne2e4dYAJdlTQEvDLwyndgoXsXcUIOJqTajkK1qGT3TnXvtGrHMK0NwrRI UwmhPUjWgKUD92rwYCdY789+N//9nLKr0oyJBByLlJaPyGGpKW9qx8fj8pbsDvRlTbHbWR4dY35M eNbTB5qGHvpsNefo9/Y539HF+Wk3MYtnrtM5HTncwU1fzhCLRi3JsqZRLUn71mp2Hg3lQn4Gu4Kh c52mORrBGC5GNN9phqOQ8pyao2OU0xp6bI7GxtgVhDYrOBr8cjxhlYZCeHoQcZ/Q4D4GpXDd5765 jp9OQGC3gp8xztJ5Co+RS/Hs6bSbodjRn1ZBj4lyIUNtXEHouU7THJXDi5sH4JntM8NP6OdPy84R xg9ibmEaMi4n8kyfXbx0K3hp7Rpri8j8aa3to1A+pbWVjY8rCO21XGhu1ehe7wGI5jvNcFQNA6mn I+8ujh4R5SKOqmFcdkAqsafTLo56u5yhM30QDVY32xQVoDEk6XNUz7sEWRa7C+R8t2CUgcLx7fYI 44ex27pZHu3M9jnf0cXqFXjMqkQWscUTq/kRUS7kp7OL1Xy+0zRHzSDuOIShs31m+GmGlx+P7oeP h3ERNw1ed19MZGUXaqcZRVX7ZWa2zywv/YlT2GOiXMjN5UWmPZ2m+Wkbtdyqz3ea4ag9sOLzhNb2 iCgXcRTmERdrznynXRwNKxgaVvIz+NMq6PEwLuRmjMuJHJfmsG5NhcmtrTC5Ubnn6Ow8IspF/HRr KkxuRYXJNdGuQBTXJbH+sIrPEzL0ERif0tr6FTUmPwjkDrC1flwvOgSP3cPNIoX1FJLs3oadBjjf LRI+ylPLxNFQLhSKKFdwKy5OYcN4E26/r5/vNKPk4eQ7d8dEuYijYcXO3Z5Ouzi6eOduvs8sP+Pp +RmfBT/jip27PZ3Od/QxfgUis2pvHa9anDqRPSLKhRx1azjqlnLUi+Vbd/N9dvMT+5126+6IGJdw E6axOKya77OLl24FL91KXroTb6sfE+VCbi7fudvTaZqfckWRaU+nGY7KR2yjreToEVEu4qgc14sO IbRewdHFO3fzfWb5GfxJa4ZHxLiQm3HxPuyeTtPcnLhisJ+d8504jRXTa3N0PCdMbvPh7Vm8v2AM XsXFI+TYxr+RQfBKQXSEBN+1vbziW7KJNdTCyxDpgkw+t1dntWyE4hvV1MJLvGx3YWS8FefS6HjR mhnuQ0Un5rHtCMi2TO/bUrVAouuaXtL4fGGD724o03ape/mpW1PvXN/2oQeJfc/oOpql5ey8ODQ6 +mOaUNweb1ylm/zaOMwgkRjWygvpoQUCh2ngWjWDi+kS1y6xVtFfDbKsFPhba7w0W0wG34KYhFI8 ohtMQkx9x/Uj9RulDd0wiNEQEELz1ScpYvU+v7NujYclArlCbCKwstQeT5xzmhjlu7ZtBD2pRsH8 h49NeojOdGPwk8jkUEFGgczFa+NvzsD6OJWeXsOTN/hkIXzqnyTZnxYyf8IRLUzNZ60WAiYn7OiJ R24hGasD2Y/DJ0DuAy2Apjt4TLAkerPEnyJ8gBBcE+HxAktx5d0X7JaQE6iS5UMQlDTUG02s6IUN 2SVKyEZEnyjQwwXwT0M4GZF/IRQhLK3QabzwE3FwrLd1feCddFiHc9kcEN4MBhcsJbMwNZbzmG8d nGqsd52R5WphpvLSos1zeFsvd+tkUoBm8BeNRnfZ8hUSEixKgiDrmcPwt1cpSm2hbIJKly8Z0naQ IBYtJDTTeAL8EAPS51ckKGC3EiS1C9TpKwOCSe4Aoc2APkbdwhIAw9oM1roR/gTw6gwtXnogK03A KuJV4h4+A2p7qL6Hynq0s8mA2h60EO6Bq+xw9OBpqfjA9CHvhdSbmlBLQmoT3Qkc2ZLAe870MAle dfDKTMyl5Ti2RYIUE3BTV3WlwmgDhS+WATFqK10EBcJYPmGFkOy/sCXZQyZOFu7AF3qPbrKbTj9a Bm+m4IfY98HPjR8G8KRY2u7qUJPzK7p00X6u6sowFXqLNAEGoogDisI5Dj1ozZejjw4h1T4I1L58 4RJpR6oSW5KNmIEEzQfN7zj3gGpAUpptK/bZZfC+h1SH9RinIlIjwZ33Zao0HMKAiprctGIsZBvv yGrDJ2pDJxBFVGydlp+BvcKbiwqciFLkEto2sNwYCLtglhK7kEhhvzfctOA/U4BZND2Rrv2F5ACl CfKbvMkRWzfiOIpEl4JXkUMTykwRoksOa0PbzMkdBuKcuN/dVP/k4sID4MWPbJOlQFcHhEQ2aekh kGKS6/7aOl/lPL+++/X6Dq9z4kX0mYDDg9mbDPi0A+GrjAQCl2UjcvUY2gi0dRQuAaWM6YKnxkJH jjyy9Ghp3NPiB19e5sR4Aj0lAxQEc+TIYUD3hN5C4rMxlJCgbMnsu21MHD/zpOFBQexTPnAEh0t0 g4e00McvGOZsNa04ZmmGpePZpWZrMKGuXV0WHWkns6gnE0+tSTytHW7VjVxJPbAaU96G0ipTmFfX +DAYx3IpYB6Z3oNr93RYQSbUAgQHHaw1QHlWi803l/fXd9Uvdze3DwcpxZg5ysB6gJAR0lSf53VY g+OYODXBXFg0G4Deu8GTKFKRNkVRlJbhmVc3fNIQmZOkoUoNnhKkyFqrZW/X8vrJlkE5IpwCGsod mChTOROLynNNLEycJNOd+QNO1EGyXQdJD8kVpKADOhSAI3PsMBwdIhaM7fXuyGYCgkwyVVVyIDG0 5GpkybOYCgyGEHqX57SoKs7Kcktn6Dk7V9hRCoMAkInYRljUrikQ1zgkEgnVpzZtDoEPqTZCSxg8 cDkOHJwbPID0sr0Lw7bo6rHtA0TFmPJa9E2YWaZmG9AAITgAyKGgD1YEyJe/4S/UbhdP5RXsk0FB H0xagmEs2OhpZVKg0oMwigSOOcM0fAcz4eAdStQobLeDYk6X9OROfaxDu0B2mjUZ0O46A/hk7+03 3729+/n+4fLh5u3tKsOm8ThSrHRAC1AaNulca9gkJYqRLK9ptLKDJzZnUvaN3pDBlIdPnSEzwQ2f ntKs7VpcN9VZqyZ3OFNw0IEPWhYXpx5l1tBO2P1mTY3RPplRA46GZUYNtMfvMmoCRxueMhvZtFbv DrNpJhQ2LTyNTVPDtgi5TQu5TdOms2na9DatJUQO9dQ2jXEdbtN6+N02DbhLl6fsh7FopuEr1M4+ oUEDA6mMpsTFazsfqbUmjCO1/OnZRmq7lvfYSE0b2nTywHx/WqOmKXAYYT52sKZ21LP6CGXCrGlN +Xax7f4sA7WxUVsaqPXF0SMGan1B+HCjpueNWkp1vRoe71pt1rRaZNYg/zQqnWFZa9faDXAqZ9L+ cGsK0ACAfzHgYF3EmlKQGDWR9ZLp3PNfVg5tRaMBVIfQGKp0ARUTh2N45NgQimlQVh1A4iVuAXkl zRPNG7PXEGmLTDif0QRz73Zo6v/iPA14/uJPWPsqjauKGk0UuiRVyo6RTWlDVEBJl7oo1YCt8Xz6 oS/fma58J1Dtav4BSBOaoNImFIsJ2hpQZyEklfD+oFFOwMKBq6qRF8JXF5/De4XvBb7TERZI72SS KVV9jVZxuDAVG1tZyO5FuS5vcA+5PVvyNYCW/axp/Gy/DBQJInYNPj0vLUiYD0JQg4MIRS2ofbF7 +rRsJ8oAJ+uWq7kqauo7gZx7spF2rWSOh3iFsSjhlV0ldB2LteH6t3WDaojXgzMOydlnIMGiER/A lCAxNrHklBvtemiq3ZfDyEFhD6zPwFGPp2OBBuV0QPcNmkEzWNh41uOV2T0gT7UyE4ep1YiIEwvz A2063pqGJdapNQ3HmVzTLm5lR7pwEzwE3LUL2qpIhhzSQJwDlfyjrCg+kSjtYLt/3PP17/QdYqD+ u6bvnuKq76rb5FSk1IAzBuOy+No5LOU3UUg81cReQdpBzG0CeinwKw43t7J6u2/ovEXNDYNOU5cb asUJnHuKuf9CewWwdDzJSnjL41/tcq0tt5IgbMO7TO2ZOa/atmlPNnFW8WMZDz3NcGdKo2jhKB6s T0DjTGHOU5EYxNKYMYkt7XBg9EkCmR4b3OF7TWe0jDfdVDP6QuAFM5SrSEsPNbh2w0PXJGzT9Ohk DkMx+5QydxhBajxN4IsXSSgHSeYwk1EQjwF6PF3kdHnqjISBD54Z3mshzdZ87hqZ7tkSYdpkWcMF k2CXDJ4WmcO9YivLMtksMjo5iKLRIQOfQilPwqaeCzayqNa4gQA3fIQnnS80LLo1pS5Yi2Ak0Pa4 SwrINUpMIia0pHtOGCmGtuBgykoEbSh6JpilNJbPoBJVa90e/8QMNxEWx+FyHGHdJ6KnwioHmhiw yIjKEXIJcp0AuadTjROiclibQcUo7kHO4GK10JlWqMN18HS4YuMMHYfNjwvX7XG/XkxahWAxeaQK nhylx5FRG7Qdan1SBpfrAmt9f0a7UwW1RAFPgrINRPF81OjsvYqSdtlsGN1pJozp3LWhAJ4aV3g+ iM9iUBbCcNgCb3+WQOkcgOMDQNiTGlfkGqgp2uAZ+9AsJ8NkyP2KQBd0OQuTZ79CxOI0Rm1ZmBwm w2QBoQgEJ0aFfTGLG4bJFhI4CFkixCR5CRZCEqd1CpSxZbAEFB8fKacVT4RzYUdkGyYiW8hSlOtC 2zgV166miRUKdW9EEts6CcGnzfGp8WlvAMmjpgK4XWHtIXTA9t6gNpEiiQiyczKqPTI5MKiV1uQv WgnaF9U6ifweBZqTjgDU9DEO7oSogC3BrQoy9YoY87TYwCphBfCE8eUHwCiR1ePQ8njO9EQY5Uj7 4ji6PE6Wd0pclmpdB8aXpOvr48tT4nK03bEgsHwS5Ts5SkkUGQeWh2V2elU6eTqks4XVKHCTaVdh dfbr3+m7MycorOKtYhfc0Surab2PLYUGR1n0sWuhI6osKoYeEDYeRI7DqqGJJEcvh+6jyfp6aAio jycqUZ4WmUOTebIS5YnR4Yn1kwZzJ0cIwiLcyeuhJ8QqR5ro3GmKlKdEBQJzohLlCVGBMmDl9ZSl yQ+AEsQEtw1PWQ39ACh1pLw4+fAOpTJ8ZDHwgRx+FMMzGD1I3tHiYbLhQR40nZWSIT+ywcep2lMs 6VJidk7ICD6dqhozuL9m+eIZncuTLjvmCA9JQx22dWey8CHwkUldPFnVAyqMfNshFB6H6AZXuKAO Lz0hyVu4mk+A8QhJ43jwmu/+8hHQtq16IDqpyb1FGjLjlKi+pFvg5QGqnYTh8C2PlxHVPIB+9gMU 38Xjhv/Y/UN1/9eUzY/q9bH7R/34Vx5AzH2mixgFCn4zN8okBMUB44Ho4lLbmL/xMgsq3MTAAyDx PxxEHON7XZBetDd3RlAlL+tJ8agHsizGojgPIkbf67Gk1vNW7UOMMAnxcZDnPMizk6GPI3zUxo/a +FGOn98IB48zMeBUWHAQkJiAyGOQcbg0iHY+AhwXoIgbd4CUQeMU2+e5PsxdptKfurj8CO88F82z wJOqoWISqL8vHaKmW8VKOwtQ2ii+sR0a7/ubsIIuwf7x3csDb0u/OKeLwelqr1ZhcPTQ6kbLymDd WWTEwmP/tFdl7WAtoVFS4xVfmW84GyCChdlLmOzgIp1pIl4EV6LRPsMQmhgrT6MU1+Uc7dfDfKIz xe67CHxPWHs5vKlnnAYEqvGm4DfMRuj2qm1781i1N48bgacnav7BC+qhsaFyuMMn0wX1RliYHhL8 /PNEbxAHVxbhoR/ejoZ+Oq81KzwmSteRBZ4UcLgncXd9xh9flpsMC8cYmaVse4G3IcCI2gj0rYH2 QtAZjIm71zBcwLSIfpgCePc6+Ealu9e4B9koZTUS4fvNze1WAgfk5mH7t4uvgT7WUTVfKSDzxedJ OK/pgnaItuo+bF4n8snqy8G6E0Znyzq9zpWjkRrRSDoTjp089DGAgmcJqgRrBdR0TRxevYe5fnW7 BYrFzcM1/TYW5lDj4ZRN9QU0AqziH1sQGtu4zS8MerfFi90b7rC5b7/e02L5rDse7oX1NFonhABp GKEUn2ylC9BBbmFwASoH1EJa8dvLK0DrYB4/4+/mcls3ZvPy9dY60N/NdfVHwBckAL7jL4QV2BVm BJaI1wss0V/gdP5NiKh/zzRnszGie2AaFpuhZHdhUZ6FR2n8nZPaRaNMieBwTbHgLMkfGEbH8vfi FbIGaeeMAE7d8uNP8KiAcNf8WBHlgCre41SBXaDITkhmmFUwZ2LYq3fbIFAOXm4DSXV1TxIiQR7A lMLv9TU0QBs2P9CQQMv2WFljpQeDh+OXx4dgBWS2QaSLrSd2ULBQ1EuqZwQU1d20XTpMrywjkiJD aCSfUTUaEJ5WXL7f/Pnt1kVc6ntUAqSli2BvQCcWr9w1Is5O2c9L1dJh9q7cNdJOyxMs2qDKvd5q EegXNNY2enMDLzxIGBkBhLjBLw6+vE3CdruIMBBEPAVhlg0zRxjtxoTxQSkmzLdgnZQHiYFlWi1A DugFeFpQNqvJYOEL8FdrdGNoMFZKyMHD7JUQHGlCN8Cog0mRClYpknp89un5F2AUHEhAvYVIBX4v lkvC4wmwbJi9klASYGLdAl9I4P9nW7H5NFHg/AukgSYaeCuauPnPRbQwE3ouOKApDiYu7jW3XjM2 CZvzB4xPQM8lnYpkl2FjMhOXD6QEesMOo40IMPouJsYRnMzPLkZiSIjkCfl0xBw7wKspVszg29jG SJpGo4P3bKs/g0jGgBEyqJUYkJnNFbo+Ci2kgwin3tZam+QJIYaxNDwGLs6rNnIxaAZxvO9utsGD pZcxkOkL0ZCBMwpZ+hP8SvgF7wiZCQD8kj6ABdAwUwyY+AVbAoxTJeQVdAbXOyamRML23ubFVil0 4K876xKcht/7+69a0g4ixZ4yTu/I/KWq0s9vZ1zqx/yOGvDn1yQa93O030v687fbOkqcuHaGiJU4 8UPLCaA9rgAUylifiN56HDzjojSPVH3eOp/3SapuB86o/X6ZPE4ibxo5CSsO384zEffTN9sa4yMH gQ0kTJBaIKtw1nfjqYEJ4zUK69Iaq79uvgXW0hx+Akahfr/BFxClp8gfRcomkeqDzs1ft6hGmKRZ CLeALCn8f2ohjibm0vTpVaIUTy7hZVAbbMpdft2yR7vpoVTMlrD5LZ/8BHkfLQbKSppMo3xMMWj1 zQ2u0qKn/bngb6c80E2kbiAn3O1LzGBwMXecpGCoegt8G5EKNc/1tNr82hk6p/K1t5wDC+BFop2F 5NH1btBJA8mLohamMXpbY3AcN4ZeWXhlu5bDjw4++u5VABoJjZOOcmuCwWBCdC1JkTb+pheKWvhK S8iRrN2Y7o1NbwCLVhoNCb0wG991DwkktrNU+KwxMVPtMLJ7p7p3WrUjmNYSYe6E5h1sd3uiDGRH CDzR78ief/a7PQDng3P1aGxEgvZl4svH5NC/583uCGPWkt2hvqwpdnrOE6A8zy7ezDr+YGgiduTC 1ZzjP6DX+a5O0cpJtzGPaq7X+ei2REdiDRl5QWHbnWrMm6Y9K521VjL1eBiX8VQX4c+BLJ3tdL6r j7VyBaa5XrMcdSfnqDtES0/AUa/XEHqu1w6emvJuzIGozDgTOExLTaPkiW3vY1CK7gpJ1lzLVVPe gjiY1MrPk3qyk4srMM10muWpt6fV0+NhXMrR4FeQeabTDn7aRq1w2/O9Zjhqy6sep2DpGOUHsr12 GKodSOq5Xju5GlZxNehVttcOQ6vj297HoHxS2+uKK1oHUtoNArxDLC9kMSuM/HyvGZ66YXD1dATe xdMjolzKU7c8v5jttIOnvhEreDrf6zzdNu1yWE9hykySOwmwM8n1w7Dh+CZ8jPIDmXBfXhs8mF96 eZLrmyDXoCrjl0MtuB+EDsdX9uNhXMrSqJcr+3yvHSwNEIks5uhspxmOhtFlyaP75COiXMbT0NgV ZnW+106ehrhcfOZ7zXA1DitDR2fq8TAu42lcU4uKK2pRsTFxBSKzKsONh9WFntDuHg/jUn46v1xx 5ntNczSIid3lvSzd02s3T6GjPHE2dEyUi7gKE1F+DanV4hwXOrlVXHVruTqoDJ2AqcfCuJSny2tR 8512cBRPPi9GNNtphp9yEFcdn5+PwPiUlhfmsaIOhb3kYssrxxWlg1CFBfltUBihZNkr/JQJ7g6I XRkugvvTisbxMC4TDdXIFTZ1vtf5rk52+Sbunl4z6q5OveV3RIxLeer1Cpb6pYFz0Gs2/Pb0muGo Hu2+HZ2lR0S5jKd6zYbfnl47uertCkzeruNpOHHR4pgol/I0ruJpXM5Ts2bTb0+vGa6aYeBzdEU9 HsZlPDWrQi2zYsuPrtmsQRXW8jSeeCP3mCiXcdWu2PKb73S+q8/yUtR8pxmO2kfsvq3k6BFRLuWo W6Gn87128NSt2fLb02uGq+4RlaF1FcZjolzGVTcM1w5KMeZ77eSq0yuY6vSeNFdMri7SAYjJ7cGa LxErNod4KQT+Sot/vaI2XuIMhmHwEkN0hK9uvHTAH4tQMDe8T2yrxCkCxPsX6VZOPtFXZ7VshOKL 3dTC65eMP2JbM8shE8fT+NR2jtot2/u2VC2Q6Loi+SVdGIG27IfnKyKv+9shfHEkLZ3I0AlW3foC 5/q2Dz1I7Hqmxey8rDQ+UAROtLjD3rhKN/nldUCbaAwr4UX10AKBwzRwDal1AQyzg7XLxpvsWpJl FcHfWiNvi8ngW4VXewthiW4wCTH1HQmAnGiUNnSJIUZDQAjNt+ukiNX7KqOTtaGJAG2ATwheapIn zjlN3PFdG7wjPalGoWwOHpv0EOl+Oo/BTyITQzwKjxx1zgM2DWKh0tNrePIGnyyIf/8kyRq1kPkT jgjmXfus1ULA5IQdPfHILSRjBVPi4vAJkPtAC6DpDh4TLMneLPGnCB8b6yMR3qmC8EzAnt2ycXQ1 bgYEJQ2VRRMremFDdokSshHRJwr0cAEywCGcjMi/EIr4hFboIF5HjsLgWJnr+sA7sEqGqNL1QXgz GFywlMzCoF1LfOvgFJDMdQaXK4u5zoMEgs5HWURvZEaAZPAX7IwA+9Nd7nyFpATiJyAynwzGMPzt VYpeWyiboIQDYUpXRfk7QYJgtJDQHKLlz69IVMB0JUhqF6jTVwYEa9oBQpsB+3uqCYBhbQZr3XBQ y4Bo8NIDGWmC1ELgLBg4g2jBVQ+uMvB2HhlQ24OWwD0QdAJBWiQ+MGXIcSHdOuBEuh4kgRPFCRwZ ksB7nvQwCV518MpMzKXlNbZFghTT05i6F6wiGH8UPWVLfYE8HAlElMH+wiWHTJ6SnWNiYeEJfKHy 6BZHY2XQZgqa534o9O6xwwCa1Em76cFr8ndFhy7sz7VbGV59b4QmwEACcUBR+MOh06z58vXRIaTa B4Hqli9cIuWShkAc0t4ILxiB5MwHza9S94BqQFKabXvbPLts3veQ6rAe42xEC+yMslxkTN0QyHgY AoLTGHJbiuGPbbwjQy0MtzuMSieMGdgrvA6pKjLbb7I2sNwYiLQkjU8Chb3ecBMS0ZAiyqLpiXDt r2wiypKEcC9rcojWjTgRN8JrB4sH5GW6qBrNcWxomzmxw0CYE+9ft/fNP7m48AB48SNbYSnQtwFd kElam0Yngku+/4yOjW+Hnl/f/Xp9hzdE8c77TIThwdZNRnjGs1uGlZXbVujaMZSBHik8AkIZ0wVL jQU/z5FGlhotjXM69Bp4VdY6gBBtVkFhL8eK7Pi7J/QREp+NoXQERUtm37GCMn7madd49cEPHjhm w0W6wUNa6uOXjLtJkZYcbbZkS7l2qdkaHIZrl5cFRNrJLNDJBNQKElAPPwU1Rx6kHhiNKScTKcEq rKtrfBiMY7kUMI9M78G1ezqsIRN6gfeDK+cCvie12HxzeX99V/1yd3P7cJBSjHmjHbzEfAe6yNxY 4zMHwakJ5sKi2cCbV27wJIrco81JFOVhIOdE1uJJY/UABQ11avCUIEXWWi16u5bXT7aMwhHhFNBQ 6sBEgWVwTpcl6Jp4mFhJpjvzB5ycg2S7DpIekitIAQd0KABHBhmINUYsGNvr3VHNBAQZZfQVBZAY 2nI1suVZNAW5WAQrssNzKvRHztlyn2fofDtX2FEKgwCQitjGV9SuKf7WqH5IJNSf2rRJgzJdDYSW MHjgehz5svIB5JcNXhi2RVeYbR8gGMYsF+wmReYuNduAhleDMW0GBX2wCEC+/A1/oXa7eKqoYJ8M CvpglhIMY8HGmFY9CKNI4JgqTMN3MBMu3gOThqG6HVRvukwnd+pjHdoFstOqAXtBhhode1e/+e7t 3c/3D5cPN29vV1k1ExoH/sMIDIhKqyada62apKQwktXFkMMOntiWSdk3eiuGww+eOitmghs+PaVN 27W4bqqzJk3u8KOQsAU+YlvcuVpp0YxoE1y716IBZmHGmJ/MpAFTw2EmjS0wmTS5w6SpgCsZnUN7 pEkzoTBp4WlMmhq2RchNWshNmjadSdOYdwY27pDb6MykafOUJi0lTmg+9QKT1sPvNGnAJcnX2nzp JU9m1Chjw1vNUT+hXbMOgTh3yavoU9Faa8k4Wsufnm20tmt5j43WrMRdpwAGxp42WAPEoJkjzMeO 1tQuy9aFKBOWDRIpNMOQdedb8M8yVhsbtqWxGpgeYY4dq/Wl4MMN255YLWW7wQ0Pfq02bFotMmyQ gxqXzrOsNWztJjhVNGmHuLUFaAGiwOqIbLz2IN9BYvhE9qs9Gf2XlWNDhAv2wogIa9IwtPMqcZgT mEcMDSFZgOjJCAMSH2Fsr6R5omljCmstbYxh2t+TBBPwdmjq/+I8DXj+4k9YACutq6a9aXRJgw1g UPhCKsB5gpxLyDCLSqzyfE6pr+CZroInUOlq/gFISPgC7zulQgWaGtBlPMKORbw/6P/PvrftyHEj ib7rK+qxaoHM4f0CGAPIktczXs9ijW4cL+CZB0luS1rLbbtbsnb+/kQEyUySeanK7KpUY1YP3cXM DDLIuDMYRCEBAwdzbJARsEW/fg7vBb5n+E56WB2941GgxO4bNIrVqoQyGD0ZoHy5fYF1OteVl3wD oGU/S0nPmX49qEZ6sKnBx+clhcBep4zfWNgf5+PH5+m5xzVzUxQ6991yBRfFYf4UjDkOIk+AMWZi FfPMq646Fj059BzIstAOD4S0ZXUaxOLxeHVmIqqjDKx9EkdgvB8cZ5jBiYekvH05EKtERfl6+zFE hmff5YQEGpKQWC8XZwZjDdamjy/Nr1kZr/KVIWBYvDJbqdLYmszxRR1fU51fHVvTYL5L1pTVc+GJ t3N4YuekFp4suNAWYzgNY+LBEQUmHPqi0f7pyNff6TseGnXfJX23FLV8v7uN3oSD4oAOOGWyyNoY zOODJ+Xg8HhwB1xX0bbyCvQKfCwWjeUnEdy2VF/RhAYW9CpZnqYVFTf3FG5/RycFsHasZyXEZelX Wi8m6oudsyI7nCrmQKtjW6VSprCh+Cl4UKEFmgxtgOGg+Y6SFmjizkQVDVZMQGA2oIqmEwkMFUmI 4mOL17HeURmVsqre/RBNLAPJiE59KTnooQFXrMLYDUnIBEk6SQF7Az7rfJJyKk0ajqdOxYsoSiN0 eV0QAyYNsm6wYoaXxWEkEqE+TIUDEtJIGYIR5LwN1hx3OjpoJgtEKOn0ybBJ9AkaYiIlT0RGZX1o vzpkyF/cpERs4rFgMyCOGFiXMtyGOptYBqiC9Da018DsQcABbRtMP5Y4drSEFjePCKHC/Y42ssod 0CGgDeTStO0UJmZfaAssuwLgJpIVqRpSaIT1mIRuhZVXmqjR9CBmlgdWSNYoP+Z8mrElLgkhA6qF OQ1TUAqZ6YQ4XQO3wmSwC2qDHEpJVIcgJUkfgpQ8UAG3x6lao0hO8pJzUvqoCyZXhaD0ffV0pwli if5tgTFFj1jQNKyVZ1gpL4udERWJADbSavD6ISqn1iuq56EmbRsCIDXB1T+hBr0KZT+xa+iJw2Er 5oMoOAgzHI1rHS8jU3A4WVw7+xWiFccwsZDFtW40rsWyRYhLlHDHwhVTx7UW8zyY7rBVWGukjHEt tjARwv3DA9u44JFIzk3EtW4krrW0YUlxrR8LaleTRHPQNC+HNNHJPbBQDY5PrY1pfKSPWBLSnkII bB8NaCMtoohoHHUsoL00PTCe5VrlL5IMHQtorWvtSIQ56gVA4x7i2bZEZTApsiK4lCtiy02RgVGS YtPAcnuMICjCjQWVl/OjW6HkA+1zbiSwvMwGb2NsBr3bafElqfv6+HJDVKANSi0KK8+igZvjBFkZ iytP29bJVXvJrVDOpUIls2XQVyQ757/+Tt+N2yAVKrFSWYtLp0LTeh+YCpVMUqH/pVOhA6qcORV6 GjlOSoUmklw8FXqMJqtToZKq+rZKTm6NTdKp3TbJya2xWdxPbxjPfQqMWGWycS50Q6R8oIl2m+zk pqhk2lZdOj+5KSqLI2yalvw0OHXaUG2UCt0eI6aYZYz2MrIKFYoLXSifCY+sLproQfKOoPipXw+t DN16FBLlqod2odgnHO/HW4R5AZ5FmTZe0N21vMpch4tiVEPHTVaSCA9RRQ22ZWezOC2Uyhtl8aRF DygwE52GEFjB0A0ucEkdXnpCmic4cl5phKhyYfAm1LaEcs3UFj0QVVWG3iwOmbGK7b6my9plvdMk YUL8lgfMiGoeQD76AWR5q/1Bw3/u/qm6/2vK5mf1+tz9s378Kw/A5j7TpYkCRXgzN8ooBMUBw4Ho llFqzN9PmQVlZmTgCoj9Hwdhl/jeFKRn6ZbNAKrkZTMqHk0ly2woivMgbPC9GUpqM2/VPsUIoxCf B3nMgzw6Gfo8wmdt/KyNn+X48Y1w8jgjA46FBScBsRGIPAYZhktVtPMZ4LIARdw4AVIGjWNsn+d6 vXcZ2/40xUVDeGdDzjwLPCkbykaB+rvNzku6ASyk0Tu8IOZbvjPe4aXn7t4qoyurf/nw8sSLzc+u 6A5vvIUrhatOkI1vhXc7JX0rjc1uPbbK0WGV1tVaXCu4xAu5PL+Rq4AIGmbPW2uru2+q9XhpW7BW 2owdrvV+Z2mU4oaboQN7Dp+NKo7fmQu3eqXl9eU6ZSQgEK1VBb9hNkymm7HpnrBI94RbhuUTTfhB eusW1mqZbW26TN4y7Q1R/Op5JDiIg6mS8HjaDv0cQOdHBFgoSreHGZYKGDyUuLt5Ej6+rM41lo0x MEvZAUM4iMBkOmOUW/feh07Dm9IwnMNtEf0ECjgiAJORALDSVggtkQY/7N/eHjhe/N6/P/zj+hsg jzaUzBcCqHz9PArnDV2ndh56dV/27yL5+O7rat0BoywvzlKWv9ONlmMJOf0PszTYCUQuThNUCWQJ cNOtbnj1ESb719sDUMzv39+E33eHRgMB97uvoOFgEf97AJGBsfa/EUCr93cHGFvsY4f78J1DA1cb qt2xvBfW00qcMGEEUBEwcvanAzeutdAChSNaGaAVDi72L14BXt36/c80EbV/cYC3L98d6Mxuf7P7 C+BzfP+BXhNK4JWbkVZXCCsRn+FMvmDMyz8HegebMaC5IfrpTOGDyYXlWBAY5KnE3zmBXTLImPAN F+RLtpL0OS9MkL5nb5AvBuhmFBL2Njy+hkcBj8Q1u98R5UCPrMXJAq96LW5aLbwMzHrz4eCYAV69 hF8L/Xf3xB8Uh/Di5iY2fqQhgZipqAwssgVrh+NXxUPAWE5cKY6dgnNqcB7eu44+08RdOEqvKDVN DXoZHEnwjKZegSlN0vLD/r9+PRiPqvHxQAS4gUfoAeqwdN0gFPLh6z55lKPrhpF8tm7ttI+ydGgk cf/Xg5TgoPbv3gGzHSz+LYqBAG+4fxvfIAjq7e0icghxFnosG2aOIFINCWKdEIEgf3sB1seiWbo9 aMnQXqUXr+GFCGZRWIgLVuhDZSXWicWpgxyVChxoRBvAgIMJgZhB7VlUiC+fXn1FZsLsm4OyEn6v l0vBg1e/aJSjMlAun6wjj+tnZPH4nn1Jzsvvnx48lgrur+LzVwfOPPw2B9AleH99cAbf//ciqqih TLMQxhT1iEs7za1cjZiDxPj91XuMTnhrOBVFRp/hot958f6gBUQo+w/RINynxZYT1MEfu5xLnpiE MRi4w1AcMcsiS+V+KHA8hTaK0zxa6awN9vpLCGWUkhRCkMDK/St0fhpDC/KBDZg3KaMvBJOuaXiM W4zlMVIKA+N434OlM8DEuwP3Nhg+r8jBKoHMfX1QHJkOHlIaBQC/xQ9gEaRz5DHCi2AZMFDlmhYG BOOEFzY3JnM5z94dsGLJkjMXRFMItroGsGL/10TlOmTsaCTtRAqAi138+eeTkPPHjR414N8fUVzu Z7jA3VEuXP16aDx3EFdKI4lqkSk/JqYAG3AJqnUKtlYs0kHpQH8gZYwbd8/BAUNXDQ44SNhtfEYq BRcUngO1dKJzHJkE19LwaZ6RzE9/OTQhWHoJkwLNVcgzj5ur6N2LySmrwyqZVnGVu7/v/xZ8JUZa WJ9k9r+kF+8H8tUHofu/H1CpcMOmGccLnULKYo5nkmivfB7MPH0FNOLd5Aivi6C9/3/7xwGvIgDX ejDhszXs/5nPPpqGidmvkwShadpYwB1D0t23b2mVGGv8XHAY9MiaID/SRP0FFkT9/foOENMegqyy p19y5A5DG2DhgGpYdW56su3/6CygETkVEhM97GqYy2yj7zymUQb1VnQtifsbrfaK3iArNLVQdAx9 03vbvXGHxjmYtdp7IJtTGGCAH+qagEExrJfbc9G/ldTE6ISTf/aILb3R1ETupo+AFimIg+AbRJ9G cuVIOAuavYhdWfdd8K5X+ij6j7L/qJLlwo0XegbgXSpFAzljDO8CGPIEX/7bEYCruiIfjBML0IKX W+ZQX4fGMW92xY9Zi3fVgFmTTTvfy6O8yq7szIYO4LFxInIQBoi52OGEXldTnYzno25mHtVcr6vh PYuexFYXFNZdOWTeVKnKOmutZuqlMC7lqbMrWDrTaYKjshV+ufDM95rhKDiEjTk6wDiupRfnKHhA u4bQc70meepW8XSwmzhNS8FD641t70NQsu7ySdZcy1UFYfJiSkOneUKP9lErjPx8rxmeQke/rZ5e DuNSjpo1dDaLtVS3bAVH53vNcFSX95e2YOkQ5SeyvboO1U4k9VyvSa4auQKTtmssr64Dq8tb3oeg PKvl1a1bxdMyvjvF9JryDueJmOZ7zTDV1LHV+Sg8xdQLolzGVFMFaydtL2Y7TfLUruKpPcJTzKR2 W1hDUcrMHncUYHKPa6uw4fIGfIDxE9lv2/LlRnW209VUH635Ckxl6HKq+bZV1HB5Rb8cxqUMNXZ5 HmG+1wRLXR2EnMTS+V4zPHWDK5YXd8kXRLmMq64Vdg2pxfItrhuEWSfIz2ynWZ5avTVLL4VxKUdX pKHcijSUb6tcKnX5aQpYTFv2N9OXsU7VYX9ayuiMdvlyGJfx27eKL7fL870mOe5WbH/ne83y1G29 VbogyiVctYwN8k1HKX2k09VUn+VJqmO9JnlKHf2WLL0kxqUcNWvobFZw1Ns1mLxdxVF+YsbojCx9 CMoz2l6cyPIkFfbieqHtxU7arsCk7al7X4SGCCbb2cJPsfmdgriaFg3HNxcN9xhOeHEiXq4RDS8X K7wYnuwdjQCO9ZpReLHxeeAlMS7jqVhxHnis1yRPl58HHus1y9P6cG4Dpl4M5TKuyuXngUc6XU31 qXNOJyGa6TTDUVmnxS5vey+IcilHzQo9ne81wVO14kTwWK8ZrqqtTwQvinIZV9WqYEstPxEMN3hW YDJyHU/N9jw1j4WnbhVP3XKe6rkM1BSm2U4zPNUPOJ1bydMLolzGUz1MLZ1EabWGp9auQWXXbXX1 A7JDq7KMF0W5lKteL99kzPea4OrwXsQJTJ3tFLa6bHx1joqBnB7p3YTbySJYRAUY4D/X+N9yauMd UacCDNa0e0MIm9ZyAwzS2N04gxeV9S6yigDxPke8+VOmwhveMhFujFMLrysH/B7bMvDcOnzQ1DaG 2onvfZuLBMS6rvElDRmumYQbJ3GNtN5OhJpk943p29b1IL7rGWc9cfFppLAISI6c6S+Cm51EFB0I YI20hPWFyefHBBLFfxS4ES0vgGFysF7eWpVdbNJBF/C3kcjDYjL4VqBsFELhTTUJNvYd148UB9+h 6OaD94qAEDpc3OLM7z7uMjJpq2Drr3dKclCZ+mjaEreMJObYro2FZfgEW3mUweqxjQ+ebriHMcIT y8QNd6fIUGMsYINtjRHx6R08WYVPGsS8f+JkdhJk/oQjYjGVzVoJAibH9OApjJwgA1YDuuLrJ0Bu HS2Apls9RlgSvVnijxFeg7pYIrwu+R0I2LObt4Zu182AoKShrkhiRS9syC5WQoI+2EiBHs5ZPYDj HvnnXCEUtEIDAoMchcExDdf1gXdgfRRRpeuD8KoanAUpmYVB+xX51sGJVlvTWdaQRsxUXvkWTDJY mSJMIysCJIP/aGa666JvkI5gRCIE2cgcJnx7E6PUBKUjFDMgSfHyafhOkCAVCRKa5Xj07Q0JCdis CEbtAi5+DYDC9IDQDoD9tdcIEGB1BqtNPagOgGjq4gOZZIKUjOEsAnAGkcBFDy4y8DSPDCj1oCWE Hgg6giAuEh8CZcg1IdEGwIly1CZaEyyyIsL23OhhIrzo4IUaG1v0sCxCshG4sQvGyrTMkcD5Skkg JkbaEFFwAGait8UWD14wcq8w/7bQc3SF3VzSWBm0GoMuMR+Dnh7bVdCkQ9KMgzfk5IoOXVCfq7RQ YfW95RkBA+HDAVlpFCtP2YR73BeH4OIYBGpavnCOlIP/JEBSp8vlBSOQnEUJQ3YXuwcUFUlptuni OmHQ1dBcnNZjuNdQFoIXy3m5HapHgMDTu9yEYsij8ZAGjTNTod2BCxlXn4G9wcuSAnyFEGT5Uxs4 rhREVzye7pBEYb9fQlPjNfEQOxZNS5RLvxDFoDBxCPKyZgjMuhGHwSJ4DpBKy9GDFdGiaGWIWF1q 5tR2lTRH5r9L99T/dH1tAfD6p2CBOUOPBpQRdFkagkuiuNThrjR6s3B59Orm7o+bO7xA+tX1bFhh wdKNhnVGth7YobQEN6BKAXaeIhjoE6MioJRSXYzUanDvIcDItj5Lw5tuAqrVusxlACXSpoGi3RAi Bn/fPaGD4PisFO02ULp49h327X74HKbdYE7CVg8hVMNFmuohLvXBS9auNczSkr3IaK7p3LXUbdkK bdLysjhIGp7FN5mEGouSZpyvT+oGTqSp7MaYn/G0ryoMrGmtq8bRYa8/j0wewTU9naAjI5phGRp/ 4xwQKajG/tsX9zd3u9/u3t6+P0kxRriDEo8bHbAALjdxeJgeot/YBIuh0XKoVlhTPbFi05E2I4I2 YLLVRNfiSWJ2FkUNtap6ipAsa60Xvonl9ZMtw29EOAZUyx1YKfBXxskiy9wQDyMryXxnPiHsyUG0 TQdJD9EdxAgFOhSAg/07QytfI2YB27vpwGYEgswyeosCiNXWXAyseRZQgclgTE45T4/xsnG6PMqp vWfnDjtKYRwAQuFTiEXthqJvieqHREL9aVTaMgjVpT5oCdVDSLiBDJjqAcQ3WDxXt1mXeU0PEA3j 7hYMJ8XlJjZjwN+G1WBYm0FBH9z8kz//JXyhdlo8ZVKwTwYFfXCP4lTAgo0hrXqQgCKC40ZhHL6D GXHyBiWqDtd1lbbpNjq5Xx/q0BTIpFkDFYWZGguxhuw9/v77X+9+vn//4v3bX29XGTaDB0Byp4Qp z0FjTiAaNk7bQk+WV7VS6OopmDPO+0ZvyIzS9VNnyJQz9dM5zdrU4rqpzlo1PuFMYePmQtllcfHq QVYNd1L6qFXDLaMYYj6bWeMoYovMGuiPnTJrelhr9kCbplxh09x5bJqo28zlNs3lNk2qzqZJ1dm0 zrrnUOe2aYhLLrBpPfy0TdO4YrwepsuwcCujphzFB3it2Z7RqFnRWm9p/2Klm4/WkhkL0Vr+9Gij tanlPTRaMw7PDiwD8+L5puEaYAZlHWC+dLwmpuxaF6SM2DXYSzFBW+/8lL2zbJjjQsumokH/lNHa 0LItjdZgNUxdOlrrU8GnW7Yj0VrY8OIBa1XdtdqySbHIssEuVKlYtAK8WWXZ0jk3pTXpEDgZAzQB zmOCBEwBw7MTxzF4IgOWCqC/Wzu2bT14WiVhCdbC2MaKyGLvHjg2RGQOTKsSGgiG+TQruDrTvIEW XEk6E2M2IwnuwNPI1P3ZVRzv6tl/YhasNK9SWAw00CmJ4nhdwWa2EAvhUNC5xHAwNzY2VCP1aTzV pfEYal0TfgDSCRRfPAOwMVeBxga0GWvVMZf37xLFBEwczLJBTsDKrp/De4HvGb6THtZH73gUKbH7 Bs1itS5hJBpfI2S1g7EKzX6qIfkGQMt+zuHJwky/HlQjQdjU4OPzktKjOTxl/MZqsJnZ+PF5eu5x zbKKcPp+uY6LIrE+BXMCSF4QsGiYSSKlhVR3HoueHHoOpBkEp7U77VmVCLF4MF4dnIjqPAMzEuII DOxFfMkjMzj1kJS8L8fhVVoPttfV3mOIS/tWl/MRClUVCF4t7ei0YWn6+Mrq05rxpVXjMLdqZaqk kLCVHl1wUXWKdWRR4gFryiq28LTbOTy1c1ILT/ZbWIxRNDpMjhd08IgQGI0m+6f5j7/TZ5Z/l/Td Usjy/e42ehLOJWD0TpksrjYG8/itZxzCYx58Add1rI3aDNsoySBwyAstuG2prKIJDZBDq2R5nlYU 2txTsP0dnRTAyrFilRCXpV1xuZinL7bNCpdkUkEcWuPQVql+KewmfgrOUxgiPQ5jwepRVG/QKJ2L KBLvbI4QRdOBBIaJpO/xscUzuXdUPKWsqrc+RBLY/ME4fA016KEBJ6zC0A3JxwRFOjkB6QVndUY5 OZEkDcczp+JFFKQRsrwuaEEnkhoiBpNHtFTzhRIRisJUOB0hbZQhDEHG22A8cJOjgw1lgQglnT4Z NobM1GC/irzWLDaq5UPT1WEDT0AblIhOPBp0lLjSmDmuKouoyiaW/6kgwA3tNDB5EJBA22LiGZBL lJpITmhx85gw0vm7drLNK8PCIaAN9NK06RQmJl9oAyy7Ct8m0hUnHjJohPSYkG6ElFe6GKoVMHrP o0okapQfcz7d2BIXw9wJKobUp+EKaiEzrRCnK+F2uFC4tatuYDepHK8XlKQQQVAeqIKbo6RUC6pD Xh1JSh+1weTKEJS+r5rudEEsUcAtMKboEYuahtXw4MfxYMyLYmdElSJSpJpoqSiIDa1XWNZj4gNu HgIotsDlY3luyPcQVHgKX1+RYwhwBEExQpjkaGgL27UiPIW9QRbbzn6FoMVbDNaz4NaNBrdYu4jl MsIdi1pMHdzq1iEF8QDaFLEtHpuF4JYO0FrNuX94dBsXPBLQuYno1o1Et15iyjdFt34stF1PEomB pBrSRCcfwUIlOD61NmbykT5iSWB7CiGwfTSujbSIIqLRVYzFtZemB4a1XKv8RZKhY3Gt12johpHm qB8AlXuIf9sUl8QrPmuCTLkixtwYm0UybBhebo9QI42GoeXlfOlGGPlA+5wZiS4vs8/bGJtsvTo1 wiRtXx9hborLEuyC2PIsCrg9TjpNGEaXp23v5Kot5WY45zKiUqgy8CuynvNff6fvxmyREzVYi33p lGha7gNzolIwvEVw8ZRoRZMzZ0RPI8ZJKdFIkMtnROcpsjohKoXA0omNUpRbY2N4aLdRgnJrbIqu 3mwXzH0KjAK3rtumQzdEygeaGLdVF09RbouLpU3VxVOU2+JSyO1Nk5OfBqdIW6qNEqLbY8Q8s+yD vf6uuwolhi6U0IRHVtdO9CB5R9D+1K+HVobuPwoICTJgF+p9wiF/vE+YkQMreEQo6yyKT7gO18Wo jo6brCwRHqKOGmzLzmzhgwsljrJ40qIHBNvQDyGw6KQbXOCCOrz0hCRPcOS/0ghR48LgTSiYCCWb qS16IKqsDL1ZHDLjFNt9Tbe2y4qnKbqE+C0Pl1uhjgA8/gFkebv9QcN/7v6puv9ryuZn9frc/bN+ /CsPwOY+072JAkV4MzfKKASFAcOB6KZRasxfUZkFZWZk4AqI/R8HYZf43hSkZ+mizQCq5GUzKh5N JctsKIrzIGzwvRlKajNv1T7FCKMQnwd5zIM8Ohn6PMJnbfysjZ/l+PGNcPI4IwOOhQUnAbERiDwG GYZLVbTzGeCyAEXcOAFSBo1jbJ/ner13Gdv+NK0pAlhuQ8Y8CzwpGcpGgfrrzc5LugMspNE7vN9s 8LDJct0q399cZXRp9S8fXp54ufnZFV3jjTdxpXDVGbKTLdOYfGatLO5vtsrReZXW1WJcK7jEO7k8 v5SLFREaps9ba6vriqr1eHFbAAab8cPhZVRLoxTX3Ayd2HP4bFRx/s5cuNgrLa/v1ykjAYForSoY DrNhMt2NTVeFRboq3DKsnmjCDxJcYBrcCtVaGQgO3Q22gOJXzyPBQR5MlYOn66hWaECWp+6xVJTu DzOsFTB4JnF38yR8fFkdaywbY2CXsuOFcAwBVlR7oG8DtGeMijBGLkvDcA73RfQTKGAdUYDxSAFY aiuElkiEH/Zvbw8cOMD37w//uP4G6KMNZfOFADJfP4/SeUM3qp3Xu+7D/l0kH999Xa07YpRFaTll +TvlaLlELPg/zBI0zgremjhL0CVvEXVLi73+CFP96+0BCOZbu39/k1rvDo0GddrvvoKGa93+fw8g NbqV+98CiNjfHbTedx3u0/d7Wm8oeccaX1gS6IsXiLRB9DJg5exPB+wq9/wA/xjoHVAMFBQoFt6/ eEWTcPuf4++LA9Bv//LdQRsOc7vZ/QWQOmx+CF8INbDNzQhuJGISXOIDwyl9wZiXfw60D/ajpr9T REtdHIqSAUbBQnrCLCQK05z0LhplTBSHa/Ilk4MoahEk8dmhMYq1Zv/m0DhmofHiNrVe32DLQGtH tHMwKgk4cA1UWoPFIbZp4SLb3nw4hK4vD7EjcF7ji9/ii5sbaDho/EhDAjVTfVmruQXTh+NXpURW kgXH4ghZuypYKSooZTbsPHEXjtJrTU1SiXfCaSAPvRNJvXKiE5cf9v/16wGUCeTu40ErXDg8ogbc LV83SEV+YjqcMsiFPr7wk4c5unK8wJIJk/PCRGmCRZM0vTtIkoN3qLVglPZv4YVJlkDCl7fpS+py u4gw4ix0EeciixRDsnQ69jfQAclAFF4kzbp9MdSxFQpR24mVgnHyMEcFA0fKKAAq4QMJOHgChp6A gRpASLL/8unVV2QJ5L45QKACv9eLBeDh6xfnWr4Uo8sX/fLB36u4fAG/Dboztf8SGvun0WpefYW0 QO24PljNgUz/vYgmckTNg+MoaxQX95pbuRpahP3VewxT0OdQgWT0Fz5aiRfvD6gPcv8h+oL7tMpy YtqQlXUFdzwxxwFvDEQRVCYxyxqF144smBwdo/8WLBNNBD4IG4z1lxBUUFgjLErkCwheYFqvft41 GMHY6P/gnaZRMWoxlvsYtSjYgtAw3789OAMWnntHJs95RYZNcQ+8fH1QELt79ImwNaFgCT5gkCSd BdW4id+DIcAolWtaCxCJE85kaKOLeYZWFun3IppQMq4iNVCO/pooW8eLHVmKIq4iA8DFLv7880lI +eM+jxrw748oGvczlOempDxXLFBeOh8pf/XrofFEHliMkUS2RikFqvFj0hHgAq4CC4qNjeRPpMBq Fxmjj93z5Es+RsG6rdwRfJdohZBgvLO5TRw5yisOn2YaKf30FwyTBAU2UZNvaN7RnRdTA2sWVsm0 iqvc/R2dQGDW64PAuvf9L+nF+4Fw9WHn/u8H1CTcrmnG8UKnwNU+P5cUV0HL01dEoDQnQuciqHZK x93LHwdhNbDsbQ8mfDb1/T/zSY+Q9QwCIDTXYf0WTECg8rfQVUrsevtzwdlehaCbjN1ir69xD4MO +A6VBh3Rzc0tMGxALKwx1z219n8MjFxYfGIZGAHLIvWAWkzb3hkY0G63F9TCzYsM8YDYq+6V7lom hAhib7ueDmjEiFOeHxRwBn0KtcBqAAYcDH/jC9G1JIf9EciF3St6h2C6eweYpJDYEV5IeGG7jo7e wdZo73E66MQEvgHLv2cizYGL1FOIDmXXUska4e4JLbxVqbasBVMI3hYUA28cgEX/8t+OQVzVdfZg cVgE94VRiyVzmILKm105Y9biXYFf1mTT7vPyKK+yOziz3t/RPOTAjYs553+809VEH2PHHccsorlO V8ObEz15bVk8obvqxrypUtV01lrN0EthXMhPp5ezc6bPKDfBUAu7VGyOdJrmJq9SpBuwcwTluH5e mJ8YOegVhJ7rNMVRZ5fjGewBTlJP6Ojltgb3QShZd48ka65kKKe0/2JCez9L5zE8arFhP9JphqHQ 0W6soRdEuZCh2q8g9FyncY6Kli3GM9tnhp94c3Fbdg4wfhp7K+q47DQq8xXcNCvwaL3K3oo6jrq8 vX0IynPaW9HaNQy1cqG9lS1fbtfnO80wVNah1PmoO8XQC6JcxFBZR2YnbCSOdJriqNXLGWrnQ2nM dqZtKkBjTNLvU204SMp2slMgV9OCUUYKlzfcA4yfxnCrdnm4M9vnaqKLlivwqFXbWMTmN1bzC6Jc yE+jF6v5fKdxjuoq8DiFobN9Zvip61uRF3fDl8O4iJu6FXo5kcXStIQeBFXHZWa2zywv7ea8tI+D l255pDPfaZybphXLbfp8pxl+mhMzPme0tRdEuYijMA+/WG/mO01x1K3hqFvLUWe31dDLYVzIzzpd dAqVZ/qMc9OuSTHZtSkmO8j3XJydF0S5iJ92TYrJrkgx2dbrFYj8uk2sOy3lc0aGPgDjOe2tW5Nk clUkd4K5dcN80Sl49BF2FntYh0HJ3GHsBMTVtFTYjQ9jL4lyoVx4voJffvEu1g9P4o47/PlOM3ru tz++uyDKRRz1a47v/IrjO7/i+G62zyw//fb89I+Bn4KtOL070ulqoo+yKxCpVQfs0FFvfB57SZQL OWrWcNQs5ihffnw332eGn3zr47sLYlzETb4isjrSaYqbZgUes5KbZuPD9UuiXMhPu4afdjE/xYpc 05FOMxwVDzhLW8nRC6JcxFExTBudQmi5gqOLj+/m+8zy09lNU4cXxLiQm37xYeyRTuPcHLl3cJyd 853CVpaNr81QkY4bPevDa7d4qUEpvMNrnaQ2/vcBBG8ZeENI8F3q5VB/Am+sCDdtI5eohZcl4hWa fJpvnjTgXEW4jE0tvAis4thYqBiHdPigqW0MtRPL+zYXCYh1XeNLGjLc4QjXOYRKXZpeeppk6I3p 29b1IL7rGWc9eYVoUPKjWlfcL2/NTrb5xXLAGokK6wuT76EZArtx4Ea01dV1juvlmKDobwrpoAb4 20jkVjEZfAta50qB8KaaBBv7jutHirdCKrpc4L0iIIQOd78487uPu4xM2rnWADqlQV9EnfqxxC0j iTm2a+M1dnwCaw/zrx/b+ODp7ngYIzyxTNwE7CKQocZYwCZBN0V8evcEUzr4pLnPnjhZnASZP+GI GqZms1aCgMkxPXgKIyfIgNW0wvj6CZBbRwug6VaPEZZEb5b4Y4T3eDsP6a51eeBG9Ou5DVES3eSY AUFBQ1WRxIle1pBbrIRsmbeRAD2cA4dUw3GP7HOuyNfTAo3UO2QoDI4ptq4PvOMGk28mmwPBV4Oz ICSzMEBbF9nWwQGprOmsakgRZhpvDFo2K2wZmZEVAZrBfzQz3b3LN0hIMCIRgmxkDhO+vYlhaYLS ESrewwyQuoMEqUiQ0IzjMXA8AZA+vyE5AbMVIaldoI5fAyB4gQ4Q2gHQei8TLAEEWJ3BalMPqgMg Wrv4QFaZIIXHC+YROINI4KIHFxl4mkcGlHrQEkIPXN8IgrhIfAiUIe+EdOuAI+l6kAhOFCdwZEgE 73nSw0R40cELNTKXxGtsswjJRuDG7usaNEIkdr6MfbsBgDA6VFQhZHC72OLBHUYeFn7AFhqPPnFk tAxejcFLxpg4E7yr4EmlpJ6aUENer+jSBfa5kgsVqNDbohEwEEUckBVesXadTbghfXEILo5BoN7l C+dIO1IVn0g2YAYSNB80v+XcA4qKpDTbJPbZjfC+Bxen9RjuOoxCglvhyl1RPYQCFVW5UcUgSLfW kL2GT9TuwIWMy8/A3uBtRQHuQwhyBqkNLFcK4i0eD3NIpLDfL6GpW50iy6JpiXTpl0NcAw0Is/Nm CNW6EYfhIzoTvIrsW1duCmGXGGJYl5o5uV0lzpH73V31P11fWwC8/ikYZM7QyQFlkE3SOIigAsll f209XN+8urn74+YOr3DihfSZSMOC2RuN9KyFQAL8M2zujCiLKdHLY1DD0NhRoASkUqoLm1oNLj8E HdlWaGnE000AuMXLCBdIkfYRFACHqDHEAN0TOgyOz0rRBgTFi2ffdav88DlMGx4EBD7lQ4jecJGm eohLffiSBSo8LdnlQb2mkuxSuyWYUZOWl8VG0vAs5slE1CkSUWbqs7mBO2kqyzHmcTxttQq2mNa6 ahwddv7zyOQRXNPTCUoyohrOkpNlwLmoGvtvX9zf3O1+u3t7+/4kxRhyxwBXFO59JHG9V1oYgoeI ODbBZGg0HaoV1lRPrNiHpP2JoD2ZbDXRtXiSEJeTqKFWVU8RkmWt1cI3tbx+smVIjgjHgGq5AzOF d1FZkWhuiIWRk2S+M58Qdukg2aaDpIfoDmJgAx0KwIFJthiS1ohZwPZuOroZgSCzTEmUHIjV1lwM rHkWh4HFYExOeU+DqmKZKM9wau/ZucOOUhgIgEz4FGVRu6FgXOKQSCRUn0alHQQ+xGQILaF6CNk3 cHKmegDpDQbP1W3WpV/TA0TGuN/V6J9wXxmbKagBQoQgIIeCPpgOIH/+S/hC7bR4yq1gnwwK+uCW xamAhZJZA1r1IAFFBMd9wzh8BzPi5GEs4wehu64yOd3GJ3fsQx2aApk0a8aj3TUegg3ee/z997/e /Xz//sX7t7/erjJsFiIIp3dKgcbw0rBxY5Jh47RN9GR5VSuFrp6COeO8b/SGzChdP3WGTDlTP53T rE0trpvqrFXjE87UUC4OKxSLy1IPMmu4n9LHzZocoj2bUQOOumVGDbTHThk1Gm1QWfZAo6ZcYdTc eYyaqNvM5UbN5UZNqs6oSdUbtWTec6hzG7WA63Sj1sNPGzXc0OCNKf1pTJpuw8Vpo89o0Rz4U017 F8vkfKSWTFiI1PKnRxupTazuoYGa03TEJMC42G1tGmBmYoj50rGamLRqKUAZsWpo9mHLXRyyP8o4 bWjSlsZpfX70gnFanxM+3aTJeZMWd7pC1uVcq42aFIuMGmw/lYgVK2utWjrupowmnQYnS4D6b6CH smBiDCqc445SnmC9UqXzdyvH9hyMCoddIGbTUGENSHtgZJCFB4wNoZiBwZQydB4mWqCQOtO8cfcK dg4PyJhUGU1w752Gpv7PruKAV8/+E/NfpXGVSqGNQo9Unm8qIEghF5h3A3GXmCXMbY0NtQ59Bk91 GTyGateEH4D0vnUinkAFMUFbA+rMgAOYxft3iXICFg48VYOsYHZ3/RzeC3zP8J30sD56x6NMid03 aBWrdQmHR+wGVsFKnQAv4lxXSfINgJb0YJgZnevXo9BIEDY1+Pi8pDYYKp2EoMG8WJEKSi8mpx+X rcvwJuuWq7ko0uqTQMacbaSplczxEO8tFhm8siuHrgOpFl5g7towWyVDqCilPDwR1ZkGOGdTH7BU ThgE2ZecMoODD0np+3IYXuX1NKsd9XA62re6nI5QqHEQWlQLG856uDJ9BORcK1O+3lkNiDiyMFtp 0+XWVGdYx9ZUjzO6piluZQVceALuHB7cOamFJzsuwO/AGw2eE8+PKD7h0BdN909Hvv5O3yEG6r9L +m4prvp+dxt9CucScHqnTBZegwc14Gk84+A+eHAKXNchN9po5XcSZI3n9Rd4ow352IQGSKJVsjxU K8pv7ino/o4OC2DtWLhKiMtqr7hew0x5nARxG2pxKpGzIrVVKmsKu4qfgh8VuFGgUcCd7RyaU4OB ybmIojRVvQyIoulMAgNGkqH42OK53DsqqVJW1TsgIgkESzBHvooa9NCAO1Zh7IYEZJQivZyA/ILX OqOcnEiShurMihdRkEbI8rpwAQ5TgBAL4+6yKBMjeQiVYiqcj5A6ylAaTQFpMB+419FBLVmgQUml T4XMQnRumChTW7PIqLwPZaNDBo6A9ikRm3gk2DxDEmhvKwluQ9FNLAhUQXYb2m9g/iAggbbFo01A LlFiIjGhxc0jwgjCAvSArXOVPqBDQBsIpmnvKUxMwNA+WHb1vk0kLI4TMmiE9ZiIboWVV5roMS+I yuFyCTKdAJnzqcaGqCwmVFAxisuKM7iCWshMK8TpOrgZLtAHAxGEL29bN6lArxeTpBBBTB6ogluj xPJcQ9ogda31URlMrgtB6/tC6k4VxBIF3ARlih6xrmlYHq+wwnRnmR9cPCaMsVBaUdRNjVdY1xPq J2jrEOCwBe7+SQSls3sTCnewJzVekWugJksRL/ahWY7FthI2bEV0CrrcR6/zX3+H77QPzmJbNxrb MohFIDpRwh0LWkwVs0g829NAQzClvAhtjZQxtsWWgj009w8ObuOCx8I5NxHbumFsKzlD0qfg1o9F tutJAqSwIIA1SXTyESxUh+MTAJpofnR9+2M2rD2JDtg+FtRGUiQJ0biHHotqL0wOjGm5VvmLJEFH glrJMRU4jDNH/QBo6QP826aoGBqPNTGmXB5ibo1Nof3bMLz8FBjBxo9FlhfzpVth5APt88Pg8iKb vG1xMfx6YnhJur46vNwWF51QLIgrz6J8m6MU2HEkrjxtYyfX7CY3RDqXDJWK48HQRLpz/uvv9N2o LZKhjgG//aWToXG9D02GSmkxkLx8NrSmypmzoaeR46RsaCTJBunQIzRZnQ6V0qM+bpOh3BgZmcyt MpRbowMh5psGc5sjBGFhZut06JZY+UATjdkkR7kpKtu6bTKUW6ICZRBi08zkp0AJYkLHhtslQz8B Sswyyz7a61AKFcoMXSiiCY+srpvoQfKOwIjUD8/tf6BKFLn7B9v9mGNmnC5QWtXyvApV21BNMH6J EdNZmH9SwiB27YAIsfipz/CymOClu4xYDwV4rj8+2V89/X9/bV68enVzf7+7//j2/as3sQ4KQiIm JdZBUfWU6PpRN8H+Y/fh/ubuHqFhNjrMBqDunvCuFAyrh9juf+hu7UeA+NvuB1oxhFLWYCUGjE4T YjjoF0y8Un8O43Wrw/EAK+W80lwMVXLdv//w483t+7EZAPlM6kHj49A6Dq2yoak4DAMjBtMBsdEa u/TVYk9fv767eU3lhbuOLiLBKIL59uaPm3f40bV6F7+GG6NPA1mPduxnP5KRbziE1BpWIziWHdtu +B++YEyDXmgHA2r45fCL14ktvv8zyISBuDwBvYCPr8JHBc/qZQQGQMEdKAwCSvgT8IejWfjgJfsi wNJr0w8ujMNP2oXXNJSmT/+4/uYJ3T7XcbI4T67iH4wq07zohYy/LwldmAeHkbhB6L5XREif8M/H z9UnGX9fYpvm8tX1k742kYMwYjkbZyCLmeJxUE4wJtKBLc0PO0DxjBmUmXlZ1KJNAgl1ykjzMMLR tgNnZopbn8rFy9RZ0VEAZqMjUgncx5FFW8PLALXsxEc7CQtmuSwu7Cc0gsobPGQ51uv/CzAAdzY/ OwoNCmVuZHN0cmVhbQ1lbmRvYmoNMjAgMCBvYmoNPDwvU3RlbVYgMTM4L0ZvbnROYW1lL0FyaWFs LUJvbGRNVC9Gb250U3RyZXRjaC9Ob3JtYWwvRm9udFdlaWdodCA3MDAvRmxhZ3MgMzIvRGVzY2Vu dCAtMjExL0ZvbnRCQm94Wy02MjggLTM3NiAyMDAwIDEwMTBdL0FzY2VudCA5MDUvRm9udEZhbWls eShBcmlhbCkvQ2FwSGVpZ2h0IDcxOC9YSGVpZ2h0IDUxNS9UeXBlL0ZvbnREZXNjcmlwdG9yL0l0 YWxpY0FuZ2xlIDA+Pg1lbmRvYmoNMjEgMCBvYmoNPDwvTGVuZ3RoIDQwNDgvRmlsdGVyL0ZsYXRl RGVjb2RlL0xlbmd0aDEgNjMyOD4+c3RyZWFtDQpo3uw5f3RTVZrfvfe95NGWNg2lP8G8+GhKm6aF Am3TdtqkSVpooJS2YAKCSdOfUGiFUu0ATpXDiAVqHV3c1VlhFH8As+MLiJvOOFAdHWdmddczzrBz HGbWn8hxp8pxEVchefu911DB9bh7ds/+t+/2u9/v+333u/e+dwNAACARhoHBgpUtxSX+H3+yEiUv IKwJDQ6IBS9f2QNA0gB4rrO/a/P6igsMQJeJ/KGu3qHO83+V/BsA43IAWtfdEWz/3THHfQCZw+hf 2o2ClMPsbgwQQX5e9+aBO+9oWlaN/Dm0v9rbFwrO78obBEh7CGPcszl4Zz/N0pWhfwDtxS3BzR27 ll98AyAd41FP/9aO/jVHn6wBSP4DANsGhHudjAEPAv8IvwhHyJ3C7DB0UmMS43lCiV5HeT187Wld 4RLBcVG8GOP3x+rIIiGRvDQ8reXXw0J+OZgQ5rCHIAdAeScO78f8yiS/CaTYRuVcXgoaPxeHqScI ubAB8qEBXoKLcJoUQBNMKG9ACHz0DrCh/H74e5iAP4Mb2oFCNtkJovJD2A8W2A2Hwc5lK6dgOVwQ UiAd5kEF6QMdzIYueIycg2XgxTEqoR7ug63Yr0L556QcNQQSYD1GfwgehdPwj/AvkIUjFsFZoief Kz8DF7RgDjtgHP7M1/L7YBY8AE/DUXgRPiBF5Aj5iH2snFJeU/4VvfJhIZTCOmjD9gP4Edo9Df9A JfaEkq3sUJ5RfgVzMPvjOOsX4RWMdZmIZA0J0afYUOxLZYtyHOuQhDlj9ticOJtGGIAn0fIsXCEz sN1DRVpDQ7FUJQP0YAIRrJjfatgMd8FeOICzeAQOwbNwgdSQbvI6+ZjOpMP0DN+kb9Q3zjgT/b1S r1zGGElgxmxvgU1wJ3r+AB6Eg+j5I4z1MraLECWlpJJUk2WkmdxPvk+eJP9OrfSP9ApLZimskPlZ gO1k77IvBD66MvZw7A2lSbkTa0mw5gm4ki6cZyvcCv2wDe6AnXhK9sIotjGs3nFsMtbzDLZfwJ/g PWzn4QL8Bfccj3NMIAXYFmCrJA7SQFaT20gX2UYeJs+TCDlNXiEfkUt0MS2ldrqSNtMu2k8H6BiV aZieoe/Tf8MsK5iHbWPfY8fZS+xX7LfsLQ64Bi7I9XDbuYc4mfs9d5G7xMV44CVsRXyQPxx9POaN rVMsSqXSphxQxrBdwBrfhLOxQB7OpwlXNQSduHP6sd2ObQhrtwdndBAew9qp1XseIvgGmMA9/Ar8 Et6At3B+f4J34XP4Aoujzm82MRMbWYj1/Q6px7YW12mQ7CTDZJQ8gnUOk1PYJsg5nGUMZ7iG+ukG Okh30gP0YfooHacT9CyuhMJ0uBKZrJ552S1sHdvABthB9tfsb9hj7BCLsAn2S45yFVwTt5XbzY1x j3PPcq9yb3Ln+AV8JT+CTeZP8T/nz+uMuhzdYl2LLqLXCUPCh0IMTsKrEIZTXz/7ZC8xkDD8HfmQ cWyYvkZ9NJGeJfdw/0TycAWqCPCjsAU+xQznkt/SMnILC5G1WL97SCdZB3/L5rDHWQO8xm8hLayJ tEML9zBc5X8BQX6EnmCUH2FR8gU9Dt0wSjdFjyp+kgwt5Ah9CnfMLqiCfC4bzlI7N05yaT49o/8J iUC1XsfsrEJIQe4Iew/TbBFSyEcQZO/i+XkHz1YzfQrfCefJOf1KzC7KnkWbXVBNjsRS4SjvpwEy hx4hy6O7o39gjyqHSBZ9FyCaGnVSF+641coxeho+gYdjX3Bvw2n6R1iNb42QdnI+xbN3B75p1sBV OhPPUwu+R/odjtaa6u9UVVbYy8uWLF5UsnBBcZGt0FqQPz/PkjtPutksmm6aOycnOyszI3122ixj qiEleWZSYsIMQa/jOUYJFHqkuoAoWwIyZ5GWLrWpvBREQfA6QUAWUVR3o40sBjQz8UZLB1p2fs3S MWXpmLYkBrEKqmyFokcS5dfdkhgha1f5kD7glvyiPKnRKzSas2jMTGTMZvQQPZndblEmAdEj1w12 j3gCbhwvnJjgklwdCbZCCCckIpmIlJwh9YdJRjXRCJrhqQhTEGZiVnK25PbIWZJbTUFmuZ5gu9y0 yudx55jNfluhTFwhqU0GqVZOsWom4NLCyDqXrNfCiD3qdGCfGC6cGNkfMUBbwJrULrUHb/XJLOhX Y6RaMa5bzvju+5lfsTi40eW793ptDhvxZPaIKjsycq8oH17lu15rVnu/H8dAX5pbFxipw9D7sYre FhGj0T1+n0z2YEhRnYk6q6n5dUgeVRLYKMozpFqpe2RjANcme0SG5iHziexsx7jyNmR7xJFWn2SW a3Ikf9A9J5wGI81DJ7McYtaNGlth2JA6VdhwckqcSJp5PdExrdMozVylvM3TlSVqRtIy3BGyGBIx E5+EcypXu45yGAmVoxk+foJecjuuSI88wxUYMVSoctVf5nMNkjjyGeAOkCb/cqMkGJfocg2fgUqq +2R6r6H+Gi1brXJBgbpF9C5cU8yxWuOX2AoHI9Qp9RtERFg+aMLaBv0VxVh+s1ld4H0RB7QhIw+v 8k3xIrTlnABHsdUv04Cqmbimmb1a1Qxf00y7ByTcyc+BeqmbLQuW6b8UQ/osT3eFTNK/Rd0xpfe2 SN5Va32iZyQQr6239QZuSl8+rYtT8iyXj+XQOEVzmKbFTXnrtLHK+JJkLhf/dNqmbo/oBdyVmoSI dbIhsHSq9yeYzf9Np4hyUfXS0Fdu8TTlCuuNfOUN/A3pJY0wTJizUG/r2pGRhBt0eMBrwxLZuyrs IHtb1vrGDXhD3dvqO0EJdQVq/eF5qPONiwAOTUqnpSonqhx4CW7YE1TQVDnjDoBhTctpAo0PRQho MuGajEAoQqdkBk2Gjw3UNRQSY3iXFtbEjl8tEj7UVvX65zT3On7l1edLvD0josfgff45CHIAuVw7 rNIdg3qdHZay3VCBulYEG+oeQF0u2m+J4weoXVFQ3oBwEaEQoQVBRGhD8CMsR9iJsIra4ccI+9C3 SvVXMTsAPpXmX4U0fg3cjNjIfQDZ3HuQp8uBpdybIKHMgvEX8UnQiHQuvwvS9HNVH+UC8st1uWjz MeawDSzcC1COvpX8HkjH3OtRV87nQ63uVoz3HqTjOE/rPiQbETfwbpSB8gkH7C0cuxXzGEKoY5fA g77LOCvUswac35tgo4+DC7EH9bMRFnI/xDlZYT7Sav5lSPsR96BNI/paUV+P9XRirk3sU1iHuBjH Xcf+Gd4kj8ARxGfRfjF3GWaRL7W4VQRXC31KsVag08G4TkcWIP4c4bKwBvL1H4AXx19/DbNF0KnW Dm8cPfGaDqF/J8Zxsp/AxniNVZinxhIAznNvUrsAygGcu6g7iGu+C2xYmw36D8g9WKtGDQ5CEPEK FXC8coQyhMo4VPDPkQSERNS3IN+ga4aQCnoTlKBvEcZqVfcG6hZgnhrE818ez1/DmGcx1tV5zV/X AAXoY2VGaLkOYBou4f3nEv7u0jA5gj7b0b+aLsTfZbvoU1MALmZUHmRGun4Kg4T03RpGX3IE5oRb jc40mofNQi3QR9LxeNym9Su1vkbri9WeFp8oNpkitOjEYRUVnpibj2ieI/GdbNPCPKOpKk/lMxyV vfmmt49lmd5BOJ5XYtpbVWLajVCMMIi8apd3LN/Ul9e3ue/7ffdyZZCejstsTBUcEfLe86vTZqTN KBuLkDMOu37s5/qxk/qxLv1Yu37sFv1YnX6sVD9WpB+z6sdy9WPz9GmCUTAIyUKSkCAIgk7gBCqA kBZR3nZY1dOfpjOoSMepPafRBqr26knHVwElAsWfm/Is5qXellrilSdC4G0T5cstUoQk4JuPl2qJ bPSCt7U2Uy63eiN6pVkus3plfdM6X5iQUT9KZboX30itvghRVNGeHPWSMQ6EKHsO5MSx3w/pgzWZ NcbqVHud+xu6QLy3fvVkWq9/vE1DL4CJbFd/DZKBk3rTg3pV2oLSMU06pkrHNGnmXPmgt8UnH5vr l0tUQpnrJyedpxw71HtJQPJ0IATkfYPdmfJwmyiGHafiFxZLoC3UreJgh3xK6nDLDskthp07vkG9 Q1U7JXcYdnhafeEdjg73CafD6ZGCbv84NJK2cMHoDeHuuxZuHApI238eMULa1CEL1IiNo98QcVRV N6oRR9WIo2rERkejFtHToy5gky8sQK0fP4YaPkkTE3AtAjlmf226ob9aW5hKc+ZdOT/lgDwDiXg3 SMJ75kwEVWVz2pyqCjeMqkpWr6BxVeZdleacn5Jn4ioDilOlWrBut37t2aY+kOnpcauAmYwrE3T4 hNFUYvVb1Y8Mfm+4Lh6PMa5ZpeMmnT6EvwR4LsQgQceHGKPZM/RciECWkF+eaW00XKpaEa1qNFyu WmGIVkFNVbRKhYULFqWaU3PNqeYuDq6KbOKqg4cr+MGZwOGBKG/z+/leSIQMKAUnAcdQmVCyoaxo 9c2LNpSWZa6elyvOK8vN31BmWy2VOWvsoslUmWdJy8uzmPLyRcucKtGSZ7qpgrPPn7ckN9diKbJl 1hRm2e+a/1HWxSZbwNZvm7BxNhtLMc2A2SaWWGWf8+tFJc78ypISY5IJ+o0mXVatq9+sTsHaeGnF ZHQy1V4crTJURaNQM1kzabQXr49GJw2TKMI/w2SqMcNutJNUox2R/d7kImvyLsPLoPKZVsMkMUxY rQsXuIYcBSTDIBitkJyQZCVpHFLpFKlUfYqVzEzEbhY/2woZBDt1PYja3U0MYBYhVevZdTQxl+Bv M51+VnpGesZsiUiz0xCbl5SWLkldbMmblb6opHTJYot0s57fHwvG3sIWIIeJBduhlbH7Y1diX8bu J7cTHf7gv/2qi2zavTuw6Td5WUbxWOx8Q25F7OVKi6Xkdzenbt94W8v8cvrUdQMcjgVib6Hf1tgo jnMlNkq20if6Vi3rTI9FF6YmciJpf6XJyokiZ2sgv64t4mM/o76l7rXGqbtLyf+3/7oR6f+qaWuQ AHdN3ylvnfqogHqyU5CbojmkN8VpHdLfRS1wM5CLwH1xmsBNxBmnKSST2+I0Q/nmOM0hvS9O65A+ 2jrU39EZDHWIR8XW7g5xRd+WvgEUia6+rf19W4MDPX1bxP7eUJHoDg4Ev83I2dsrNvd0dQ9sE5s7 tnVsHexoX1a/3Ll0pbVlaHNbX++K1m9noRWGoB86oBOCEEIswlGEVujW6BXQB1sQBuJWIriQ24q0 2gdR3qNZiCjpRf8ipNyaPPg/HsmJI/UibkZJF3oPwDaN60DcgbaD2LfDMqiH5Wi7FFZq/7g6BJuh DUfoxUitmnUXbEcuiB7fbvu/0cZ3zQQG47VdQsEAxbAaqY/5Q3BNr34wts1/6LaUqs+EuYImfmLp C5UqfrHezitKrFr4UEjU/qciviP/Q4ABAGX05UMKDQplbmRzdHJlYW0NZW5kb2JqDTIyIDAgb2Jq DTw8L1N0ZW1WIDAvRm9udE5hbWUvSUdMQUhPK1N5bWJvbE1UL0ZvbnRTdHJldGNoL05vcm1hbC9G b250RmlsZTIgMjEgMCBSL0ZvbnRXZWlnaHQgNDAwL0ZsYWdzIDQvRGVzY2VudCAtMjE5L0ZvbnRC Qm94WzAgLTIyMCAxMTEzIDEwMDVdL0FzY2VudCAxMDA1L0ZvbnRGYW1pbHkoU3ltYm9sKS9DYXBI ZWlnaHQgMC9UeXBlL0ZvbnREZXNjcmlwdG9yL0l0YWxpY0FuZ2xlIDA+Pg1lbmRvYmoNMjMgMCBv YmoNPDwvU3VidHlwZS9DSURGb250VHlwZTIvRm9udERlc2NyaXB0b3IgMjIgMCBSL0Jhc2VGb250 L0lHTEFITytTeW1ib2xNVC9XWzE0N1s3OTBdXS9DSURUb0dJRE1hcC9JZGVudGl0eS9DSURTeXN0 ZW1JbmZvPDwvU3VwcGxlbWVudCAwL09yZGVyaW5nKElkZW50aXR5KS9SZWdpc3RyeShBZG9iZSk+ Pi9EVyAxMDAwL1R5cGUvRm9udD4+DWVuZG9iag0yNCAwIG9iag08PC9MZW5ndGggMjE5L0ZpbHRl ci9GbGF0ZURlY29kZT4+c3RyZWFtDQpo3lRQMW7DMAzc9QqOLTrIcTK0gGEgSDN4aFLUbndFol0B MSXQ8uDfVxKcBB1Igkce7kh5aN4bsgHkJzvdYoDekmGc3Mwa4YKDJdiUYKwOa5ezHpUHGcntMgUc G+odVJWQX3E4BV7gqeteX4pnkGc2yJaGiOzK75+ItLP3VxyRAhRQ12CwF/LwofxJjQgyEx9gt3iE MvebVdsZnLzSyIoGhKoo3rb1rSCZ//Mb69LrX8Xisb0/1iJur3jipZvuPvTMHC3mw7ORZMES3n/j nU9qKcSfAAMA8X1qrQoNCmVuZHN0cmVhbQ1lbmRvYmoNMjUgMCBvYmoNPDwvQ3JvcEJveFswIDAg NTk1LjIyIDg0Ml0vUGFyZW50IDEwMCAwIFIvQ29udGVudHMgMjcgMCBSL1JvdGF0ZSA5MC9NZWRp YUJveFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDI2IDAgUi9UeXBlL1BhZ2U+Pg1lbmRvYmoN MjYgMCBvYmoNPDwvQ29sb3JTcGFjZTw8L0NzNiAxMDkgMCBSPj4vRm9udDw8L1RUNCA4NSAwIFIv VFQ1IDkzIDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0XS9FeHRHU3RhdGU8PC9HUzEgMTEwIDAgUj4+ Pj4NZW5kb2JqDTI3IDAgb2JqDTw8L0xlbmd0aCA2MzYvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJl YW0NCmjejJPfb5swEMff+SvuEarY9RkMJpomtRS13cO0BdROXffAKE2oEtiALOofsv29O5uVJlEf JqSz8Y/Pfe/O99NBqMFRYcQDDSFygQhMBQIiKaCrHLm/sXFuT6BxBOgAeaxBxYpLYP/+6PQt7Z4m fQhlD2i/vqSVywxh2R+y9nw8Op+nM+e5c5rnAd3MH8lR4BsyGwfyq7kOASPNI18oyDd0ZOlwIUQI eekwM6ObO8e9qZqHtuuh3vxYV5uqGYqhbhsvf6IbvpXLxkEAqtiABY5ECwkMzkykoX11f3sMUSGX buIxHrrbriPm+hlC+HXsqXqA7Ozmmnnf8g8OciVEDIyCjrSG/GLkS8MXVmnyKYO6gWFV1R2kNHRN NUC2q4dyVfWjYknyKNHjQL8kXVKOZHCoGl9U46j6j8fiQPLYvfJ44PoJ3JNpN/feHDJFutLr2TjJ 7AQlrVjVVAI1lkAKLrWMyClJF5PqdwJL/z1pey0WQ6qK9qMx1lhOsfpTaUIbcIoyPJtBikqS9aU2 VkkTKV0NYm3T5Uu0iClbNMHgIK7QvcvTOdx9WSA9jViImTLGJ3NmwxAWhDG+gNQUwATx3QsP3XpZ D8UaklXdFHO4SBYZo8dtWErsod7QZMI70LTweORu66e6msPikmU6JE2ZipS1IVlpVGaS1i06P9lL 7ATS7rnRNeyK5zmc10M2dFWxgYg8ziC01hdCvB2nnFJ+nLHEqDOPtJxDShgomgdK/wQ66o1AR6bj jtvDlvS1K9B2hXLrvmxncLUtdlXtMRnFtFN0FRTrvoWyXa+L721HjdgsgZ73Cv63Q9LFxzSHx7Z7 o53T3PkrwABbXh9RCg0KZW5kc3RyZWFtDWVuZG9iag0yOCAwIG9iag08PC9Dcm9wQm94WzAgMCA1 OTUuMjIgODQyXS9QYXJlbnQgMTAwIDAgUi9Db250ZW50cyAzMCAwIFIvUm90YXRlIDkwL01lZGlh Qm94WzAgMCA1OTUuMjIgODQyXS9SZXNvdXJjZXMgMjkgMCBSL1R5cGUvUGFnZT4+DWVuZG9iag0y OSAwIG9iag08PC9YT2JqZWN0PDwvSW0yIDMxIDAgUi9JbTMgMzIgMCBSL0ltNCAzMyAwIFI+Pi9D b2xvclNwYWNlPDwvQ3M2IDEwOSAwIFI+Pi9Gb250PDwvVFQ0IDg1IDAgUj4+L1Byb2NTZXRbL1BE Ri9UZXh0L0ltYWdlQ10vRXh0R1N0YXRlPDwvR1MxIDExMCAwIFI+Pj4+DWVuZG9iag0zMCAwIG9i ag08PC9MZW5ndGggMjY5L0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFtDQpo3qyQS0/DMBCE7/sr 5ghI2Xj9zpGXUI9VLXpGUVsKSkProP59nIZW5Y58sHd3ZueT9yTYgpwPbCO8sBJB5axC0AqHFenr QUfLO+xIIVrhJsI1jjWq36qol2VaP2aPNkNOJ7el87IQbPLfXVcZa5pfNA+J6pRscaZ1CTKnzdV0 jblsPEQbNk45pK5INlSxUkojtaVKR7pZ3L/OkI/boX3HsMoD1v0BohTat+7rO2O3Go794TPfpg96 TrQfc8pKLwGVtoGjL1HG+vFhxbEJgrajetZpPPUF9uSQyNYXNm0iu2JwKrBHVBzcWW7O8n//5Ik5 ctOMzNKw6BFhSrCqYX9hthPEnH4EGACl0GrjCg0KZW5kc3RyZWFtDWVuZG9iag0zMSAwIG9iag08 PC9TdWJ0eXBlL0ltYWdlL0xlbmd0aCA1MDEwOS9GaWx0ZXIvRENURGVjb2RlL0JpdHNQZXJDb21w b25lbnQgOC9Db2xvclNwYWNlIDEwOSAwIFIvV2lkdGggNzc1L0hlaWdodCA0NDkvVHlwZS9YT2Jq ZWN0Pj5zdHJlYW0NCv/Y/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkIDAkJDBELCgsRFQ8MDA8V GBMTFRMTGBcSFBQUFBIXFxscHhwbFyQkJyckJDUzMzM1Ozs7Ozs7Ozs7OwENCwsNDg0QDg4QFA4P DhQUEBEREBQdFBQVFBQdJRoXFxcXGiUgIx4eHiMgKCglJSgoMjIwMjI7Ozs7Ozs7Ozs7/8AAEQgB wQMHAwEiAAIRAQMRAf/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEA AAAAAAAAAQACAwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFhEyJxgTIGFJGh sUIjJBVSwWIzNHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX0lXiZfKzhMPTdePzRieUpIW0 lcTU5PSltcXV5fVWZnaGlqa2xtbm9jdHV2d3h5ent8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhED ITESBEFRYXEiEwUygZEUobFCI8FS0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2 dGXi8rOEw9N14/NGlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQAC EQMRAD8A8/8ABOAl4J4ULKpOIShPCSlJ0tE6CVJJJ4SUsE8Jd06SlJJJIJVCdIJQkpUJJ0klLJJw lCSloTwkUklKSTpQkpZJJOkpaEk8JJKWhMQpAJklLQmUkoSUxShOlCSlkoTwEkkI7f5t/wDVKyWr Xu/mn/1T+RZDVJDqsydF0oSTp7GskkkkpZJJJJStEoS0SSUqExUkySVo8kk6SSFkuEk6SlJJJ0lL J0k6SlJBJOAkpSSdRSUpPKZOkpUlSaoorG6JKZgJ4TjhOBqgpQGicJAahIBJKgAnhOAnAQUtCeNE 4CdJSwGimAm8FMIFKgFIAJoUwEFLtH4Kf55EQJkKGnKmSXEGsbpAB+I0SUuUkxLmx6jS2eDoR+Ck CElKShPonSUxITRCkU0IJWs+l9yiJUn/AEimCKGQUoTBOOUlL6DRM4EwG6lLRGrAb7iOeEUL1Vtr Ht1ceXdypd9UnWDtoo7pKNKXJUbg2ysPP02HnxafFNElM8/mD87+CRCmHtHJ+SifJE2+ICiWpqWE JtVOE0BJSOElIpJKae1LajbE/pplstIdqeEX00+wpWmkUJQi7EvTStVIgE8ImxLYlaqRwkibCmDS haWKdS2lLaipjCSltKfbqlamCdPtKeCkqmKUKUFKEFMYShSgpAJKpZMpQlCSVkoTwlCSFkk6SSmM JKSZFVLQmUkySFkoTpJKWhJOkkqkd38y+f3SsdvC2L/5l/8AVP5Fjt4UmPYseTcLpJ0k9jWSTpik pZJOlCSlkk4CSSlJk6RSUsnSSSUskl3SCSlJ0gkkpdJJOElKTpRwnKSmJTKUJbUkrJKW1SDUkLNa jNAAUQFONEErgJwkE4BSUoKUe4o2PiWXgkENA0krQq+r91kOJeQRptaANP6yZLJEbldGEjsHJTwt LM6dTi1F0OLxMh3kCs5vuAPilGQkLCjEg0V4ShOAnhFCo4UmjVIjUfBO1AqZAJwEwUhKSVBocdfo 9/NFGmnAHAUeOUpJ0HHdGlqQO08R3HioFu1xDfo8ifAqYEaqMkmfl9yRSFap4SSlBSiEgNQPMJSn bJcEEo3ak/FJOdTKQRKAvqnCUdk4SUoBEc32Md21B+KGCjMe0tcx4ljuQOZ7EJDRXRiAU4akWWt/ my2wfHa75gpoyTMNaI11cDoPIJ1hFKc9rRr8vio7XTudo49vAJNa0HfO93Zx0A+ATygSliZTQpSm KCllEqUaJklMCknKSSlwxPsRgxPsUHE2KQ7EtiPsT7ErTTX2FLYrGxNsStSDYlsKsbE+xK1NbYl6 ZVnYmLErVTW2J9iP6afYlaqa2xL01ZFaWxK1U1tiWxWPTSLErU1tiWxWSxN6aNqpr7E2zwVnYm2B K0U19iWxWPTTemlaqa+wpbVY9NN6aVqpr7UtqsemlsStTX2lNCsbExrRtVNeEoKOWJjWlaqQQlCN sTFiNqpFCSLsTbELRTXv/mbP6p/IsZnC3Mhn6Cz+qfyLEYNFLj2LFk3C6SSdSMaySUJJKWSSCSSl dkkkklKSSSSUrhIpJJKWSSTpKUE4CSdJSk6Q1TwkpSUaqUJ4QSxAUgPBOBKmAkpgB4qQCkUgkpSf sEoTxqgpcBPqEgFKNErU7n1Zx/V32Ebgxw0PiV0tW03urDtWgHb5HQrC+qZmi1sS7eCB+Cv2nrZz 91VVbMVpgWGN5rkT3VHKLnINnHpAIvrNS37LvHID/u2OXKMHtC6n6zXzQWAy0NePmWwuXaPaFYwf zYY8vzfReE8JJ1KxqPPyThI8lOEErqQKiD2UpSUycOHcB3J80RrQAhBx+R5CcCsuEsBCNoXc7fo0 6d3dvknJ08lHj2/u6fcnQUulKYJ0lKnwUm86+BKj3Um8O+CSmCcBME4SUukAmCdJS6QKQH4JBFTI OKJU73g/JDCmyAQRygpiOI8NEvJPYItf8Z+9MkhYpjKlrKZJLHzTFOQmKSmJSSSQS3g1OGogYpbF WtsotolPtRNifYlakW1PsRQxLYlaUWxPtRNifalaEWxLYi7E+xK0odiWxF2JbErUh2J9gRdiW1K1 IdiXpo2xLYlaqQ7EtiNsS2pWpBsS9NG2JbUrRSDYlsR9qbYlaqQeml6aPsS2JWqmvsS9NWNibYla mv6aYsVnYm2JWqmvsUTWrOwJixG1U1ixN6aslgTGtG0U1/TUTWrJYm9NK1U0ctkY1p/kH8i59g0X TZrIxLf6h/Iuar4U+HY+bDl3C8JQnSUrEsmUoTEJKYpQnSSUt2S4CeE3ZJTEEpwVFOElLpJ0klLd 08JoTpJXHKlCiFLySQoJ0gE6CV08aJu6cJKZN0UhwohOGjXn4JKXmdU4TBSCSlKUaplLugpcJ9Eg NU/ZBLe6b1DIwGb6qt0kkOLw0eCuXfWvqLhEY9XaZc4x/ZCx7ARZUfRNoNQaNDAJJ1+SKGFgaG1C BWa3GI7/AEtYUZhEmzGyvEyBQbP2jJ6jXcx97P0VZsLW1kAjQcuPmqQbCsYVgqZluyCyt1lIrqYH AkkuB7EoJRjpY2AQdRaoTpcpCU5aueT8U4SPKcJJVCdNqn7JKXHKeIUe6lJSQydHqHzg/elBSedG HxEfcU06JKXiUkpSSUqVLhjlBSP0Pmkk7MRCdMnlJC/xSTcpSkpfslKUlNKSGc6KTXIcpx8Ukpbv 5wEfnNB/goSnsPtrPxCiSkpXxSTSkSElKUSnJTHwSUskkkgp2A1PtUwFLaqrbR7U4aphqfagphtT 7VOE+1K1I4S2ou1LalaUe1LaibU+1K1I9qbai7UtqFqRbUtiLtS2pWpFtTbEbaltStSHaltRtqW1 K1IdqWxF2JbUrUh2JbEbaltRtSEsS2IpaltStSHaltRtqbalaEOxLYjbU21K1IdqYtlG2pbUbUg2 pi1H2ptqVqpBtTFqOWqJalamjnNjDu/qO/IuWr+iuu6g39Sv/qO/IuSr+gFYwbHzYM24XhJPCUKd hWTFSTFJTGEoTpFJKySfsmPCSEZTtSaRPu1CfSdOOySl0yfskkpZOE3dOkleCeE4R8W9tO/c3duE CEHsheqtKUApJgnSUv3ThN3UgkpcKTeQmCccpKVCl3SI1KcJKWhTjVNCmBKBSFhKkEg0gp48UFMT Xu0L3QO06JNxaeSJ+JKmIB5Club+8PvSUxbRVU72tgg8qSd5BdI1mEhJ7E/JCwmlJwNQkGPP5p+4 qTarSR7SgSO6qPZY8pwp/ZrT2/FSGLbwI+9Dij3Twy7MITJOZYxxa7t4J0RrsgqTiO6Ycp05DNw/ RtP7rvyhRUgP0b/KD9xUSgpScJuyfRJSydx9g+KaNVJ3DQPMpKLFIJDhP2SUpIlIcJiihUp5UdUk lMpTiFFP+VJTNxmofyXc/HRMYTjWuwT2n7lFBK5TSlokSkpRSKaUikpZJJJBL0ACltUgE4CpttgG p9qnCcBJTDan2qe1KElMdqW1ThPEoKR7dU8KcD7k4CSmG1Lap7U8JKR7e6W1E2pbUlI9qW1E2pbd Uko9qW3VEhLakhHtTbUWEtqSkW1LaibU+1JSLam2ou1LakpFtTbfmi7UoSUi2ptqNtTQipEWptuq LCW1BSHam2o21NtRUh2pi1G2ptqVqaHUR+oZB/4N35Fx1X0F2vU2/wCT8j/i3fkXF1fQCs8vsfNr 59wuQknhKFZYWKYhSSQUwSVtrQWN05Cb0x+6E3iXcLVSIlWTU390KJqb+6lxKpplrgpgQrBrb4KP pt8EeIKpEmhTcAHEKKK1bunCQGqdJKgFIDlMApBBSwUgEk4GqKl41ThN3UkFLgKQCYBSCSlzz8VN lYeDqRCiRwi1D9G6e5TZGguiNVhXUOXfipD7OOXj/OWfbVtcfDshEJvDfUruKv0Q6u/EHL2/epNu we7m/lWPClWzckYeJUJnsHWOThToW/d/sSGbijj8AswUt7ypClnghwDuU8R7B0v2lQOAUj1Sv90/ es/0WeCf0mDslwRTcm47qzBwz8Ux6wRwwfeqTmMloAUy2sdglwR7K4pd21+2X9mN/FXOm5j8r1C4 ABsAR5rIiseC1OkBvp2Ed3dvgm5IxESQFRJJ3ZXEeo74oeinafe74lQKfHYLJ7lcQnUZT905alYO R+80j8FAQQFKvR7fioRBI8DCCl+E+iYQkkpUDlO7kf1UgCk/n4AJJKydMEtUkKJKSRTIoWKQ5SMp JKXSTBOkpJV9KPEEIbQSAVJjoe08apO3Nc5vYEoJW4Tpp8UwKSmRTTKSbhJQXCScJJKvV6UBSjVO E4VJuLQnhPCeEFLQlClCcBJTGE+1SATwkphCeFOEoQSxhLapQnAStTGEoUoShK1FjCW1ThKErQw2 pQp7UoStSPanhThNCVqYbUoU4TwlaUe1LapwlCVoR7UtqJCaErUw2ptqJCUJKRFqUIham2pKRkJt qIQm2lFSPamLUUtTEJKaHVB/k7J/4t35Fw9R9gXddWb/AJNyf+Ld+RcLUBsCtct8p82vn3Hkkaa9 TZwB2RaMV2UT9nggc7jCqvAJiPuV/o49O9xA0IhTTJAJDHEA6NWyt1T3MeIc0wVFWuo1xluc4QXw 4aqtARibAKCKJDYb9Fvw/gnKdv0W/D+CRUa9iVE8qXdMUQhidNAoxqpwmHMeKKi17PplQhTsHvKi ZHf5Jw2W9VhypBIA/NLVFS4Uh2UdVIA+KSFKQGqbaeZTgGeUClcBSATbfMqQb5n8ElLgJwAkB5lL b5lJTONAi1j9EfiUGNIko9I/R/emz2XQ3a9tchVXMIK0XMkQq765TIyXmLTLUSlji06KW3VX8Oph plGU6CIxstMUHwKkMc+C0wweCcMHgo/dZBBzPs3kmfQWgaRqtUNHgoWtaSz4pe6ngczY71AIUvQL tSJV4sb67dOxRQ0Ape4jgc37N/J/BanTKtlBkRLiowFaxxFYJ8U2UyRSREBo22V73e9oM6iVDfV+ +370TeRxHjwE4tf5fcFONgwHco/Uq/fb96b1av3x96N6r/L7gl6r/L7gjqhGL6f326a8p7LqRY4h 7YOvPip+q7nT7gl6z/L7ggqkXrU/vhP69MfTCL6rx4fcEvWs8QPkElIxdV++En21yZcOfFGbfZoA Rr5BIX2CYPfwCWimv61f7wT+szxVj7Rd+9+AS+03fv8A4BK1U1/VZ4/gU3qN8/uP9ytfabzPvP4J vtF375StTW9QeDj/AGT/AHJt57Ncf7Lv7lZ9e6PplN69sfSKKmuLP5Dv80/3J/V/kP8A80/3I3r2 87il6tnO4z8UkIfV/kP/AM139ylZad+5rHlrgD9E8/ciC6z94pevZ+8Ukot7zxXZ/mu/uS/S/wCi s/zHIvr2fvFI32a+4pIRj1uPQtJ/qlL9PH8xb/mlT9azxKXqOPJKFJtaLo1psHxHKSZzjp8UkaNI d/C6t0/OAFFoLv8ARu9rvuKurgX4j6K23QW95mCtCr6y9S+zsrY1pc0R6jtS74qvLCDrA2GzxkfO NXr04XLYv1symODcygPbOr2e0/dqr+T9asCkD0gbnHsJEfgozimDVX5J9yPd3ISCz8DrmBnQ2t+y 0/mO0+QJ5WjCZIEGiFwIOygCnCQTwguUnhKE6CmKeE8Jd0lKCUJ08JKWgpQnTwkqmMJQpQlCSqYw lCkkkhilCdKElLJQnATpJYQmcQGknQDlThDyWF9FjW8lphIbqOzyXWOvZFmQ5mK/YxhiRyVTxut9 UqtDxebB+cxxkH71Vrx3W5bqHaHcQfHlXm/Vy43BrZNZ1DyIVs+1EAGtmGMMs9QNLeo6Z1OnqNO9 ntsbo9h5BV2FjdG6MzGuN9drtBtLexW3CrT4b9OzLRGh3YEJBqnCQCaphCBbk4tTtltzGO/dc4Aq l9Zc3LwsMHGG3edrrO7R5Linuc+XEy4nk8/epseHjFk0GOeThNU9z1N9dnSsp1bg9vpO1aQRx5Lh avoBFpyLqa7G1WECxpa9nYgodQ/RyrOGHACLuyw5J8RBTUYIuhxdEqzRdi4biNbj3cOFRORYGem3 6PfxKEHuc7XTyTjAyOp0UJAbDVuZ+VVkWNfW0tIEOlV5UU4TgABQWE2bLcA9rf8AXskU4+i3/Xsk VGv6BhCieVNR7oqWhNGoUimA1CSmtaP0h+KemwbiLNPNNcYefir9+NVkMqfXtc6xgLw3Qh3dGRAA vqmEDK63aVt1c+zk+CiZmHaHvK0aMTEqofdcGksMhpMkkfDhZ7jueXcEmY+KUJA3XRWTGY1Z1Kgn TcK50zpOZ1IudV7K2CS86CfASjKQiLkaCyMJSNRFlqhSHMJWV2U3PotG2yswQk1Ea6jqogg0dwuA pJgE6SFfpDIrY6xw7NCf9MyPWqdWDw4iAtfpIcxs1OaHmHGeyN1MOsDhc9rwXQHDyVc8wRk4a0bk eUBx8fFrX0cXurNIlg+ar6SY+Ss44lgHkVLk+VrQ+ZW1CezVW9qi+udVDxMtOdYwzIV7BYTjNjuV E1iCt3p+FSenVbtJEnsm5cgEUwhq53pPHYp/Sd4LRPTsXxP+cf7037Px/wB4j+0f71D7gZeAudsd 4FBuhj2F52jXnTstO/BDKnOpDrHj6LN8T8ysFzy7MjMYf0ZgVEzB/ipMdSs9B9qDE2B3bDXsdf7X B3t7Ge6OGOOoCzOotqa4WUjZbyWNaWlo7H5roMLCdfiU3PseHPYCQDA1+SM6jESvQ90EESMd/ENL Y/wVhktp17Aq5+zIH87Z94/uVS9uxj2STtBEnlMjMSOijGg5k6JwU0J+FdGwah3K4STeSf5pKUU+ iY8p0FKSShMklk3kfFIcJMjckNAgoLlIcJk/wSUuAmSShFCuyR4TJdkQhZJIpklLpkpSlJS4ShMl KSlJ0yeeySlnctSScfePgEkeiujm9S6g/Lu+iK6m6BjdJ+Kri5zdIjwXS4nT/q5bW5uczJx3Bo2W gFzN0GXEtHiOIWTd0O315ruZZS4yLQZ0+CZGUAOH5aZZCcjxXZLVrORkNLK9fEnQKdmFlVt9RzQR +80ytfHxcehgY1u4ju7+5WPTpMyxp+QUZzUdBovGGxqdXnGXFrYEtcO/ddn9WepWZ2E5tx3XUO2k nuPzVmvqxIDvSYXN4kcImLd9jY6vEik2GXEAGT85Tck4zjXCQe6YwMTvb0ydcVk/WLrePc6p9glv BDG6jx4Qf+dPWv8AS/8ARb/cmfd5kXYV7sR0L3kJ4XBf86Otf6b/AKLf7kv+dHWv9Of81v8Acl92 n3Cvdj2L3llja63WP0awFxPkFxXUPrR1DItc3Gf9nrB9u3mPMlVL/rF1a+p9Nlzix42uENGh+AWY X66xopcWDhNyorJ5CdtHWq+sPXaX7/tJsA5a8AgrrOg9ZHVqHOLPTuqgWAfR17hefscXkN/BXcXO z+mhzMWx1YsguDY+XZOyYoyFUBJUJka7h9HTwvPf+cPWj/2os+8f3Jv2/wBb/wC5Nn3/AOxQfdpd wv8AeHYvocJQvPP291v/ALk2femPXOt/9ybf85L7sf3gr3f6pfRIShefj6ydXbR6Zf7h/hSTu/LC E7rnWjAdkPE8ax+RL7tLuFHMOxfRYSAXnP7V60f8Pb/nFL9pdZP+Ht/znJfdz+8Fe5/VL6PEJbSv OPt/WT/hrf8AOd/enGX1p3+Gt/znf3pfd/64T7h/dL6LtKPXhZj2h9DWyON3C5z6t4GS1oys+6x7 j9GsvMAeeq7GnMrraJ0CjlCjobXg2OznZ+Bh11/aMvDq3D6bmgBwPiHNifmsTLu2NbZjOL6HGA7u 0+BXauNOTUWPAcxwgjsuC+sXTsjo95vwi52NadW8xPYjwREIzNFIyShtt2djFqe2oF+rnak6Iu1e e3ftK2wur9RjTrtBdHy1UPS6rMF1n3u/vTxhj++GMzmTfCXueo9VwumsDsl8F30WNEkqn076z4Gf k/Z62urJ+g58Q5cZZh5tl7GWbnvfo3cSfxKHbQ/HtNbwWWMP4+RUgwY6q7ksM5jXhNPpGfity8Wy ggEPB5XC5HSjW8MBDdmjyeZlVmHIs4vIJ7OcQr/Tceb3DIeSWafH5pRicYPq/BPEJbx3TVdKpNID at867txB+5Vruj5NTSQzcznR0kLogRXWHMaC0dh4eSkHMe0ObBBTfvBBuI87ScUSKLxr6S3Qggjs oBmuoXYZOLj3tAsYHefB+9YPUOnnFduZ7qncHuPIqfHnjLQ6FiniMdRqHPLB5/emDdUQ6anhbNP1 M+tFwBZ062HCQTtAg6jlymolisOc0aMTnlatn1X65UdtuOK3Mnc11lYI08Nyy+RP3qOUJR1IIB2X xlE6Ag12YKJCnGiG+2thhx18EErkJAahM17H/QMorKLrGPsrYXNqALyOBPilsoaovRZ7nO906weN EB5tEFnD9YWhXgZd1W9lZ2ngmB+VJuE9rGMsYQ8P4GpLSJ0+5Ox1KwSPqkiQogENSlj2D1rhuJkV s7TxJ+CKK2Oa3eJ/KrFmJm2O3eg4NboABIA8EGw+m8MIId4RqhOQNRjsOygDudba+RU1tktBDDwJ ldN0/IofiAMq/RNaC9wcRtLeyx6sLIub6haBWeC9wEx4AqeK3EbLLnOrA10aSD5GFXz1OIBvTs2+ UxyHFKNdqanUr2ZOc99YAAEbh3hBa0jv+C0DTjvLrYADnQGagxHKrX1NYZZx4eClxZI0I66I5nk8 oBykgjrW4QgE9/wTOOzUkeQ1ThCc7cT8YUpaNJcfOsqtG1oLTyJifmllZz7h6bG+m0dgZ/FALAeP xRacZ7qnv02t511+7umGEb4q1ZY5J8PADou20wJGpWhiGYHg1Zb3gNgclXumP3bgfzR+CUz6Stju 6ACdzdEmp1XZmu5uhXS9PrjCx2/yQucs+i4rqMNsUUD+S38ihy/ojxZIdW66tswGgAeQUDTUPzG/ ciumVFx8FJwjsEWUGTXUGN2tAceSB4LBvuqxb7H2NbuBhrtJg6hafWeoswaWOc0ve+QxvHzKx8Gr K65kOfkkVY9TXP8AY2dW6jnlM9smRNVFfDLwkDclDYH57mtaxldVrh6lx+lt+HmuhZVWGAbRA0Gn YaLI6tkUV1NxaWljiAbQ6Nw8G6Krj9Uzamgb9zBoGv1/FKeORiANK6KlkBkS9A+tkcLDzHey3w1h Wsfq9eVurALLGCXDsfgqWU79G6dQfH4pYYESorJysaNCU+4pi2v9z7nO/vS9OvwcP7RV5prwTwCl wdeV2HRfrF0jE6NXhX3NFra3ABw4cdxgmNZS+rOZ0GvprKs70De6xxPqtrMAnSS/VQnKRdxOhplG MGvVu8huTjxRMwVPy7ix5Yw2OLQxo2xOkIOz/hj/AJn/AJkpQbFsZFGmZKSj6Z7XD5sP96cVP7Ws PycElM2xr8E0aJbHgGXMjxl3/kU3p2/v1/5xH/fUqUunAUfTvjT0z/bH8Qn9PJ7MYfhY3+9KlL8J Jellf6Kfg5v/AJJNsyR/gHfKD+QpKXKRUSLxqaLP80lMXWf6Kwf2Hf3IqXPCaUxsPdjx/Zd/coG5 neR8iEaQkTKH2in94JfaKf3ggpnqnUBdWeHD70g9h7hJTNP5KO9nYhOCDwkpX55+MJKIPuJ80kut KZsysvIAfk2lzeWs4HxMfFEFoiOPJUPtG0OJ51A+SlW9waASdx1PzUEo22YkBuCxEJDmy06j8FTr drqUZ4cALa/pDkeITDFdbIvJDgeYU6i0gOGvYfxQC9josYdB9NqJjmAS4gBvZIjRQOrbZ0V/VHg1 NL3sbqAQNP7SbJ+q9uIWtyKnsLhI1B0+S2vqPbd+1nV1Wem/Irc1nhp7h+RXfrZlbH41mUfUe4Pb udHYhSzwyHL+7CZJsAx7WtGWPvDHKAAIvieSHRKv3Hq5h/VKzMYbamH0mu2vcXAR8lB3WMJjy0s4 7gSPvAXQ9DzHnANtALanWbtNA4Rt/Kq8Pdv18QjW7MTjr0USn6V0Ho32RtdbK/Xr0FlgLifOJAK0 n/Vbot1bPtGNXc9v0nBpbJ+DSFzOdk5HSsv3tLK7Tva8atM/3LbwesHMAbi78h8CXAFrR/WJT5Xu CVgrsFsv6g/VzJh1Fbsa7saXEz/ZfuWR1L6iWYbH5AAspbqSfpAAckNXXi77CNmS53q2ATY0EmXf mtAQuq1/aOl5D6aLm5TayWOcTJjWNCRr4JhlIjcrhQ6B87HT8cH+bH3/AO1P9go5FQCKepWdqj9y Y9Ru7Vu+5R8OXx+1fx4/5BiMOof4MK9V9V+pZOO2+jGa6pwlri5on7zKpnqOR2rd9wS+tWVfX0vp exxZ9oqcSRp9Fzmn/qla5TlxkMjlJiIixR3YOYzmIj7YGprUIeoYL8T9HZZi1WO0h1jTE6a7ZV3p H1M6rdXOMMe8OM722AjXwXFhrZ4klaHROtZ3ROoMysdzmms/pKp2h47tIVqOLCfR6hfXia5y5fmH CZeT1nUvq/n9KfXXmMY11gLmhp3aD4KPTejZnUb3U4jGusY3c4OIboTH50LX+u3U8exvTX0PYMi6 kWPpDwXtDwH+7w5R/wDFxbZd1TKdb9IUiJg6bmqueVj73Dfoq92Uc1L2eKgJ3WzQ/wCZ3XA4s9Jg PjvbCkfqd1up4D62tnWdwjTzW3m/W7qVGZdQzZtrEgbZPLhqYjsljfW/qVmbi02lvp22hlksA9pM aFXT8JAjxGOlX87VHxHKTVjX+q4wa2supLYez2mD3CN0m519rhaAWs0B8VWv225Vz2v273uIB41P krnR8ZrNxuAMnidFmZBGMpAbXo3okkAncus80MZEBrDpIKxeq3Mc047jvDh7T/BaeQcZoLANrTzE rmMwMZmltVu9vMdwmRFpJajqzWHOIIa0ST4AfNc5n9UtvtPpE11jQeJWrk3XPstqFsN1a5uvBWHZ iWi51Nbd0cHwClwYhEkyonojLklKhFLh9Tvxb22z6m38148RB1+CfI6m/KyQ9zGiuvSuvmB8e6l+ z6AAHO/SNHvgyCj1dJbdVNTTYeDB1+5SmWMG612WVlI4bsb00r3euNwgkdvJF6fkuB9MnVuonwUL MOyjcaju2/Sb+cPkhMsY1wtad34EJ1CUe7HrE66PTYhbfXtmHN4PdSxt9fqV2cg6EcGe6z8DIhwL ToVqWODnNsjSIPgqsomJIZwbFp3AQPAqnmVMsqc1/wBEjVWi8Fo1B+CFcQ5pA1MJsbBtJ2eYvq9G w12/RGpI7t8Qve+jdRxczAx30Wtf+hrJAIkS0crw/NeyyWyN7JBhaOJ9bcXBwacc41rrKmBrnbw0 GPgtTljCQPuS4NNNLaHMRmK4I8Wr6j9amVPwBtgv9QTHOoK8as9tjmgRtcRHwK3x9cnV2B+Ng7id Wvda6NRroWrm7cmbbHubtdY5zyxvA3GYT+YyY5YowhLj4Tazl8c4ylKQriA/Bm0bnAcSYVLNx7ca 8+pEv1EeCt1W1vdBJYe0hXHUV3Uena0PdMizv8FU4uEtsREgfwa3QekDqF/vyWYw+i0vBO537ohF yBkdKyX4uXTurkeoOJA4LT4K9hW9OwelZ+LbgfacnIE4+TvIdU4DSGquzPycrFbTmkPawh8vALwA I2ymy4ieKxKJ6dQyQ9sRogxkOvQt7ozvq9dSXZIrDpIHqutmP6lcwFqnpnQy2xlTawyzaS0XObJb MfTEiJXMODKybKiWgaw0kQrmP1ptdD6MgG6vadhmHNfGnx1TBiiSTxSj5L4zB0NB1W9J6RxQ8B3b 0sthM/B4VHK6fVTkstyL3sx7AWiy3awhw0cNzQ/dp+6JWNvzbKzZs9RjdHPLAQPi6EKw7wN8NAMw 3+5CMCCfXbIYE9Levx876q4rfSooN371hqLyT8bLm/8AUrDzfR+02+hIqc6WAjaYPaJKxpYw8jyn v81Zqc/0w8GR+KBxVqCT5tnlJ8MyPBsOI28qs/3seRwP709pD2y0wHd/NRr/AKPtj4z4oxFUfFnz S4xKFacJKGYBKqB5O74yrdlbvTcZEAeKqhsMJOmuitPP7JJHdMXGNPHRRDgeNPNTZSHakwOwPdA0 kISZs017BX+nPIuj95pEeY1VM0vDuI+CPhte3IZJ4KE6MSmN2HaBUp0UQNJTmAqjYYPBLCImdF0/ rVY1VTrHBjQAAT8Fze5oIJ0E910NfUcCzbUy9jnQNJChygmtDp2XwrulHV8Y8W1/Mwpt6hQ785jv 7SY1NPNbSD5AqBw8Z30qGn+yEz3D3K7hcH605LbMqmtsbWV7oBnVx/2I/Ss39n4Fth0cayGd5dZ7 QPwWX15tVXVXV0sDA1rQWgQJOqnbXuprsLjxt2g8jursD6QT1DGPmkeyB9jrXue47iSS53mUF1od YWDQAIlr2sbt4HYBURuNu8yG+SIHESVkjTe6fZs6iB2ewj+KuZZ/QnzIWRU8/bK3boE/SK18lj3U ja0uBdpAlIj1A+CAdJNJOE/o3xPpugeRUZhTfiw0uOUoaeRKiCnlJS5TTqmBSlJS8lNJlKUggpmD 7T8QE88KInZHif4J0UMpCdQGqeUlMk6jKUpKXnwKf1XjhxChKUgpK1SC+8cPKRysj98x8kMuUSUt FWl+13+IPyH9yib3HlrT/ZCGSZTJJSF7D9Kph+SiRjnmhn4/3qMppSUyNeL/AKAfIu/vSFeKOKyC NdHFRlPOjvgkpfZjEbtrw6J+lpP3JJdoSRrRDnOJ37SdOQjB8N80G0R7o7qUFzg3mTCYRoyg6thh Oh8eFdrdLVR4dHYcKzjunQqKQZIlHkVmp3qsHtP0h5JVZLA4HmRqrbmhwI7LLyaHUvlv0DwlGpaF UrjqHofq/wBZZg9ew8m1hdi1Pmws+lwRMeC3vrjkUHEoyqiH1l7yxw4IdqFwlVthaAwgnsO/wlaG R1XMyemY2FazdjYZc4PA98kmA894lTwkPbOI6WRR8jbDONyGQbi/xarC6xzWE+610OI8+fuXc33d Px+nNppymCttYaxn57dPoloXDU2MBN3AOjZ8FYr6jZWfTe7fS7kQJ+fimZvVIRG0V+M8I8S97gux cnHNWQd1jRtO4GWPHaD3RqbqWVOrLjXawgQ0RqPILnOh5mUx7jWWua8Swk+4kHVuq6Cb8wfasUMG TtAcxwgkDvu8VXkKJ7M4Nhs5Dse2lxLza9v0STqHdgB2Wjg5Rvx2sDNYgteTAHz5WawZbavVudQL i2GvglwC50fWS3pOUaL6PXY4k1v3uBDT2iYTeEnZRIDn9XxX4fUb8d8AteSNvG12oVMuWn18tyhX n0sDXvOx1Q1J77tPDhY1nrVM9SxhY394qQDRjKTf5rV6b0Nn1lzcPp+SX149dFoZc3s4+4fcVgHI MxpPgi19Vzcdm1lr62AzDXkD7gVNhPBKyL0YsseIAA1Rth1H6tWdD6s/EzyXCo+x5ENsYeHt55Us q/pNBbY2tuTkxDWmYEcF3iquVl5GU1outseWmZc4nntqqhrY0lwEuPilMCcuIGQ8F8JmEOGo/wB5 IS6wutf/ADxdO4aQui+pvW8rE6zS1upsO20+NfLvyLlTcPokQVE3Oa8FpILYI8ZT4mjGxdMWQcUZ Rv5n2N/TOg5ORbkZOVe0v/MGjYJJ8PNQu6b9V6h69WTebKTvYJaQSOxG1eZDHyszHF1c2B59zWmC I5V/CxL8d+O120Cxpc33BxABj3RwrWTnZURcttuLT8mHHyhFG/rw/wBrsvZe12+uLG9wNCFpYOXW a4sGvgSRBWM+26kyWO2H88ahUz1Z1GSRt3h30mGR8wVlkcVt4Gg9NmWZO0hz6xSfzHN3fjKw68Wr 7Tvc703fmFriQR8DMq/hOuvqFlNhaw/mAz/1chBzGmHS1rnMG6QNrtO+mhTY6aKeb+sbgM0WNdqR 201QcbJa6ptj43mQT3ICP9YKX5IpuprLi4e7aFmtrdXWyu0bXjWO+virAAMAxgkSJSkv3OcNZ1+9 ErvuqgNMaqq24tB11BhSZYXNl2kageaXD3CeLs2PtLnZDXkySdVq9L+pWd9YDZlYDRXWDDi4Q3ce dp7rBLJAdOq9b/xSPtd0C9jj7WZB2j4tEqSMOxpZKWmot5mj/Fp9YMVhdvZYGSYbqSOdBKTehdaF cOwclwiAPRd3+S9gId4/gkAe5lI4QdSbR7hGwp8dt6P1bHqdfk4F7KKm7nvcwta0DkmVWAY+sPYf a4SAvWvrIwP6B1Fp741n/UleR4hZ9kr8dolQ5scYgEMmOZkSD2cTq1ddFjiCQ90EDsZ5PyWS6x+6 XCdp0ldB16lt2J6jfp0mf7J5WALWFu0sBPipMRuA/FZkFSfVvqV0np3XOlUZefj13WVbgRt0I4+j MLpm/VPoA46bV/203+5YX+KZ89I2jgOePxC72NEYY4EbdT1ROc7+bp2ebf8AUr6vWaHp1Y/sAf8A UkKB+pHQxAZgsaPh/wCZrqISjwTvbh2/FaZz/e/B4jrv1PwMfpGXfiYlbb66nOa5wgCBJP0uQvIb b7Bt3CJ4PiF9J21V21uqsaHMeIc08EFeO/W76pPxs92O136Pe+yl55LbXb+3hwjIQjG+GtdfJdAT mSOInTS+7yFOYZ2O4OiVt+526I018/NSs6TmUWms1y4GFt1/UzMOGMrKtrxWubuiw6ifENBKZcbF a321XCGStRVPe9IfiM+q+Dfc54r+zsdcQN7T/YDTOqarrP1VZ9Mud4ziv/jUug+qWLiUfV7Bpx7W 5VVde1twET46HwK2DVUeWN+4K0PYGhxfXT9oatZySfdkPC3hrusfVV7S2twbPd2GT/6KTM6r9T2i bNu0fSd9mcP/AEXC7r0Kf9G37gq+fRQcO1rq2ljhBEDVEHl5VH2uvh/BB9+Pq92WmuheSyG/VjO6 Rk5PTGV27WvY6awNdhdwWAryuRq1oIHYHRev53pM6Tmeg1rWtZY0Fojhjp4Xm31RGHm25DMvHrvd DdofOgEzEEKpzeOOOZ4RUQA6Hw7mrxn3CSSeuriZDv0LwNdIkKgyyBDtR4r0PP8Aqx07JqDcSluL ZMlwL3AiOIc4qtR9SejNp25YudbP06rABHwcwqMczCtbWSxSMiY1q8QbG/mka6SVodCoqyszba31 GBuoVnr/AEjouDY2rBuude10XV2gGGkSC1zWhUMW2/Ftrux/bbU7cB2cPAqUeqNxBYx6JjirR6u7 oeBdXZVRUWGBtf3/ABXNZnS7MPEfbc79ILNjBPbxhbg+tFz2HfW7dtjaG+HYFZGZdlZjHbqn+47j poI4CiGPMJ7HhJ1bWTLy5huOKtGrTfdSGuqe4OIB2cg/FW6+ouez9PWK3dnDSfkqDHmsBkbreCew AU3B9wItcPaxxbA1kapxgCdR9WvGVdfo2H5BdLXEQ5Rhjhv4eI9wOqo20X0VVPfo2wEtHfRMy8jk wO/mlwDooyINSBD1X1e6pa7IGHc7ex4JrceQR2XRxK4PoNOX1Dq2LhYdgptscdtrhO2AXF0fALqu qdP6x0AVZeV1D7dS9/pvqFeyNwMEGfEKHJyU53OAFDddDmIioncvN9Vcb+u2hsmbGsbPlDVv/XE4 +HjYYrrYxxkHaAJgDwXM5t1rbvtzQBZ6os+cypZvWL+rWNdnGGVT6TGiYB8T3UkYExjpYA1UZgE6 6lq7nZDieGgS4+ACgCwnV0N8EfW1wZXW8U9w1upRMrpLRkZgBLGU/wA00iZ0mCZ00T64R6vSPFAB kTw1IhDR6b3iXEV9wEfCzb8XKGOyxwY8xAOgWRvcCQNFYwJfmUydQ4fcnRh6tduywyNVWr1FV1z3 EPe4gtdoTpwVjdlbyc047g2uDY4ES7gAiFQbT3e8u8T/ALEcnDGRpEQZBJOqcKob312bY3NHB7EK /VUbaw9haQ7tOqaZAalXCboao9U0o32W8DRs/AhRNFo5YUuId1cJ7IinEJyCOdEwj5pWO6KPZmNG N+JS0KePa0eSZFC6QS8kgkpdKdUwKaUlKJTyopwkpROqYpFMkpRTJJQElLSkUoTFJK8pD6J8yAm4 5U667Hhoa0uk9kLA3SISl8oJ8gqUlZPTM4NDjSYPHE/lSQ447cQ+1k+65/8ANy+xxXnsSRPii1e0 7zz2CCHyyPDgpMeS4F3PZGtFoOrYB3PRqn7SFWLtNDrySjMcCJlRkLgdXQJ0B7FCtYHghwkJ6iHV jX4JSGmOyj2LIdWgWsrs2PJ2HVh4Mo1jyK/pu2jmDE/GOU2dUHVb2/mmVZ6Rgu6gPQaQxrxDXO8V JxAR4yardbGJJMQNS1Ksmmuo1tpa4O5c4S7TzlVcm5gslrdoInaCY/KrWVgWYl7qL2lljDBB7+YV bIpD2QPps1BPcFSRo672xniFgjZLg57zYK3XfZ65kOAMA+Oi3cHN65nZVlPTcmuz0mgueSWtdOnE Lk/TLeSF0v1CcP2rbU7h9RP+a5pVjlsGPJlAmLjrox5Mk4wJG4da7F+tjq/UN1LASA9rd2p18vLs qWT9Xuv5ThdkXMkcGHQB4DRdje4BmyOY1+A/2rZuOHd0kg+5/oh3qbhAc3TbE8rQlynK4xH9STxG r4ml97zSv1AU8BV0brWJSPS6hSHHkMY7cB57mrG6v1jrLcp2Fa/1fSAaS0aOkSXazErtnCVyXWms q6nkEz6jq2Oq8J+iZ+5DneRwY8BnCHqBH2Fk5TmsuTJwzl0eednOa7Wlgd3JChZlPfB2taRrDRCl ayyyx1hLJPYFDDCXEuA0BOhWUBHs3ZHJsWRvsfwptx7nxqBKkxjGADuRKtUxM8JspVsuhjvdVGKG wDTXa4/vFx/AEK27BOyXYmPXPcuLfyuQLrn1htdZ2vskF3g3ugGuqOJ8zKZqdSaZaiNALSW4t4ZF FrKCDqwXAtPw1kKXTq7sbJF199bm9w2wEn5IBrrH5oTsDWPDgBLTIR6V+xbWv9r0dPVqI0sDfIp8 zJxsqiBsc8cHghY/7SwHnbkYwB/eaSEOy7p0TTub5Eyoxj12KDLpYd7o+P1Cxotx6rQ0nRzDAMGF unp2fkV/pcd73RAcQAfvCt/4szTndIfQXQabXGO8GCuz/ZON3P4J0cBnZ4hHVByCOlW+VZn1W61k 1sprr9MsPJcYIP8AUlYPWvq91bpNdd+dXFTiWCxp3a+ZXuduFgY1L773iqqppc97oAaBySV5h9bv rhX1NuT0npuG3Lw3Paa8t4ezgawwxOvB/BSxw8O8xXksOS9gXz5zpUhZ58K6/AzLbDbeNXcu+Ajg KY6a1oIL+fAJGUVtSajHmZle0/4rMQ0/Vx15BAybnObPBa0Bkj5gryNnTaDEud+C9A+rn16f0fpV PTH47b2YzS2p4fsMTIBG08SiJx7qIk+npLlOlf4wel5b21ZbThvdoHE7q5/rACPuXVAggEGQdQU8 EHZa0euN39Gz2jk49v8A1BXgluY9tQb6jmtYIAmB+Gq+gOpt3dOy2+NNg+9pXzteB6gjk8zwmyAI 1UCQTXUK9YWU2B07iJBJJPwT9L6fj5GQyvIeGBx9znGGtHmkbW0lwglxA2xxPmCrPTbn5eVThspa 6y5wY0ieT37phBo1ovB1AOr6h/i/qxMay/Gw3+pQx3tdIMywE8ea7fsuB+oGLbg5+Ti2xulrxtMi HMP9y76dCjh+Xe1ZPm2pdJJNOqkWLrB+tnS6c7p/qH23UGa7B+IPity22upjrLHBjGCXPcYAA7kl cH9av8YWMGuwukbb3g+/KOrAR+4PzvihKqNr8UZSmOEa2871TrBwxXj4jQMxzWvute2TUCJDAD+e e/gsW3Kyrp9W1ztxl3mfMoF2S62191jt1lji57vElRFsmAJVW6FR9IdbHCA+f1S8XX6H9Y+pdDv9 TEsmt385Q+TW74iefMLvui/4xel5z205zfsVp0Did1ZP9b835rytrHP8AVOtgD9XfPyToZSNzazN gw5LNUe4ffgQRI1B4IVHrlldfScp9jixjayXOEyB46Lz/on17zun9PZiPay9lQiqx8g7ezdOYVu7 /GPkW1urdTSA7SZP8XK1jkLEgdiC4/ME4zKBBJrShYLTu625n1WyKsd59T1wxr3N09N0NePcO+5Y mNi/ZXbsRzqbT+cyuvjv2Vvrf1lb1DAfjuNTdWuG0wSQ4eaA7q/S2tO61rteRMhX8Z5XLkySzRjq RVlqQlzAxjgBjqdvwZDJz3u235tzB4tDB/31DvzOpV2Q3NtsZ2MMH/fVBvWujiyXOLx3Dmuj8E7O v9Eof6jSXuPI2u4PZWfZ+F9IYytGTnL1MgyFoY9l7L7bLXvrFhcxm0kva2HEt8F6CMatr/8Ak9rG zz+jn8CvNf2n07MyGsxGva/e18GA2GuDjq4+AXqT/tb3PBa0MkemQdSDrr4Kvl9mJAwVw1sGQe5I Xk37qbTSRIxwPiAP4IDjjZNlmCWgFzHbgCDHAIIjTRyusDuChfs9v21uTWwMdLvUd3dLY1UfENbP 4raIO74fm44x826p7SXVvc0gdoKfFvpx8uq6wbqQ6LGn90+134Fd7l/UTH6p1fqeTkZ32JlV8lpY DLXtFm7c5w8Vw3U8fpNWc4YVtuVitgNfc0MJPcgN7eCzpEcZHZ0I6RBdHNs6ZkOc2zUVt2sA4AHB CxBiU+oXAeydATr80a+5rocO35FAWapmOHDZBOvQr8uUzABAFdW/0zqL+kdQrz8Gttb2SNrveCCI IPdbvVvrfT1no12HlUejluLXVPZrXuaZn3ahcqHA6J4Uwyy1HQ9GExBNqw7rqOq4tuQN1NdrSZgt I3CZ+S9hqwcBollFY8wxv9y8fBMFp1BXp3Q+u4mT0ui19rK3tHp2Ne4AhzRHdWeTlpKLBzANg6ut 6dLfo1tHwAXn/WsG2zr1vT8as223HcGN09rhMuPYLu6c/FyQ70La7Az6Ra4ED4kLG+tvRcXO6a/P xZZn0N1saSBYwa7SPyKPn8mIxGMn13fkz8jHLEmYHpIrV5d/QPqhiEnN6mbckaWUY4ljXDtvgoef d9VDs+xVtxyzbtsYy17/AG87i4sad3fRc76vdLfPZVYgjrbLLJZOgFulm04WZWx9FzWvY479/tcW 9tDosvOofiXljHl9ZALHeIIlPug8rV6HTh9RzaunZoJZe6KyDtO/s3ceA5KRkDxHUdUxMJDhI4T0 k4fqWOAESfxXTdJ6F1DJxWenhWWu27iQw8H4r0n6v/VbpHR6hZVTX9scP0lgJcB/JbJMBbDWgEkF snvBUU8gIoJjGtSbfILunWY52302UnsHBzfyofoxqHvHz/vXqnXem09UwXY9k+oPdU8A6O/uXmeT j3Yt76L2lllZhzSo7ZEHpWRpafgQCkarO5rd/WYpzCkClZQgNL+9VTvhIVTLe3HcwOoA3995haUh Z3WRNVT/AN1xH3hPxyPEAdlsgOEmnSH1X61aA5lVbA7UE2Tp+KKz6ndbcNXUD+0T/BdFZ9YmdN6T gZH2f1xk1DUHaAQ0eKzbf8Yr2GG4TY83/wByuCIr+1qGZ7NIfUzqv519I+Acf4LP6h0fJwMpuNY9 j3PZ6jXatB1iNV6a14spZaOHtDh8xK5H64UMdl4VrxuDt7CPucmyqjQXQNyALyvSMHqHWLLa8QVt dTBdvJHJhazfqX153+Fob8yf4J/qA9lH1izMY8PrftB8WuBC0sn6/wCRRY6puJXuYS0ySeNOylxw gY8UqC2RmJEAbOePqN1k/SyqR8Gk/wAFn9W6Lk9GdUzItbd68kOALY29tV2f1X+tN3WHZAyam0+j tLAyTIdPMqr9dXerVh2VD3MuLfcDHvb/ALE444GBIINBEJSMqLw8jTVLRadlNrj76K3/AAMIJxK5 92IR/Vd/tVIZQ2PbLR08UoVo42P3ruZ+P96iaMX/AEr2n+U3/YjxjxR7cmWC2upzci0BwGrKz38y tVnW8UfmuqPg0CFz11uyxzNwcBo0juFBriQS4wPyKGcOI2S7vKZceHHEYwL/AEiXff1rEda0usdI MgR3SXPbsQ/na+KSb7Mf61+TZ+/5P3sVeerSYdIUqyQTPZCB2lPYTpPZXKeXBSB34I9Tndhu7Sqz GkkaIrnOgmfuQISC6FF20lthAafkrB9MtkFpH7oIWLXueIB/ii/ZjMnUj5KM4h3peMng6MNc0t7E GB/tKj0+zMosig7YPtf4Kkci/GILvdWeWn+C2sBrbQ2xmoOoQ4KBvUFfGetjQu90zExuq4e/qNYy L9xHqO0dp2Bb2VLqH1Jptc52DkegSCBXYC5v+eCT+C0+n3ipraw0NA1001K1NzLG6FMBMdl8qkbL 5T1LpeX0zN+yZO02QHAsO4EHiFp9As/ZvVacrMrtroLXMLgwzLh7YGndUuuZD8rq2Rkky0vIZH7r fa1AObfY0V2vc+scAmfyq3jyThKM41Y7tWUYysG9X0t/Vsa5jYpzCef5lo/6qwKIy6yx7zj3jaJD bHUsLvh+kK4JluRsAGVYGmD5j5qLmlxLnXWOPclysf6RzjrGu1MP3LD2P2vdu6qRoOnu/rPyK2/k lYvVqTm5YyPSqx2tqLI9cWO3TuDuy530qzyXn4uTejR+5PxcVFk53PkiYynoewZIctigbjHXzTO6 djtG/dW10ncXS8z5MaCoXta3Ee1nqPaYO4sFbNPBsotGQ/GeH459JzRtDmk8FDzc2x9JY4AgiNBH zKrXKx1Z6FXs06i628O2w2FdbtAhVMfBzraw+lriw95AH4oh6b1T/Ru/BGVE/MAuhxAXwE2va79O e+1n5SmrfvZujSUHJx8ugsZa0sc8ceMfBEriuprTJPJ04SIFIBJJ0qknxTjhD3E8NJ+RUmiw/Rre T5AoLrYXUh4nuq4c5p2laDmPDYe0sPgRCoXCDPdOiWGY1t9D/wAUd0dRya90e36Pju0/gvVLLa6q nW2uDK62lz3u0AaNSSvE/wDFnl+j9Y62kwLa3A/2Yd/Bbn+Mv64Xfa3dEwbf1ZjIy9p0c8mdh04A TsenH52tnrw+IpyfrR9bcnqfUsptWS+3p4tPoVBxFZaNA6CBzysgZ7TzoVjm0l0j2g9giM3EaaDx JTZRvVMZVo6bshrxyoF7eyrNrsid2h8E+xvdzk2gvtP6gCkL1WFdQ5BPxKkG1fuhGgiynOURwdV6 7/i863X1HorMWy8WZeJLXVk+8Vz7CR+C8beMcDsCjdPx8u7Hyr8TIFJxmte5u7a+wF23a2CJTokA LSCS/QOa+tuLfvcGj03zJj80r50vd+nbI3MjWPjytjCwcrqDSdt7rB21LT/aOgT5P1eFO65+Qx7t GCisjcD3kmeEDmhtaRilu87a8epIMgcI2P1C3GsrvxCaMmuf0rDrr4eGmiv5nRG0tHpuNlhPurd7 XAR58qDfq5mvsqrEVPtEtFxDNPiSl7mOqJUMUyTQunr/APF718/bL8rqeR9AMBe8gGAHD58r03H6 nj5Vfq4zhdWfzmODhPyXiN31RzcKtz8y5lQEFuhcHT+4W6FdX9Vvqj08dObfffZabxu/R2Orr29p awjUeZUOTNHGLjLS9gGSGOU9xqBuS+jjJeeKys/qn1lwekOrbnPbT6oJYXuAmOV5t1/o3Run5Lci vql4YSfUopt1EcREwDws/O+tWZkYYpxNuOzHILKx77C0fvPfJKMcuSQBibHWxVLvZANS0df/ABgf W27qZpw8C4HA277g3h75MBxgcBcKcs8ET8FKzIx7X7iPT8WmXj5FOcbF1cLw4jWI/gpb09SIkxsR 07rNsLufuVhuQA2J17eSrPtrrG1nudxuTMY5xk6SmkWyxme9tz7ZBEcjwUbcgvrLG6aHRV4a10HX xRXbXNOzkAyUBDUJOXQ27H1L6Dhdctyqsxzx9nqD6wwnkmNV1z/qH9X6mu/RWOI27Zc8dte/dYH+ K55HWMmvUb8YzH8lzf716RZtggyNwET3WlhEaj6Qfo4nMZJicgJEaPKN+pnQm840/F7z/FGb9Vug 1ifsdWnd0n8pRuvfWDE6RVEC7Kf9CkflcRwuIzvrB1PqB/WLCGE6Vt9rQpsufDi+YAHsBqxYcHMZ teOQj3JetOB9WKX7CzEa6PokMn8Uein6vl+ysYu/wAYuFFzAAD96Rrxtrn2FxB41VQ/E6P8AN6Nv /Rl75pW9X9dMbHb9XrXUMYCyytwLAB38Qqdf+MnrT6gKsWqQAJLhOgjghcy5zqXCv1HehbxJ08gV fw8vFYwMzsRmVUNJGjhGkTBUeXneMggcOnXVkxckIR4ZHj1ego/xh9QrxbjmbftZ/mWNA2tB/Oc6 I+Sya/r715uR6luW6yg/TaA0AA/uwBwuf6vl9OfYa8TDswyDJ3W72keQ2j8qzLMguG0aAcKPilKy ZHX+XRlqMaAiBwu11v609Q6rWKcm53ptcXbIiT2ktWJ6v7oI+JQnP1US6dXHTwSjARFBUpmRspxa YiZUmuKrh7iNAAi1N3PAcTB5hFa2WOHcoocPFVmtdyAiAWBIQkdgq66ptwhdD9T8Lp+fkX4+fRVd W1rbN1rtu0AwY8Zlcxsf3crXTX5NWW1uPU3JttBY2p7d899G+Kbkwz4CdY+N0vxyHGP0n0nKo6jh X7On4TfQaf0bamg1EDj2wQCn9a+6m/7a5lJYwusqa8OMDxA0HzXKtq+ttjTW6rIqo/0NLRW0/Jqz uq4v1qNBqGDZVit4a1u4+bjGpJVYRBIHEPtbpkRG+E/Y8+54dY5zdGlxI+EqTXoIFrCWkQRoQRqF MPf3IPyVqmgd0shTrtdVY2xhh7HBzSPEGQgh5Pb7k8oUp936Zm15+Dj51MRkVts8DJGqvNe/uCPu K8w+rv1wb0/olGIf56tzmtcZIa0kunz5Wo76+UUgGql2RY7l9ji0fiPyKqYGzo2IyFB74uBC5760 fV1vVaxfjbWZlfBOm8fuk/kXOW/4w+php9PGoYexcXH+IV76q/XPI6tnWYPUPSrsLN2PsBbuIOrd Se2qXDKrTxB5O1j6bnU3DZbWYex2hBSXc/WjoNXUaHZNVYOZW3gATa0fmH+C8/vbRjuixu2xvDII 9s8ad0gLUdE/l3VLqwBxCf3XAoNuY5gGxzmAdy7cT96rZGfZdUa3OkEaiIT4QNgrZSFF6fJIyPqX 097tfQsLdf7QXN21OcAGBzj5a/kXa/UO2u3ojq7drhVc7R0EagO7rpW5eHTp6lTD4AgK4NQ0ya0Q dFsdZ0XDc8EO9FgcCIIIEarH+uLP1PHt/wBFe37nAha1/Xuk1/Symfeuf+snXel5nTbKKbQ+3c1z R5tKbKOhRA+oOL9XLfs312p1gW7m/wCcz+9F6x0249Tym1Y77Gi10FrXEEEz2Co03Cj60dNyBEGy qT21dt/ivV+o2jHpDy0kA7YHmpeXiJ4+Ersp4Zk93iPqJ07qmJ1G85GLbVTbVAssaWtLg6Rytn65 Y5PSH2wB6FtbwRzG6D+VdHVex9LHTEtBg8rL+sja7ui5rJBJqcQPMa/wU4xxjEx33Y4yJkC8VP4p iUOl+6tjv3gD961OmdB6j1C1jW1urpJ917hAA8YMSsSXpJt0Rq5yYgfFb3XPqy3pGKLzki5xIGzZ t585KwJS6Wpr5mDVlVxAbYPoujj4rFf0vOdcKNPiDIjxW/da2tsuO3wKl0x9Ty576w5nAdrz5p8Z yiLH4suMwGmQnhPSO7nVdHqrx3VmDY9pbvPiR2SW0cK4PFlgIYTNc9wkovcnxXZt2+Hlfu98I9vh +rwZ14VvppYb9to3Ng89lQU6rDXYHCY7/BaBjYIeXhKpAlv2V+i9zCNRwfEIDvolWHXteIA3j7oH mq9hAamRvquyCN+kssIQ8z3WgWt45JVHDaHEyY81pACQNDrylLdEdmOZjA4RJ1j8NUHD6jkYYDa4 cwcNcFfzHOZiOcwwRGqx3WPfq8l0cSmx1FLjoXocf6yUuA9WpzCOS3UfwR7vrXi1Y7w3c5zmlrYH BI0XLgwZHzUcn+b+YS9uNq9w0isA1MmVERCk7a1xBG4kaGYhQ4JjhSMdt6pzfSb7TMamVbxaW37j vqq2x/OF2s+ESqNRPo6KThj+k3YSbTyDwo5A9DTIC3HsoFjwbqWbTA0eQR4t0Kg91TQDTcy0md0M IA/zgFXaGMsa65hcyNQmgPsea27WdgUgPG1W3H5vT/S2V02C7bG8vEB3choaqGW57q/pFwbqPmim weh6IqG7u/uovZLNpP5p/IlGIjtf1NqJsNWvMyqmhrLCG9gjVdVy67Guc8uA5CpucSA3sOEgCRoJ gKQxidwFgyTG0i6+X1D7RlY11J2va2NRwStEMy4BOVWD4bFzAc48nUcKbrLAR7jHfVMljugDVM0c +5kLvxelByh/2srHwYkTcfpZxH9VsLm22Oc4DcQDzqruHji2wO3yG6lNOMj9L8Fwzg7R/FuZTwRB ebD+8eSsvKECAtaysEH80DkiPyrJziwO2t1Rx7sWTu6fTMrD6W+nPxXPdlUjcN0bJIjULNzMh19r rnuLn2EueTzJ5KFUHGtwH3KBkc6FOjGidbRM2I6UPBRdATse6ZCETJhFax0S0T8E9jbDL7OJJHdE Dyq7C46bXT2CmK8g/mx8SAm0uspt5Tb1D7PeRq5oHxlP9md+db9wS0VqtYS5hb4CfJbn1K610vpG RfkdSw/trHsFdTSJDXTJOoKw/Taw7S4unkcaLRxvrb1DDobjYxFVVejWtY38sShPi4ajHiX4hC7n LhfSMX/GL0JteyjEroB5YWvaP+hUVaH1s+rHVqXYd9NJZeNh2kGJ7jcxh0Xlr/rr1t4IOQ+D4GPy LJdnbrfV2N3zM+ajEcp3HD9hXyGHpIl9Db084pJw6TdbJjJsA0/qNJ/EqeJhWV2G3OwassuMl91p /I14XBftrqFp2mw/egO6nlmRvKhPLZjK+IBsx5jl4QrhJvcvrFXVenYrSw49dFR+lSLy6s/2Hh4W R1v609Ip6dfidNaanWH2VsA9Np5kaDvqvOXZmQ7l5UDa88lPjy0tOOV/RiPMYh8kSD5t9+aSJPu8 Z7/FAddudOocNdwVUPcEi7VWhEBryyEpjYXakAqLrdeIKESVJmphGll2zabCdO/JCNUwvMMJL/Mw hhtrfb4+PCl6UOG+WGdHDhN0XANlvrt5AB/eA1080Q0vczXnuUn42WykW12C5nh3W59XPql1brcW XOGHiO/PcJc8fyGd/iopZABZkAGaMRZFFN/i1JH1jDNffTaNPkf4LuPrV12vovT227d2Rd7KGHgn u4+QXE/U2n7B9eG4bSXCt99MnSQA7mPgqv1062/qnXbGA/q2FNVImZIPud8yr2LJw4hPsNHOy4eP Pwnbq0r823ItdfkOL7nmS4/kCrPytFWdZ27ILnkjRVJXKRlKyS2wRGIiNAG0cpw44RBmPIjlvBCz 9/ZOwmdDoUuAK4y6LMlxcA4ggxII08ip+s5oJBgj/ULPbYeJgp3XwZ+R8wmmC4Tb+XQMykwYvYJH mgY31W63kND20hrHcOe4D/amxG5eQ4toaXRw7gD5rXpt+tFFe2i19ThpLHNMj56hNMpQ0BiP7y+A hLWUZHyNOefqjl1icnKop+Jc4/g1RPQenVn9L1Nv9ipx/LCllYvW8h2/L9e53dziXfxVR2K9ullb gf5QKQnI75B/ggMvtw6Yh/hSJbLsL6vVtg5eQ8+La2gfi5Z9zKqrgcew218gubtOnYjVWG0t8Aq+ 5gc47RrwPJPgfEnzY80QI/LGPlbYZ38j+VThCrfu1iJHHw0RQVoYZXAeDTnuzNbBWDulx/Ihi22m xl1LzXZW6WvboQfEKUqD9WkBOyASiR3CImiG+7N6q8e/qOQ7+2R+RCcLnmX5N7j4mwo2NhZl+CMu qsvqBDXFvuIPiWjWNOVXtdsa4u0LQdCsm9aFbukKMQddnMyLbHZDvUeXPBg2Hkx4qO4eMpPpyRLn sIB1kjTVM3boNSSrHRpS3Tvoc1gsB9nc9wpUF4bvZR6usBzzpPwUcqbK91bdtdcNd8VaxrdtW0HU +PEJhNC1wGrB+feywVuraI0hgkogyt3fXzW/0HqPQsBhOSyM2wkPuc3cGt4hpE9uVHqFOBkMNWNl UupedWtqhw/tP1URyji4eEjxZYwBGswHBFl91jaKAX22u2VtHJcewldJ0f6n/WTAz8fqXUcB7MPH /S3O3sL4g8AOJ0lc692XhO21na1mjXFoMgd5haXTvrp9ZcB26jOseO9Tz6jD/Zfuj5KQiwa6sexs 9H0yh/VX9ObZbW2vKALWOsP6N5H0XuLA7bPJC5LP+peWLnZufkHIF7xNmPsIl30p3Rt8tFXb/jL6 i1wdZj1SfpljA2f80t/KrH/PTpWfWG5tDWts019WsGOfcw2KE4yBQseLIJAnWvJ2undE6O4iyh/r em017H7dgdEbjWWxuQev/VTE6hgOY51YzGD9WuG1hLuzX7REKXSOkfVnrNb24LQ59UOe2vLdInQE iysH8Eur0dO+rDKsu/pjMhhPpse/I3gO51b6Q105VEcnnGQTHMHQ2AfyZveiRw8Lw9fTL+n2nEzL n0Okg1iWS7tDjLSnyOk2u3HHudaQY2v0JJ8xP93munr+vH2zIrrfhVfZQ17rm2A2t2NY6dnqAR96 zbMljc1oux6qK3jey+gFrQx30XNYyeVdGXIDUjrXTYsXBHcDRyLOnuvaN9vp2MAHpOnQjQgn4ozO g1khpsIBGr5mPlCN1mnq5Jc/DssoGrMkMsh7TwXGPwKzt8HXWNe4A/HQJ1yI+ZFRB1BR9Yxn0XV5 FLWhlDh7wfcSI1I+S0rf8YPXL3hjLGt3QAdnf5lZllTbSTZH3mfuT4XT8N9m+82FgOrWATH9Y/3K aGWUI70xzxictBbqN6t9bcrSvKLp/wBHtH8EY9J+tGQ2cjJta14hwe4AEHt9JbPSeu9AorZiW0WM paIDt8kR8GtVXr7ehgtuwc2+0Wk72MIeWT/Jft0+ai+8ZpHhuQ+i/wBrENeEfVfpdVnSYdc+glrQ 1riZI/6JXRYP1o6d6pdbaG7R7+fw0Xn1tOIBP2x72k/RNL9w+ImPxSox67HD0WZGQfBtbWyPm5yi nhG8jXmyRMjpGOng9b9bPrF07PpY3GtLwx0n2kaAea5EdVocX7AZaJg6K1d6ohj8MhzRA+0XHQf1 WNasnqWSHHZsrr26O9MEA/eSSnY4xOm6skJxHFIcI8VqRl9QyhWCHl5hoI0A/guhptowWtx6Gi61 mkke2fh3WDgWW47GvrndbLYHJBWow+kJdpa4ajwRya6dAshs38rqmRa6reQX1va5oHAcCksq64N2 CCSXj3JJvCKbXEfY+bS9nkQiU1my1rB3KgFd6WybXv8A3RA+JV0mnNG6d9Hptgat8Qql5bt047K9 e3kzu/BUMqIaPimR1SU+AZJjmdFp1MJdqI8ll9LG57m/DVbTQByA75wU2e6+OyHqNgbhO/Nk7QD3 WKLHeKv9ZcSam8N1IaVmp2MUPNZI6thnuZ5+KjYD6RapUH2x4FStk1u+CXVPRja0tra/bJeANw1A CBU5jbGmwbmT7hwpi87fTa0CBqfGPFQBBdtcOUQgmy2sYwzmORKkHNmQPmo0MIaW+J0KJ6tnoGjb pP0k0rwnpymUiBULXvkSZ4I4Cg+yudho9Jw15JMfNDDXM2uY4bm8J/0ljzZaZMdk2gmyu31nVF7a xsby/v8AlQy0Wt7NHiT4J9rwC0OIYeyRqdYBXV9M6CSihznCD5JCBBB1V/C6e+4uD4aGmPcPyK5Z 0qhtT3CyXhpIAHdOOSINI4Du48tOo+keQnO9zY2mJV37EPSocGuLyf0gjgK4KamullT3eMmJ/FAz rbVQgXFdW8OAIieFodOY6vcXckwi5GNda+t1dQZsMmXTKt4uOw6Xv9ERy1u/X4SE2U9PNdGNFE93 lqsnLY/1XSCIG7Xw8V0Xo9METbc/xitrf+/rJzca99jravcNWgGJhDGRapx0amJBa74hFfW08hQx GOb6jXgg6aFWdglGZ9WjNiFwALRfW0PgCAFIGNAiWtBsOkwoOrE/RI+aeDo15D1GltxJglFa75x9 yCW2HhriFf6VQwXG/JZ+hxxvMmZI+iEjtaoCzXdv4fRQaW5PUclmFQ7VgcJscP5LP71YFf1QpHuu yslw/c2t+6AVmB9nUL3ZeSS5pMVsPACsiGiGgD4KGV9SfIaNmMR0A8zrbabkfUlrtxwct5/lPP8A AKTL/qVOnSb3fF7z/FVNeU8lN+sv8Zfw/wB3/FdFmX9T2EFvRLSfMuP5bEYdY6Ez+Z6FxwXQPyvW SSUkPt/ximvL/FDqn6xsa0ino1Df6zgsjPysPJk5/TGUNOn2jFc4Ob57SS0pzKcNa+GPEsdo4eSM SIm/2olGxv8AgHnsnHOPc6uQ8DVrxw5p1B+aHp3Xo+D9UPqxfYG5lt1RAAaAZaAdQN26VEdC+qXS +p2s6pg5FmCH/q2UC59LmEfn7DI1Ug5iJ6FrHEbfOw1p4Kl6Xw+9ex9O+qf+L7OAtwqKskH80WvJ HxaXStRv1R+q9I9nTcdp7FzN3/VSmnmoj9EoGE93wf0x4ifijUYllhDGMc9z3ANa0Ek/Be71dFws c7sfEx2Hs5lbG/wV2ugCA6thjjQAj7k0832j9q72R3fB/QuwrzTlVO3N0cwja9vyKM9+KW/oWudA G5h5Hw0XqvXfqJ0fq9r8mHY2XZ9K5hJBMRqwmFxvUf8AFn9YcaX4N9WY0cN/mn/9LT8Uo5YSok8J 8WQADpbn/VzGxsq217ZZjVt/WGlupn6LWnxK9H6VvbiNvsAr9gDWnSGDQLC6H0HJwq6cS+r9Iwer kFwgPsPAnvC3LmPqB9ewWsfw2CC0+UKpnlxS02Z4AAPBYtjafr+2wj2uyrPLR7Xf3rmcqwi617vp PscfvK6fqxqxfrjj32OFdX2mtz3u0Aadsk+SX1h6J9WnX5OVjdXo/SMLqcdrbCd/gHbYgrYwVPlo x4hGXYuZkuOeRokEdHjXW6pgXOOgJ+CJfhX0tD7GkNImfirHSwfcWO2OBBB547FRyPCCWSEOKQid LaZnk6FO14M/it/q2I3L6ezMYxouq0sezTew9yBGrSsI47xBAmfBNhkEhe3Qr8uCUDW47sSSYA18 lq4HRX2bbMv2V9mHRx+PgrHTOnGmsPe0eu7Xc7XaPABaA2M+nYJ/H7lDlzbxh9qYYusk9VdVTAxg ho4ARQ9o4Vdj2E6OcfiCEQWNHLvkqhHUs4ro2GvBGhScXRwI80HfPBgfBLc3856FJtm6mi1pbaxp B5/1CDV06jGreenbMe+zm57fVMfuDeSAPlKILW8au+Cl6kROk8SnRnKOxKCBLdx+p9O6i9tV9uy+ 0bhZ6LdsDsSABKyHP2OLXSCOxELsg4jUmPmovpxbnTZUx7xw4tBKs4uenAUQPowz5cSNg08k0sfU XteDYDAqAcXHzkCFOnDzbiIpe1v7xaQPxhdO/DGgreWDuOB+CKOl4LaBdflisidzQx9jtB4NBUn3 2Uuq32K3cno2O/G30XksblB1Zc1zYbEPrfO794K9jYNfUGej1Fl99cR6jWt9Rh7Buzn5qoOpdOrf DqLHhp0cSGz57VZd1HpeTWRjmyqzsyqoPdP9YuUMuM6jQnqyxIGh1A6XSN/1MyMMetRnRiudDfVZ sdI/Nc1x5+Ci76tUua19rmF06WNcGz8eQh19XurqOL9ksyL2k7bbnPEf9ad7Ai02dW/R25z24uKS TW0hoa6eduyU2YzgWcg+zVmwy5ckROPc7sW9CfXXDaxfWwh2jmmDz7gNYR6Kc3HbYMYUbbjufurB Ph7S7hXa2vO22p8DlrgY/FXGTc2HAMtGu8fRf8ewKqHmcnfVvnlMQ1rQ9kWP0j6q9Taxmdbfh5pE Pt2s9KRpptMKzb/iseWi3Az23MiWh7CAf7TC5AbjPLS4VhzfIA/kRsHqPUenOJw7TW081nVv+a7R SQ52tJjTwa+X4ddnFIX2k4fV/qh9YulS+zGNlI/wlJ3tHx7j5hYFjHk/p6THiWkfiF6KPrb17h9z HA9trR/BY2c85dpveGMcfpBjQ0E+PthSnnIfo2fNZD4dkP8AOVHxib/B4+KBo2W/A/8AkpTMspbY 15k7TMObIP3ELpH4mO/6YY7yMT+KqW4XSTyAw+RhOjzcTvGX01RP4dIaxnE+eiui/WGzp97jQGWb wa6mGWAB7g4jQOJ1CP1X6x9VyHtbdbRU2p241bS4k+BBCzHYnT67A5l/taZ2xP8AFPk39NLvULHX WOMu921qeJQJ0B17hily+WG5GnYuozCwepMdnYW7HFrH030tBcGkj6Td3Ypsbp9OV09uFnNe1lJP oZG9rS0OMkEfnDuqGP1cVU2soqbVW0NLmgl2m6PzvihW9YpptPptawtPtOnyUco5dRG/6vgvjGEh xTkInY+L0jOq42BUMbEsvvfVSamfSa3cZ9z9xPcyIWd1PFszKqrG2epmBvvsftAdHDTsDdR2Kys/ rBLmW1uhtzA7TxHtcPvCr4/VnmzaXOIc0/eNQlDDmHqG+5tN8sNCb/BtU9PzXubXbsYwcvLgI++F oMqx6IHrsG3vM/kXN5PUnOufEkbjGqruzbDwFNLDkmBxEfRZHmMGIngiTfd7WvqXSGA/aGtvPiA4 f3KhmZvSrLN9NRrb+6CY/Elcs7KvPLo+CgbbTy8n5ojlq2lXktlzkT+gD5vQuz8Vn0ax8ynp+sl2 GZx3BhOnErnNTyrmLhPyLq6wPby49kTggBciZeaoczlySEYRAMjWgdpmfkZgfl3ndPHaVi5Bc+zm ZWtlbK6hW3QcR4ALKsMuJHZLCALIFA7J5+VGOIHi4B6j3l1em6fgbcNjscttsAh9gMwT2ATu6bY4 /pHwVmfVzqQpynUuJDHz8JXVOLLG7m+5RzuJo9WKFEODkdODTUPUcQ54HwlJW8t7/tdNZEkOaY+J SQ4js6H3b+h8fXenhhwtHpgIpe4d3fkVCxgY8t8FqYALMVp4DiSfvVyR0caO69xJHOo7LMyHbrPh otLIPuA8e6yrCC9xHElCCpN7pOtr/gPyrcqAlYfSDFz4/dn8VuMIkHyTMm6+OzjdXfOUG/uNAj46 qkj9RJObbPZ0fcgJ8dgxy3Kag8ortWkeSFjgkuAbLyPbrp5p5IdB+aB3XDZqAmVNjiTr24Udo8eF MNAanFa2qXNNr6g6Wj6JPJVqql9tgrrG57uGjus3G+k49wFZDvNMkOy+JdNmOMaxozIrrc0l273g xx7WOBTZGR091RZQW7tCYr2Ax2kklZkjk6qY2uERHmmcNak35Lwb2dXGq6I/GFuTkurvO6aWtJA8 NYKo03N3gNG0Tr3MIQpkaanyRaMHJdYC2skFNEQLJkTfQ9Em9NG7Vu0JncdSs52Tbj5FjR7mhx9p XQ4vR72tm0iT25WF1Oj0eoXVdgR+ICGOQJI3VMEANmnKqtbIMHu0ohtqby9o+YWPYyGEoBUntjus OQ9ndOVit5sb96g7qGIPz5+AKyaXY8H1mudr7S0x8oUnPra6fQG3zJJhL2x4q4z4N1/U6B9EEoL+ qfu1/eVQJ1kCPJMniAC0zLdblusJloHdP6rgNe6rY/0j8FYeK9g3A7uZlNI9TKJ1DxRl0uKcP8Dp 3HgolrTLmkz4FDLWzAJLz2CcwtmQDpqT2Vixxr6ZtBl2Q/X4N0hUhRfEOdA8OVbubBxKP3RJ8NTK aejJj6tqlmyprfAIgAVXJyjS5rAJJEqywkiSoiDv3bMZDYdGaQTeCQ1QXrpJJaoKVx3Uqcium2u1 59rXt7T38EvRruYa3WGsu7gcKf7JrYxpFjrNrt06cppyQHzEsgw5ZD0gH6u/iZdGWwNtsHqtJDyy I5MS2PBXqTfTW91TtwBgFuvt77mrl7WtrfZbDi8mYZA/Ki4XW3Bv6QPa4GAXfk3BRmFjiiQQsOOQ NEEF2n4vTch/q2U/Zrwf6Rik1PB8do0Kt1dS+tGA0fs/Jr6xSP8ABXgMtA8N24EqhX1Gu0A3NBP7 x5/zm/xR2tqcP0dmydRv1E/1m/3IcR2P4sZh9G636+dUY7Zk9AyGOH0vTLuf+2yrA+vXULNKOgZt h/quA/8APa5vobvrR1XLyGVdS+xvw3bHCsSYkjQk+S3T9UMrLk9S6vmZU9ja4N/zWwFexfD5ZIiR 4IxPiWpPmIxJGppjkfX/AKxRJs6O2iP9PkNr/B0FZVv+NHrFjtmPh44d/J32/kMLexfqL0Ck7vs/ qu7l+v5Vr4/RcDHH6HFrr+QViPw3CPmlf90fx/gxnmpdB9rxWH9cPrrkZTbRh/aKQD+h2ekwkiAS fpaIvUsr67X4lmffXThsoG81VM9xHfVzj+Rd42gNEaAeDRChfjU21vqsG5lgLXA9wRBUv3PlhdQs 9yVv3jLe/wBA87d9UOm9Upq6vZYb22VNurax3pGdsiT5eS419nSMjILPTFj2OLQb7XuIg/ynLpfq 6LsRuf0y0A/s+4tYTqCx0ub3WD1rqtnWLS+3HxYqMb6qwwnWIceTwsyIlGcoEn0t0H0iX73WkuR0 p9WI+m30n1ObuY2RvHeGjuFhYeCKbHD813C0BlZGO6ul7m7aDsDZLoB7DnRGvoax+5mrHjcw+RTs 07iOH6r8ABOu7VoG0W47jAePkQdEOjDZU6QPUIPtJ+iP71O2ytr4gSz6Tz2VezNAfDfce27+5QRE jt1ZMuQfL2bxDTo+wvP7o9oUmNYNA0D4LMGXa/6MADvCd2SHEMkyNXEafkR9s92HiDpnYOGz4pw4 9oHwVB2W2sbQ7c6J2HmPIqs7Pc4e0nXxQGMlRmHVfaxv03x80N+bjVCXGT2B/uWNbmkGGiXnueya gWWO3DR37x1J+ATxh6lacnZ1ndRybYZV+jnmBrCPS0VDfYdzz3cVnMu2HeB39x5JI7BHZbdadwr3 ebjATZR6CguB7ujVaXnWI8pKsNeeFmetY0bX3Bv8msSih7WiXbnk8bj/AHKMwXCTf3ypizuFSY8x EQih/imELgWGZ0rDzPcW7Lez2j8reFhX9N6jiv8ATa15b+a5kwfuXRh+il6m4FrhIKkhmnHTceK0 wid/weXbgdQPuNZ/tkD/AKorX6N1HY1+N1C2zGxhA9JgFtI8d1bpJnnQofUca+phvxpexurmE6ge XiueszLjMAa6lTw48g/RTP2I1Rk+iWnojt1eLZ6Tq6w9gncx7ImWmJbAWbb1ezFhjmhodq07pa4e IcOVkYmdRX1ZxyiTi4mKa7C3kuLNkfDe9ZNeba1pqsJfjvMmqeP5TD+aVAOSBJMjfVsDnuCNC5eb 0h+sT2asIZGoImQVHL6/Y7GpymuAdaXssiAN7I1+YcFzbek52S+cWbqTJ9QnaGgc75OkKOdbQzHq wcZ/qspc59lwEB9jgAdoOu0BsBTR5LF5sUviGQmwKdO36wWn/Cx8NfyIVPUcnLubRS5z3v0aOJ+9 YrWyr/TS+q71a3Fj2jRzTBE+CecGKANBbHms2SVcVM7cvKLy0S1zXFpEyZCrW5FweWlSq9+W951M kkoNzpufInVPjGINADZZknPhsyN3SxutP533BDc+zu4ogDSdZA+9HbRjE+57j4gAA/eSn2B0YPVL rf1R4hPoZTidBWB8y9qjlN32hzRo4NOg7kBaNOFccWxmPW4vsc06Fo0bJ7+ZU29L6nYaN9ROwjc0 kDQGd3McIe5G7sBdHFIgivFz3DdjOq5OOQQf62jvxhNjti8NHO0/erdeBZVl2Uuc0h+6t0a6n/ao VUNryG2F0QYj8EDMa0ei8YpdRTm6nnlOGSOYV/Jqw6b3tJmCdNUI34zfosn4p3HdUCxnDR1kGufc 0AjUd04osPDSfkjHNj6DAEN2Zc7uB8Aj6+1eaKxj9InyDJuJaSARAW7g43pV+Z1Px8FQ6LTZfab7 SXMZ9EeLlpWX+lW+x2gHA81BkJlLhvbem9i4cOA5dp5PTDuB3aWfYDaWtgAaQFnvIGqVmS57iXd0 M3MOh1lTRjQpz5Ss26PS8W2yt1zBq4wD5Bb3T7svGJbYZbGgKyenHLfWBjDaysQfNadlz/TaH/Tj VQZNSy4wNEb+osdmixzZeHgg9tCks0i02T2Bn8UlHwi3e45e1w16eFx8uo1XOadfArUwGivGAtaC 4iW/1Srt2LS6XOrl3iVmuvoBLdrmObpxKsDJxCqedMaN92F7zq6NBMLO2O7iFqMa+9wO123tpCMO nVP+lIPfVO9wR0RwEtTpDHix9ke0ACfitptTwS5rSW+JVI4orHpVvhn0ux1VqvNupaBfttrHE+06 fNNkeLUJGmjp39S+r32P0epUstyK6pa0thzj+aGvb4+a4s6kkCJ4AWnlZVV+SLG1hxAjglXemsy3 3AikNp13FzY0PgkJCA6/UpMeI9nJwMO/IvFbNzC4GHwYnwJVvO6Q/Cp9S2wOc4+1jQSSfuXTVtsi ARA8kdtVp0kH5KKXMG9tF4wgCreIx+jZ+Y6aai1o5c/2hXqvqn1Jx/SOrY3xmfyBde3Hs0Jd+CM2 kaSSR+CbLmpdAAkYY9XnMX6nUsg2XkuI9waNPxWhV9V+mNHu3uPmY/IFqirv8e+qk1gAgSojmmf0 ivEIjo0GdC6UwfzAPxJKMzpvT2E7cdg84B/KrQbB8VLZpEwEwyl3KaHZE3HoboxjW/BoVfOy6MHD fk5Gm3QNb+cT9EBXtsDdGg7rifrd1MZGaMSlwdTj/Sju88/cn4oGcq6blbOXCLZM+tuaXnfTW9oO vIgfGVndQzHZWW7IcwM9SNGmRoIWeHECBo3t8URtrGt2nkd1dGKMTcRTXMydykH6QEboHh3UCw1x ZU73AyAYPCatxJLWR79BJ4UnUk6tcH+IAiPgnIRPybHuLnGS4ySBySma8vhpmJmSUZtFDtd5nuNA ovbTWRBk+HdGwilFlUHx8kHZPBGvCM2rc1znmNNAlRQLn7C7aOSTwErUxpa9u47TA0lH21vb9JzY 1IiUbLPpsrqrEMZI858UJlztN7SW+XCB7pHZG2qt5I9SI40hO0MrMtDnn97gKz6rC3VgjxUvVafp HTs3shZTQQnMa3Th3nr+RPm2xZVcDJ2ACNOyMxjrn7MWk3P7hgJ/Iq/UMfMpsY3JpfS4j2teIJE9 kBVrtREoH2vvta52pEDRbLPoqmMWyqzc3DuEcAtcdfHgIwdnk+3EtP8AYKbPWqplxemzK7Pg2dEg oMxusW6Mw3jzIj8qss6J12z/AATWf1nD/aozQ3kB9WUG9oyP0Qym3RqrzPqz1d/0n1M8dSfyNRW/ VK2f0+a1o7gN/vcm8cB+kF1TO0T9XHtJjcwgmdQfBTozbajLXFv4hbOR9VsCnCsyK8t9l1LS8A7Y MdoCwjWELhLTf6LgcsDezoM6gyzW9kn98KRq9STjOa/cdWnQ/isrY5urTCJXkPYZOnmEw4a1gWxj 5ytMg+rdy6nVNY/Ga/Gt4sY47qj8G9kOvq+XQIurLR/pa/c35hFr6k5zQ2yLGDSCiVUYuS8Comux x0HIP3oDIRpkjfirJhhkuWOX0bH1a6o3F+sVOQSPs/UQanuHG6Q2f86F6e2ImPL7l5Z1PpGRjdM9 VrqmvxHG2Q9smT2bMr0TofUmdS6ZjZjRPqsBcPBw9rx94WryOWM8ZA/RcbncJxz16um1wGkKUhQa 48aBSBnzKtFqrobxoiwmcwwkDSnjOtuf0zrbMprSaeos9C0dhY36Lv8ANXOYXRs/Gue4Ci8OMg5D CIHyXcfWrpr8zpN3p/z1EX1f1q9fyLzHI666Ye73DkEys3n8WQZOLHVTGrpcjLCYGOXeOz1LaM5o l+bjY48Kqmz/ANIqFteHDjf1B974hu5rYH+aFxz+uSeSfkgP6w48AlVBg5gnU03Dl5SOwCbMzXuu 2NAIcSSnYx20l55+m7x/khU6rRbkC2Ox081atsMNYPCY/IrJFUPDVz+KyT0vRluP0GaOP3NCJtZW ye/bxKGwtrBLj7jq4+ab1DIcT8Am0VMLmPtr3gRdV7gRyWoLLgRqPpeHir9N7DaCTqVQz6Ps9zmt 1rcdzD+UJ8TfpP0RLuzDA3jk+KJTQ60l7jDW6EA6n+5Vq3lzRuPtCMLWDbYwkuGjSNAkQdlAjdvM cRo07AOABwjNrLtXvcfjoqdWSXkNMNd2jg/BWmhx1e6P4qGQIXjwbDNrB7RATtIc7c4oO8fRHCFk ZO2K2fSP4JnCSuum+3JqEwdWpC9zzA07/JZ9ZgD7/ij+rMNbyeSgYUq2+LR7dUVr54VBrgD8NEdl iYYrgWyyyFUf0bp1uSL3BzBIc5jIgxrx5owdqpb5iUgZRNg0nQ7tf9j4z2vZXZYHZrwC59cREvj5 oLujdFwnOGVc5zmmC0ENH96uXtstDdlrq9pmBqDpCNR9YaqMa3FOEz9p47m2U2auZYwn3S2eY8FJ GczsSe6jGJ7Obg5OM+wdPpoaLLn7ay1pfuHwfpKo9a6NeH/a6ww1v7s9o0HdsCD5L0VvVbD0tvUs zHqwC1u4+o6No7bTEyfBcB1f61jMaaManZQXbnE6FxHHj4p2OWQz9EdB81lBjCqmfscL0ra9XtIH mreFw93gECzJsuGoDR5I+Npj2O+P5FPO+HXurGIifpNijqUWLrY4ozMWuywhs2POu1ok/hKFhgQ4 kwO58lJvVMmpnpYv6Gkfmjk+bncpEEk0U8cYxjxC7NtxvSMlwluHafi0j/qoSd07qFQ0wbY8mz+S UNnX81rA1zGOA45n8qtU/Wexkb6nD+q6fwITDHL2EvquGXF2lHyiGnkuyqtodS9g2g+5rhqdfBBq y3uf6e7R4LY/It1n1tpHJf8ABzf7pUz1zo+Q4G1lbjzLhBn8EAZAa4vsV6CdM5H96P8AB5vIusPp 2hxlw1/rN0KhktJs9Rsltg3j4nn8V0+z6uXt27Nond7XHk/NyJ+zOjWVtrZe5gBJEkd+eWhEZwP0 JD6LZYDK6ywl9a/NwLOnuygzIFrR6rRuBkHc3QpN6OG/zm539WP4rpWdI6WKfSNpsG7cJcOf7Km7 p+OGbKdsj6PuP8Uz7x0sj6KPKzOtA+Rt5yvC6ez6dbp/lz/BTux8Z1JbQ1gLoEiNPNbD+mZY/M3j +SQVTtoDGOdEOBh3kkMpJ0NrsXLHi9Y4Yx1JP5IPUOFUynH0I4cdSqXUcqy0Brjxz5nxUnPL7i78 0cKpbNj4U8IgefVgzZTORI0GwHYdEAqfYYHCt4/Tg++thOhI3ItWOK2ieVawhFwPJkAR8UpTNGmK MXXfaMWv0MRuwD84CSVXqtmXWNk66lWX45ceCfPshnG2tcYHCgsNiI9QHiHO3t7QB3STgMM8td+B STL1eho+3Xg9AMffILQmGEwnVrfu1VxpaB5+KlqAe/cDuo+IuA0jgMPMKH7LaT2WgHEjcWEH92ZT ySdW7QlxFVByL/q3j3lrnSC3QRIU6Pqz0+stc5u88+4n+9bGs6filJ13duSEvcnVWUcEezWZ07Gr +ixo+ARPstQB0jzKJWwNaGhxcQZk6lSdWw6ga8num2epT9Gv6mLW7buEgT5DzVhgaQIPPCXotOok R2HB+SkA4nXkaJKXaPHtr8U4HefKEtdsjUp/dGugQSxIdBDGjd210lV7MW+2xr3Xvra3hlegPlKu QNsfgowNdZPglamDqy6ssa4jSA6fd8UmNLWBrn7iOXd05bABnVRf7YSU1uo5NGHiXZVp3mtpLJM+ 4/RAHxXm73ue9z3GXuMk+ZXU/XK2z0qKm/zZcXO+I4XKO0Cu8tCoX1k1s0rlXQLyP838qG4qcQ0B QJVhiSM1ZHaNUWsPBgOgHUAodRJaAPMfFHpe0sAOhGiaSuCn0OcJJE/BC9MsMDU+KuH6Cq26O+CQ URSziRLu57FPiu2XNBOjufmou4OiGw+5Hoh0M+t0VmQSZmBHgqkubpMSj3X766wR2PuVVx1+CCiz FjgDJ0UHWkmJMd1EnsoubARoKe/+rHUsJuIymgCstA3jgk+JWb9cbmXdZwg3UNa0H5vXP0Myt7Lc d20honUeHgnysjIfksfcZtbEfIqAYqyGV3oW2eYEsQiRRBD6U7qLAfotA8FH9q0g67FxI6q+JtLg eTMpHq9B4eFB93LZ+8QrcPanqtETuYPkgP6tV/pfuAXHHq1PZyG/q7ORqj92PYqPM4+4eus6rSeX Od5TCA7qlU6M+a5J3WHn6IQLOp5TuDtCcOWPkxnnIB6zK6o19NlUavbH3rJhY+PkW2ZVYc8uBcto BKePgod1Rze7rWzEtUHVyj7ZInTxWx1DAxLMIZlDgCxoDo4OnfzTDOiF/CCHm9jmmWqbcmytpAEm IlGLQoPrGqfYOhFrBEj5TTUflufOhIiOF3H+LHqIuxsjpzne6p3q1A/uu0dHzXGmpu0hrJMeEq19 Tcy7pPX8O65pZTc/0X7pHtf7Z+XKs8pOMZaadGvzokQOI8T7O1siRqQpbSO6K2v/AHJ4a0S6Ggdy VfMnOYMb2U9iq3dX6bjmH3t3eAP8Vk5n11wawRRFlg4a2Xz82iEiJbn0jvLRF9rPlq7rqQQQRPiv Cvrl0p3Teu5NG3azeXM8Nh9zfwXb9Q+v2QbHAPZjs7Nc7e6f6ta5nOOX1zIN+WN9Ue2/bsdHgN3K hy5IcNcXEfD+LNihO7Maj4vI7Eth8l0tXQOnY7xkdQuP2RpjaPa55/dnWPNdl0bpH1Purd9kxq7R Zo8WTbA8i7UfJU8nMCG4J8m7DlTIWCHy/HeK3M8AdfmrdZdJeRucToPgu46/9QsWuj7T0ague0+/ H+lI8WF2vyXFXsups9D03U2OmWvBDmgfEBNjmjlFx/FE8Jxi7YemJ2uO555I7KTtrPPuFIBtTDs1 ee/eVGukF5fYd3cp1rErB7d0RPH96DmtdbVubqW/SHjHcIr3OsEVifIKbBfEWsAaO8poNG1VpTk1 tNhG4wwdlaY1kzq/wAGirWv9O9wH0SZBKsMduGrzHkFLLZYN6TkmIDA0eaJVlEDZaZb2d4eR8lXg EwJPmVIJlBcDSazJLRDTp2Q2ulwJ5OqE6Gug/Rdx8UmmDABP9yXCAFEkttr4CNWdjNztC7hAqYGj dYI/db4pOsLnSdVGRa+21W+f70dj4VRhPdFDtEyQXAttrwETfoCqbXlGa5MMVwLZDpWX1zHyCW5m MS11bYft5jxWiDonY8EwfhqlCXBK9/BRFinj323W/wA5Y54/lEkKIatXqvShR+nx5NRPvbzt/wBi zQFdjMSiDFgMSDqvGitN9uC4+KqlW7Gn7GxjRJcQAPimy6ebPi/SPaJQNdtxHnu4wg1gxKvdR6fd hYmOLWkOuJOunH+9DFQa0BHiAF9ygR45Cv0Q1oSRyzVRNaXEkwKJNtnQCStLpfSLc+7bqylv03x+ AXXYPTMHBYBTW0OHLzq4/EqLJzEcem57M2HlJ5NflHd4B1Jbq5haPEghIGxv0Xub8CV6D1DOxcfH cckNe0iG1uE7j4ALg8gM9Z2yNpMgDgT2TsWY5BZiQs5jlo4iAJCRPTspmZms+he8D4z+VHq6z1So 6W7h5gf3KnCcMc4hoEkmAFJQO4DBVbWHcwuvdQyLBW5ogcvECB9yFbfZY5290MJhrZ0+KVVf2bH9 GoB1jtbXd5/dHwQ/0DINz4PZg1KjEYgkgALpZDwCAkT1NsLay1u4GR3hV2WMpdud77TwwdviUW65 jg6upjgT3JgquMQN9zz8lIPFhPgtZkPefc7+y3+9W+k5XpWBkaF4PMqoa2wY0A5KWOXVWerJDRx5 pSAMSEAmwXty4nUuGo4Cr5lrKcdznHU6AKlXkNcxtjD9IKtmercwkH6OqriHdtYpATiSL1CN2bLg ANoB105HgkqfpXD4JI8Idj3sl3R/se4ZAJcph4mRMDRMI5ifNOWmDoJPxVZx6XJP3pCZHj5J2jy7 QphuknjufJBNMALJgmPFMa/U0BMH8qMWiIEGUth+j3CClmMLNI4GpP8AcpBvc6eSdrDBAPx7pFvb mCkpTTPaU4Du2hUmiNP9yeNeNElK2geSQEfNPBBTxHAIlBS0Dkyk1pMkAa90i2RIMDwTgaSdPDxS Us4OMNHdCfXu547HwRgDqFBzT4T4pKcTqvTW51LqiYc0yx57FcPmY9mNc6i0Q9h1C9QdVubqO/zW T1H6r4Wfd9oue5r4j26SB4qxgzCGktmLLjMtRu+fF0pCt7jtaJK7sfVLo7AB6bnnzcdfyIlfQ+n0 ghlAA+ZUx5qHQFYMEupDwgqfWCHiPBErALte+q6P6x9OY3DFlFYBY73bR2K5phLT/Nl57cj8ikhP jFrJR4TTaP0YVW3VymBlP+jS8/JykMDqNh9uO8/2SiKG5CjZ6IZCG8FjyDoYWgzoPWH8Y5HxICtY 31X6gbWuvLK2g+6TJ/BL3IR3kPtUISOwLkVfpGkajaJCgQ8LtsrpmJV0y+qsAvFZgwBxquQNZ4PK GLIJ3Q2VOBjV9UDJBM9wmceyK6sxxqEIiCZCkpbfR0Om20N3j0zuLAN2786fpRHh2Q8wk3NPhwUL Ee1jjJgOHKlkvDy0jWEwj1Wu4vQB2T5DpYSeYWbKtvs3CFYyMb9CXNxTXAkvJ1HyRB4dD1UReznM EmEZ9ZAbA3TKg2A6BqrlIyY9jwwHnSU4+CxququrDXxt10Km5rSQbm7XO13N4PyRMn12R6j97Z00 0R8fOyKQDWGDwJY1xHw3AppJpdQVjYQZYy0H6JlaJtgS4wPFZ1dl7skWF271HS8HTU91qta6wBtm 0VExOnHnGqgyAmQstjHMRgaHVdtJe3cHjae4XR9O+pXV8rG3131NxrgCffP4NB1XE2ZBoybBSSGB 5DQPAfFaXTPrFl4Vm+i59Lu5YYB/rN4Kiz4chj+qIB/rC0DPLvT2tH+LVn+HzNe4Yyf+qctGn/F/ 0OuPUNtx83Bo/wCiFzv/AD96zZUG121SBq5tY3H4zp+CpZH1n67fO/Mtg9mnYP8AoQs/7v8AEJ6S yiPknj8S94z6tfV/EbJxKwB+daS7/qiuf+uzugWdCuoxn0V5VBbbSK2wdzTqNzR3BXJXZOReSbrH vPi5xd+VZGezKbY5zLJYRqwyf4Kbl/h845IznnkTE8S2UxRFW9rT/jFynYlNcAPYxjLrXaDcRtHE u+5VbvrB1rPb+rPfcTz/AINgjxfZJ+5cdidSOM8Gyhj44I9rguiwOvdLyi1uXa+knQ79R9615Z84 +U0P6tfsYY4sR3GviprOq5H866thJIJ1sM/FxRHdMfkVsZZZZcdwIaTtYR3EABbNDMR4D6Nt7Xzv cwiQP3oMQiODDIcNeHTpPg4dgSqsskpG5EswgA51PTcOivcypjQeIbJPkSeEGwBxkS5upDZ4nyGn 4q5k21N9pcC7uOZ8SWiefgs+6zTd75ExtbGh553fkSF7p0Y9R6Pi2CuzJzqaW1j+YDXO1Pc7I1+a L0CnpfTMuzId1Dcx/FVLXMaP88lYmT0g5FjraXvbvJJY+QB/FU7+kdRqdDBvHaDKJiZRMfcq/BkG WMSDwHTxfUW/WXp1de4Wkt7AySub+ud2B1XFb1PHeWZWK3Y5hH02E/8AfSuItfn4x2WzWYkAnsgD KtJkyQeUzHyZhISE/wC1OTmoSBHCWzuc8hoOv96K9zWNFbe30j5oIfXXqw7nu7+EqLZMnurBDVtN U97HSHQfJWWWucYtJLXCCFSkg6IzPUJBdpCBCQVZFDIc76RaJBj8ECqwFsjgq3cSKiD9J2ioNYan lh+idQjHUUUS0KcXawB80+4kobOT4BTBlGlL2a+0o2PbWGlo/nG8qu5wmfBDrBk2AweyVWFA03TY 5zvNTZPJQG2BzZHzCn6wOgEJhB7L7bDX9+AFNridSqweBoSiNsnXsO6YYpBbIRWvHzVH1i4w3hEY 8hNMU23g8/JOCqzLETemELgUwcOCJadCCsvIo6PVcWWmyonUEajVXw/xVXqeO2/HLmj316/LunYz UqNgFUtQjb0nAyP6LmCf3bAR+KsXdKz8UVWmoW11kOlpBBhYLWEuAaYnwVv7Zn9Oe30chwnWJKnM TYAlfmtBkIyNadSy6jnXZmRTXaHNbVMMJ4nn8ibzR2/WF98NzMevIj87btd97YWgzB6e6tmRbW+k HX0XOmR59wmzPCBYpl5YGRIjZvq5+Lg5OY/bS2Y5cdAPiVsY31dxawHZVhtd+632t+/kqD+s41DR VQA0DhgEADzVSz6xPrta+mLtvZ49s/lKiPvT+X0huGfL4vmPuT7B3LcrF6ZQ0Bnp1/mNaOVjZf1o uMtoYK5/Od7j9yodS6x1Dqjwcl42t+jXW0MaPu/iqbWAawnQwRjrP1SYMnN5p6QrHHwGrO6/IyXm y55cT3J1Q9o4U00aqa/owiNanU9yx2hXOk1Vuyx6o3NAOiqkLSxaHU0hxEPs1nwCEjp5ruAGMjsI h1v2Tiu9zCR81E9Mxo1MnseFUx829oLC8wOysGzcNzjH5So6l3YRXZrW9JLXk1R7udShPwXgQ4Ae aJk9UZS2GulY+TnZOSSATtUkBM7rJGIZ3uxKDtJNjh+aOJVG7IdY/dx4BT+zkDe/7kB7SDqpYgeb ESW/h5L2M1JI/NHmrbxkWs9Sp0tPImCsml+3Q8dvir+Pl2M1aZB5CbIa6L4kooyN2wyTxykrb7ml zbRIIiR5hJM17Bvccfa4+M3W1vcgduPJTA8eR3S2kgRp4BIv/NPI/FUWJRPdO0aEeOsJxoAAPOCl DjLoie0oJC4AP0u3H+oTFhncNfJSkhpB7J2kHSY4+HySUu1pAkDzKkBudpEFSDXx7AXduJUxiZVj f5qwR4Awkpjtjjv38EoPJ48VY+yXge9m2dRuIb/1RTeiATutpYBp/ONP5JQUgIG4an8ilPYfin/V Q3e7IZ/Ya93/AH1JtmF+Y660Dkhgb/1TkkrbJI04TkaQRqmssDx+ircATrvs7eQY1JuXc0w1tLYj 80mPm4pUpdrHO0Gs+Cn9lyHf4MjwLvaPvMKFmXlPBAtc0d2sO0fc1ALiXS4bifznGT+KSmyccNIN l1TPLduP3M3KLhiMP849/myvT/plqDL44+PaEonUiPFJSUPwtsbLT5ksb/5JM5+GDAx3OHnZ+Xax DJA51PZRD3h2gEFJS7zjFpacQOHfc8n/AL6gPxemOcduG2uNZDgdf+20Z3qOMjQjXVCIsAIIB8gi CQhGzHwnSNaXTp+jDmkf2dfwTOw3ixraSLi/gsBHy2uAKHtcxwjlPY2TJJLhqPI+SdZVQVYx9css lpHjyExb7f7lZrzrCz0spn2mrjcf51v9V5lNbizWb8R/rUN+mIh7P67f4oJc+0MLHVkcgg/NcllU 7XERqwkfcuwta2C6YjknwXL9Wrury7CwB1dnua4cfNWOWmBIg9WLNAkWBdOftntyq19REuHzVtto Gh18UO21mhB1B0Ct8XYNfh7tWmGk7geNNEaxzXsaWiOx7K19px3iSwh3cBByHseBtEAHum3Z2SQA N2sXO7NKvfte9zdlle5pEEeSTLmhoa5o+KsV0VWAe5rEJSH6QTEHoXKG31NQR5K2bAGgNmfNHu6T a5++p7CO+qv9NwMZjd17xY+Z0GgQllAFg/RQgb1c7qFGzEqeTJJ1PyUvsthpZsHLQVv/ALOwM1wY 4bQ0/R8SrzcKtgDWt9oEN01gaKA59AOtsox/Y8cyjJrtY6zRu4CVq47WyPa5xc6CDo0/Aq31jGsZ S2xrm+nuDXMI1nyVSkAkAvLgXfREkgeScJcdFEo8Mfq5F4/WLREQ92nzUONQVPIgZFo4G93PPKhG minGwYUovfW+WmPgrdHUm6C0bvMaFUH/AEvkogA+SBiCniIegryMWwS0/I8/cmdttdsZXJOkxqsR rngDaCXExA5XW/U/pnUup5Qpx2AhhBych49lLe43Dmw9gFGY1tqvB7sKPqd9qY1z6jba/wCjU07T 94BK3MH/ABS1WU+rlP8Aslx+hU13qx/W3CF6Dh4GLg1NrqbqBBeQNxVggd06IlWpWkjoHzfI+oPU On1vdiWue8A7RQY3eG5hELn8i/r2A019WxLmMAgktLZH9YCHfevaJATODXgtcAQeQeEOEd7XcZfG endR6VkZDG5Fr6aXaOcxoc8eHJCN1a3pOFk+nRl+qwD3FzS188/REr0fqX1P+r3UtbcVtVn+lpDa 3/eAg9K+o/1a6Wd9eMMi2ZFmQG2EHy9oQMR3VxPlFvW2Ttxsa293i4Frfwk/igD9vZE+4YzHGewI 8tNV71FIG0Mbt4iBCz+o9J6Rm1mu/Grkj6bWhrx8DCVxGwF+OqhxEvijekhhLrXi+x3d43flQr+k Mnc5wYPkwfwC2/rf9V+tdKc/Kxsh2T0/ndX7X1jwsa3t5hcaS5xlxk+J1T42RYl9i2dDSk+RTXQ8 bLG2DglpkBMyys94KE06gHvyn21HRwLT4jhPrutBbDXAajVOXkquGuZqx24eCk1/yTSEgtmSRqZh CyQNocOWp2P0KjYQ4R96QFFJ2R7vaY7lJr4UG6MhIFOpZbN9jSIHJ7KYBADBz3QaxuePJWSQwTy4 oHTQLgsRs457hO0x7hqmbVY4y72hHorpby+Z7eYTSQFwBK1bHv1Og5JUnOn9HWNO5SfbPsZx4pg4 NEA/Epv0T9UjG7Qp7ggG4EwEhucfyIGJ6psNkWgeaK15fwqrGxq4/wC1GqceB7vIcBMICQWwASNd P9fJTNQII1g8pmT3geI7ojWMbEyR2k9kxeA4jqWV5PpH6QOnmg9TP6YDwatjPxWmym1jdQ6HO8o0 WVk1HIzvSHlJ8AOVPjkDIHtHVMon2iB+lIBL0jHawHLvHt4rae58fgpZ/VXOJawy7ufBNn5IrYK2 CABtYPABZ9Ldztx1RERImctv0QvnkOKIwY/mPzFmBY87nk68hTDU4CdEljjCvE9Su1uqROsKQENL vuUEGTZdMSmlLVFFp8On17mtJhgMuPktnLIAY0axwFnYlJ+yl8auMj5InrusIMEEaDxTSLNsc5nZ Ha51dm7ieVO6617dlUieXJr31kQTNncjhQZaGD3cBOY0X2B7jL3T8VP7KGDsmfnHhgQjZY8amSeA j6kenpqUeQ9rTtBVR4JO4q+3GAEnUqvdXBSExdBn+6TEOOQrsGu3QieyL6u15jRp7IcdlIVgwPzv BPYZxNWOiX1jt5kJIO0tMRzoklRY+I/2PqoZjgScgEfyGPP5WhFFGDa0O+0OHxbB/Iq0kAjkkcBM BoIcRrxyswU3C2bH4LDsrZZeRHvLg0apevWB7cWsmfznPP8AEIXGsDzlIzpBEHQoWoJG5d+6G1UN HiGbj/0iUUZmWQAHhh/daxjf++qvvLdB4ansnknU8HnxSSmdk5f511keTiPyQokl59xe4+ZJj7yo SYkfepCS2Z18CgpbbUHTtBIGjtFIEE6aR27JEM0GnhpwnYGTAjx80kKgEQRPmmqABLSfipGHDTgd k7WAiC0SdQkldzSdG9+deyQYHDUD5J9kkHgKUe33FIqQlhAj79SmAA0mCiSDpETymIBIEahBSmgQ AQUxEExx3Uw3mRBnupem0t4+5JSECTB47eKiWmdT8ArGyeOEtrQ0khJTXM7vNDhxknv2VvYx3hJ7 KJqMkfOYRU0rASI26eMILxDZPC0TUBqZdHaEzqWzpx/rolaHMI10HCeu59LxZU4se36LhoVfdjNi NR5jj5qBxWkx4fwRsJ1Uaquo1fo2trzYPqUjRlg8WDx8lzef9Xm2T6T31n85h1APhqujFIadwkQe R2hXHVtz63vI/W6Wy4gfzrR+d/WHdOjMxNhEhYfOL/qzkt1bZuPhx/BAb0LLa4+zUd+V3ewT7hom 9JjgT/uClHMz8GP2YvEO6PktEvaVWysR9LJcCNY1XevxQYGiwPrJiOqww4tIh417d0+GcykAeq2W MAGnKx+nC2hj5PuEnVFZgivQy4eC0ul4jrOnU2NEy35aGNVbq6RddqRt8ilLLqRfVIhoHMYwjVjP 9fkpmvIPuDms8gNfxWtX9X3jV1keOiNV0qtpguOnf+5RnIFwDn4rg0zYTub3OhWlj5v5tp5OjiEh 02rknhEroZwSXAadlGZArg1OtCs41bhq3eZ7cscB+VYmK58MD3hrA4aiN34are6xjD9mXFrjDAHA f1SDysKgPDxtaGDeIsI8vFTYdvJZkOjk5ew5dxZO3eds88oWvPZEyP6TbJk73a/NQ1CsjZrrv51U Y101+ClZ9I/JOwQ6f3RKKadDpbemjLqq6je7GxTJybam7rNB9BkA6lel9L+v31D6ZhswsE24+PVw 30nEknlzjqST4ryJxOwT4qBB2yNZQAUS+3Vf4x/qha6PthrJ72VvA+/aVsdP610nqbS7p+VXkhv0 gx3uHxadQvnmsneFZxsrIxLm5GNa6m5mrbGHa4H4hCUUgh+h3P8ABRdaQIbq48f7V5/9T/8AGL+0 LGdO6xtryne2rKBDWvPg8Hh3w5XcF8E6a+KikCN2QAEaJ/UgamfNDdcdYPHKrudZEuMF3hwAoOJa JJlo4801eIhP6xj8iBdvLYBmeVEOP0uSdYQbsh1TdyalBk0v2kNG6dNp1/KvN/rZ9VjQX9Q6fVFI k30N5Z/KaP3fFeg2ZhsdDhBPBCr5VNm02A+5us9o/leSdCRibRKIkKL4wVIOke6JV/r7+nWdUtd0 1mygnVo1aX/nFn8nwWv0rpGN03Df1DqFfqZbmfq1LgCyskaPe13J8uysynERBPXYNcQJlQeZ9vwK cmFoYXSLup5ZrpAY0S6x5HtaPPz8lpXfVeqsxW8vDf35E/cgZxG5XDHI3Tzweo3WQ2B3W4/Aqxz7 8Vrh+9qQsnqbB6u6tgY2BDRx5pQkDLZEoEDUoGu0jvCadFGdQfEJ57p5CxLX7BuOif7S0GQJd4qu 5xcYlGZRXALiZ7oEDcpsriy24xMN7nspOfPtaYaOEnHTa32t8EwbCCrVuc4IjWkt50Q41/ii1n4T 3JSKQkaxo1d2U2lzhLRA8UIua06+89iVI2abnmB5/wAEyrXXScBk+87o7DiUX1CByGs8eAsx+ZGl bZP7zv7kCyyyw+9xd5dkRjJ30VxgbOpZ1PHqENJtf2jj71Ts6rnWaNd6bfBoVUN8FNo+9PGOI6X5 rTOR8G3g3XuyG+pY5+7SCSQtB9DMZ1ljjN1h1jWG+CyschtzTMQZlWMjLJDpMuA0Pio8kSZCtAdC 2eWyxjE8epGsWnk2ereY4GgRGM2thBobL5PZWU6WgAHRbj9UpTPUrKTRJTASUelg5PZMJZgLR3kN AYO2pQZTWPL3l3imBTgKY5SBLKeynVW62xtY/O79gPFDlaXTMXex9x0P0Wn8qRNBV6NuphFOxurR oPgqZbttI8OFaZZtBreTPgOEC9mwh4duB7psWIontE6BCD2h/u1CNbTa9s1OAB5VC6m5n0tfABSC lhbxGO5oiAmZU1hJmZ4VPGAbYPUGp7FXwIMcKLJKtA6Xw/l4n9bKieg7LFDsrBGqNsBT+mBqdfJR g06UsfENQ0Bj+4ujQKpduDye44Ww+DoFn5Vc6hTY52dXP5zlgIHgYsua+o7vptBLT5hJVRIMeOiS mpyafVvoifHuE4BMAGI8UodwPknAcTIMnv5LKbi8ka8+SYjX3aSniDqf9fFPtkkn7yeUlK05OoHC cRsgfdCiQRpOnPmnAmSPnqUksuSGxDfwT7ZPgO3ZIA8R8JUwwkoKWbrpypkGCABATBsD28+KTWyd Z+RgoKXbMiO3dOBskkzPEKQrcAIGvCYEaz28RokpUOdrMeCWsf6lO07j2jupAGCT34E/xRUxG4/A pbfDk/69k7NJHJjj+CZpAEDlBTIAyNOO3+9SA5/EoQkEkHTxUt1kwB7UlJIZHMpO28eHBPCaNdAA PGZTOe4SCO3CSlnfvePhwlJPHPiVEEkA+fEpOBPeCeQkpQcO5/imLm7QIGvPio+i6CW9vyKQrDiB M+ARUwdZP0eRp8lAvc4+XYgKw2ppJMe4aQn9NoI7fFJDV3PkaHQzPZTqdZXYLKzte0y13mrAayTB BjQqXsAIAHIgJWpa3EqzGuvoaG2j3X0eH8tni0qsMLsePD/crJdbTcLanbLG8HsR+6fEIrvSymuu xRFg/ncedQf3m/vNSU0Bi1h2jueJVXq/Rj1PE+zm30W7gSdsnT5q/wBtIHjpymfY1oG50EeKQJBB G4UQC0+n9JGBiV41TxcK59zhB1JPCK9r53CBA1A4Pkp+sx8uY4H+qd3PwTueQ3UazrGmqRskk9VI jvPY/EoRZbujt3MyVaLtNR854j4qpfmY9J22PALuB+d9w1SHkpFtcDBOvaO6W7b9J0EFQdll59mP a7zgNH/TIQ7Lr3H+jP05lzP/ACSdwnshWafUxrWhuhrdz8CuexIcGODNS4e5x9p0XQ233/ZrQ7Ee JY4F25mmn9Zc3h6tYyHPId9A6D5KbCNCx5NnMyQftNsxO935VDUaIuYQcq6G7Rvd7fDVCnxVobBh XsHvKZkjcPJPZq4qLTz8EVKd/Nt+JUHAwpu1Y35qEpBBXr1cPyopChVG7wRCNCkd0jZpnQFdr9UP 8Yl/T9mB1hzr8L6Nd/0rKvI/vN/FcY4S1D2pxiCKK2MiDo/Q9N+PlUMycZ7bqbGyyxhkEHwUHh8g dl5D9Uvrrm9AtFFpOR01x99B5ZP51c8fDuvWsLPw+p4jMzBtF1Fg0cOfg4diFWnAxPg2YTEgxteA PaTHc9yhSbhqdB+aiZFTiYGgQvRubG3t3Ua5r3tczXhvwXH/AFy+tRx8d/RsG3dZYNuTY38xp/wY Pie62frh9ZG9HwjQ2HZ+QIpbztb/AKR38F5hjU35+aykEuuyHwXHUyeXFTYoX6pbBjyTrQbl6P6m dAZc79q5jZqrMYzDw5w5f8G/lRvrXl1tMNIO6Rz3C17bWYWEzDxiK66mBgd4Acn4lcN1LN+15MNM 1MO2sc/E/NRQvLlMz8sdgmVQgANy9b0OKelUw2C8FzvMlWLSHT5oWI308OqvwYFJyEj6iyxHpHkg c3Vc11+xoywwfmjj4rqLB3C43rr56g/y0UmHWSzMag03Cscg/fooOPgIA8Et0j3aiNIRAaXVak+o OPBWmqwrYSZPZGJDRz9yG0ogAPOiBKgtuPYJw08pwGgT28eFF1o7e74aBDfZLLjQ8qJsjSfu5Q3P eeTA8AoyEaRaf7S7QQAJ1PePinyLG2w4hodOmwQI81XlOjQVxFlATwFBPKSl3CBIT/xTSdpKU6D4 JIZPdDZHKG9xIEqTvoj4pgJcG+GqSdU1LYbJRUwGik3VRE6tyEQIgLtbqtLA6Yc/dT9opxRHutyH hjQPKeSqVbdVqVdPNlDXOodYTq2CR/30j8VFKQBFlkr0mtygf9Tsou24vUcHIeTDa2XgPd8A4Afi q931T+tFDPUd0+6yvkWVN9Vp+de5Xhh5dW19eFY2wGWkOgz4hdPh/WP6ytwacGuj7IBJsyJ3kt+l o3hvyTjmI3MS1va1oWC+bv8AVqcW21uY4chwIP3FWsPqbqPZ/gz25grvLnYd5NmV06yxx1LnVB0+ fdUrul9Cskv6bY08y2tzOdP3gE37xE7wK4457CQLzb7G2s3NbuP7w0VZ1zj+jPsHYFdJ/wA3GPP6 tX9ir7NsebHH4gSG/esjOwLKLPSyWQ781w4PmCnwyQJoFZKEwLIa1Vjm6A/JaOJgNuHqPO1x4aVS x8OxrhbYN1QOnitau2tw/RmCOxSnI7BUR3avUekMNQsqPub3WfXbdSfTtGnYnha915dW5pnvwst1 zHDa4bh+KZZqiLdPkuHhNS4ZRP0SNvrmHN2qRfSRzCql9bhB7cEqBf2GqbwN33yBrUktlgPtYICE 9stMp2ukaiE7tU4aMMjxA31c1zIsA8SkrFlR9Rp8wkp+P0uZ7B92q0t73p1+fZbkUZbAfs7g1tjd A4HXWZ1hXy0gg6kDwiPmqWDmVCx1DdZO5rme+Se7yNJV6d7vcDtHEjk+MLPlvtSBoy2BpnXUcKQE +7TTjQoe3SBoCphzgASeIElNTa4rAaXO+RUwPkCk5x1AnTglRHqAgujSO/OqSEgEwGjQKW3+z4aK L3MmRM6AkaJfmQJBOh11SSuXa6gc8+QU2uafAD8UIOk7Drr7gptgiAJHcQkhn7gIadfuKUge0tlw HCi1zgCOR5cpnODnaDWYOiCbZBxc3jUyYShxg8eKgCQ6Rrr35RC4/R0GvCSmJETJ4Osp+88Ec+ai 7kF2kdgn3Atb2I4+SSlg5rgY8Tp/FS3azHMyAncNZgR+RKG6SeUkr7ndgAI1lPECT21PdR3DTQ+X xTsd9LfoT2lBSgBprA8TolukkHg9zwnlu4DgdieEn7gdII7JKWAAiBACRa5hDgBHZSDjIDu/bwSJ boJPHB4SUttBBnk6qQ2ujTUcwmEzD9SRyPBPPLWkQCNRykpTgTpIaztHJKG+x26Ow7qTnAN2yST2 CE5zjpGgHCSmL3Ekdz3Kd9RcWGtxZYz6FjNHDzDlHaPbEiNISL4iCQfyo9UJ7rL7agciphtZ/hq9 CR4vYe/wKysnEbldSqqtIuxaqPXJb7muc92xu6PCDyrL3OdMOJHE9tOxWIW5d/VMtuLcaKQxlV+0 xviXbXRyNdU+FWelBEuzay2dCYNjdtbgY/Qgiwf5gUen5l5NtLHPva1odj+sCxzj+4XHT4LVpxMH JrbTXWzDzOBWPbTb/V8HHzVR+DkNt9EsLHTDiQfafGAPuS4hqN/NVOdk2dSyXbH2NxQTGyqS7T+U T/BGxeg4gDHG7IcbSQ94IaC7yJ5QsHCyMfNtpue26svmv1HnVpEmHDWQfFdHl9R6J0vo1mWanevU IrouAcNzztDtYDgPIpxvSMa17I6WXHf0PFjdTlW1PJlrrHyD8oT14Oeysvc2nJraJDgQx2nk4wSi ZLunWAk5l72OG47S2tu7n6LYACyrc1mK0WVZD7mD6VbwXgj+S8N5+aQBOm/0Tp1dB1uO+m5rKtuT Ww/o7ABqdJJ1EfNc1j2i2pm+yyy0vk1gQwA/u+ZVrqXVzm1PpxP1am4AO3sduNQkl5cAQAqGHZo0 l0s3A+36XClxQMQbFWx5JAhzcj+kWwI97vyofKJkn9ZtifpnnnlRayQC4hrfEqx0DCtZJeY1OiTt jRB1f3I4H96ndYxpLahE/Seefl4IBAJ8ERqosyPaO8qI8DwpO0a1R0PkfFJDKoe6QdEV3B+CHU07 vlyiP+ifggd0jZrRIQ3cosaKD4UjH1LBbX1X+tGX9Xs31awbca2BfjkkAj95vg4LE+SRBHKBAIor hIjUPvPTOrYHWMNuZg2epW76Q/Oae7XDsVU691vD6FhOy8kyT7aah9Kx/gP4leR9C6/n9DzRlYb9 DAtqP0Ht8HBP1/r2Z13qDsvJMN+jTSPosZ4D+Kh9nX+qze6Kvq1+pdRyepZtubku3W3O3HkgDs0T 2C2Pqnj7HXdRdoKx6VX9Z30j8gudGsACSdAu5xscYeBTi6A1sBf5vPuclzEuGHCP0tFuIcUrPRp9 dzfTxXCffYNo+a5fHaXX1t8XBXet5JvyywGW16fNUW6EEcjgp2GHDCu6Ms7l5PoDB7Gt8AAmcFx+ P1rqNERZuA7O1W3hdade1vr1kbo9zeNfioJYpDVnhliRWzoke0yuH6q7fm29teV2vrVvY7a7WOOC uSy+mZdmQ520w86aeKfgIBN6IzAmIAc0DSPmk3aOTC1qfq7e7Wx4b5DlUeoYjcTINBJLmiSp4zjI 0DbXMSBZCAvA4MKQc6JA+ZUJaO2qW8p1LVHxcZPmkNAmDRyfkkUlKmUgknCKlFJMnCSl0kw5TpKX 5BCRKXDSfHRRGqSmR7eQkqdAMl3ihnUx4/kVmke0JkjQZMUbl5MwERjSmaEUQBJURbkR3T4lLrbm Vjl5AHzXeUlldba2mGgbQAIGi5XoVBFn2qwQ0SKweT/KW+3Jr3gtMk/NVcxJkqUgdtm60MLJmT/r 4pwz2EgQXc+OiqsyGzzIPM8KbL2iYPzP96ipYnLpMjntqEhaddvbTXyVd1gc6ZEj6UaCPBIw4Swy BpHZGlNhtgI8SeSFDKxcfKqNVzd1budJI8x5qDa3TBJa3wB1R202H3T8WhDbUFTg5HTrsWsisG2k cPaJcB/KCyrcdt3uqe/eO4On3LsvzwJMj74Va/pmHlE2Pb6doJixmh/tDgqaGWt0GNvGWHLq1sbu A0L26g/FUXWsLzIg+K6DqHp9Oym0ZDwHWDcx4+iRMKhn9PqtZ61QAMzLeFYBBFnY9V2CUo5Kjrel FzvadTr8EpaOAhuqvqnuPJM20HR6NdtW77lGpDhPik3KYOiHE8KQkJpC8ErvgEeZCSgA4mTyOEka 0pFm+KtHv8e0SA2IHBH8IRzYBq3XyH8Qs3pnV8DMhtR22ESWP0OnwWkWs038ToFVlEg6inOBB2ZM d2dyRP8AvKYW7WlwjXRrR4p2CreOxHInT5BPEGdmpPbX701K+7SHaHuRwnYGwR9Lsf8AeltBEOAJ 7gJS0O0AHZBSRjZA0k+aesbHmACh+oZ7+A01KkN4OsARoP70lJGgidRJk+fkk12mmukH4qEgAydZ 7J9wOrDoNCklk0vBhzpb4KP58DTwnhLQiTMD70gY3Ae4ngxED5pKXkxPPZPv3MmIPnoE0OnUyDqR /uTAkiTo3w7DtqkrZQdqDw3mR4KbWkv3NGh11S3GABrHcjhIvmz4fJBQZCd5nUE8pwGBziQdO/PC iC0nXV3J1KQcXGGNLRHfVBS5eSJa0RxuTkNmQYPAlReWjxBd4c/BMXh0wOOJCKksD6Tjzoog9gdB 28UEvdpt1HJHb4BOHmNpeS7yCSWyCGnsCOSluI18dT4oXqGBtGp7/wB5UX2AGCCAew8UFJPUh8A6 zopS7drx8UAObt01HHnr4J3PMkkf1SkplMu0A1HzScYAnUgH3O4CgCS0zqeSUxs1BA+9JTIAwNxA J4jRQ9NsazpoR4z4KZ2wXcdpdwmNgAhrfhPbx1RUjeytgnx0Df8AcgYmKKHkVjcbXF7tJO7j7kSy wBpc87pkADn4/FFwbWvu2CdobqR3R6IR5eOS0NrINlzhW0ESGnkmfKJRxYTlNo6jY+HgNryQYa13 Dd4EaFE6hXUzKxHV2GPUc303c6sOoIEdkDJyJ3VF29sw1mjhHnolSrcfq19vR8wljQK7LBRe0NkS fzml0xu7+KqfWanJz8b9QptfhY5P2qzbtbvaJLQNZ2DlWPrAzq+X0cMYGOxcFzrMklzRZA/mjqZg I31Lub1L6uZOFfdXba1z3Nr2l9rW2Da4kackzKsY4gRE9yCxzNkxcfF+rV9uHXm5p2Y9wjHY2SA0 Dk8ao1nSNjC6qwPa1pL6rdWhoE6HXboq131t6pRhjpT6q2txSK4cBuD6xsJ18YVjpz+udSbsvO7B c3301FlU694aXO+5GYmDZIEURMSKGpc94N9oa15xbrRsLCSwV1gewO7mR96c4ow3tJvqsdOpqJLm x4tPC1crD6WN1Bx3fbTO17XOa9vgS33Ocfksy1hqf6djK67WObvcJLuO7SSjCd7bImKGrj5Dw7Lu e+T7ifjr3QS4uMnnsj3s3ZFrgZ97p+9AIjnlTjZi2Xf9NRiSU7vpFMR4IoXf9FqiBKk86NlRhJTO n6R+CI/6JUKSST8FOyNh+CHVI2a3ZQEzA5KmeI8lAhSMbEjXU6KJI7J9FEoqVKdR1ieyafFJLodF pbf1PHrcJAdvI8m+5dXnvczFffB0BOq576q17897/wDR1mPi4gLc+sNnp9Nf/Khv3qpn1zRj4M+P SBLyJcXuLjy4yUgmCkFZYCudAujwcZv2akvJJ2NI7ABc2T7SuxxOn5BxKtsRsGh+Sh5g0Br1ZMO5 YSGtO0agcjxa7snfvAho8T48GVqUfV7NynTXU+CSC46Nn5wrdvQsfpzPVzcmqgayN252ojQCVV4h 5thwSLZJ5guH3a6LlutW03ZznUmYEOd2J8l1fUevYFNNjOntNrtpAtOjRpEjuVwxmZ5lWOWidZEV 0Ysx0oMYKkGFODCYvcVZYFHwTd0tSnKKlk4TJ0lLJdkkuySld1KNQod05PgkpcmTHYKTa7HNL2sc WDQuAMT8U1Vb7rG1ViXvIa0eZXddOpowsKvGZ+aN1jjwTOpPwKjy5OADS7XwhxHs8OGnmEWr1dGt aXE6ALY6x1ZuXY7GxgBUD7nACXHwEdlPFpZiV+s+DY4aeDR4DzTTP06iiei4Cj6S5raMrl49Mfyt ESo1VEPI9Vw193H3I+ReX6O105CAKw4Hv5Jt3vouJPe2y7q9x0I+AHgm/bD266+Z/uVY0Ez+Cica fNLhh2Rcm63rbzoHEH4q1X1e4xMOB5CyPsYmSYU663MOukd0jCHRQlLq9BT1HeYsiOwV6vNB7kjy OnkuZDi2Id8UVma9nCilivZkE+71deWT9E/Iq0Lz3jae3+9cjT1ggndIV/H6rTy+wz3UUsRHRIkH ohaHaE8DSSoiwtcYEzqPOVlM6pVugagiSedVYbnz7hJJ7QmGJC7dx/rxivfRj5UiK5Y5vf3aj8i5 KrKvqEMeQ08t7L0DMysa3GezKoFrYLtpGhPb4Lz+5v6RxADQSfb4eSuctK4cJHysGWxISBT15u4w /Q+J4RHBjhwDPcKhtHdOyx7NWGFIcY3GjPj56QFZBxDv1bJqePokx4Jg9wMFRZmun3D7kXcy0lze /A4IQojcNgZMZF4pWf3UwjbPlKShsI9s89klHXi2+M8NV0el6V03CrznX1zuLfad3tAPaPFburmn aQY0nt8iVldJwcii/wBbIeC4iGsH0QFrQ3cXGC4DuNFXyGyNbpy4ihtS7GEESAAO4H8VIECQHSO8 p98kNaIbGs6fcokS8CQB4ApiVBrmndr7tYTtLZnVx8tdUpgbo3AcbSlJJEEsaNdNJ+aCmekSNPjy kHbgJOh4KVTASS2CPPwT+73EiAZSUyJc2RHIkHxTQSOCGnWPH4Ju7SSd3x0KmSGt1APh3+KSWTTu iRx28Pkpbmlo3ewjw7/eFX3O3F4aA3yRQA/3OMRpAkpIZDZuJaSTE66D8VF2okGZ1IGqY+p7mj6R MB0Tp4pq2j3ATIbEykpcEEcyBqWjsl7Q0u1EcT4J7PoGARuHPfy+9RAe5gHESB/tQSpriRIHOp+C IXv0PA7/ABQy122A77uE5JjXQ+PmkpT43CSZSLwByR2keXeVAEagg6JAkSSJH3pKZ7gWgNI2xp5p FxAAjQ/efwUGw1p2gD/XunlxGpOg1I8UlM3EgamB27JNc2Poye/MJTPOrdIP+9QJBJa3v+VJS5cA 4DjvKW4uJPyJH9ygCI2gyex/inrBDoIkfgEks2vaZEagd+EtOXau7ShlsOIOs/geyTTtEEnTx0+8 pKXO6yXB0DuANPxTF7ogAyPHX/UJ92vtiP3p1/3pM9zoeYb2I7jy+CSEHpneS4THIE90TGeabt4g NIgDxHiVM7joPgAe6EaXagv51Lh28f8AYipNnZTLWMO+TTa1x26w0+1xA7cqVhpoLRtDXPloc+I3 efgqm91LLK2sa71hscSJIHHtPz1WdTutBF5L7Kia3k8kjv8A2k7ohenp1+Y3O6Zba+g5YDnPgvO+ t24BzZGhCvfVj6t5XScyzL3uu9Ss1BtLRWCD4k/elbkPoy2NMOPTmgV2FxDjZH6T4j3bVWwvrLdn 5f2TBDy7a4jHENkjWQSU8SnwkDbqjhBNk6tyz6o9EH1ib9vY41dQqN1Qss4vYf0rHbeZBDlV6liY mDk2G3I9GpvsoZTua0NHEubq4+OoUfrDZ1S64uwcY3HBvD/a4mxrdsh3pxO1wPITfVS/IyOo3ftd jHYRi5r7BuY10SwtmY3QkblESJ0HRQoGgE+LkZFn6cNe+sNje6ttQeP5Ln7rD965/qppr6k6llJZ YSHA2T75Hg4Benv670ZoA+2VDbBET2+AXD/XxnTeo5Q6ljZzXW1V+m+lrHndtJj3xA57pYqE77oy AmLzhxKD9q9ez0clhL62n6DhEloPis99TnDcGkhvLgNB8VfqvxziPqs0sDTBdq1x7Edw5Wvq8Jsu DgCC0S06g6lTTyGEJTq66McYCREXCe0gk9lDzXQ9V6RVVS/LodDW6vr7f2VhGtrhurMyn4c0ckeK K2cDE0WDuG/BR1Ck8EBoPgozCkCxJURJ0UrfoO+CjVElPcf0bvgh1T0a86KDjqpdlE8qViYEwozq k46phBMJJUSTzwmKkWmJ5TbD30SS9F9UK9ciyP3W/lKufWiwfZmVk7dzh+Cj9U69uE9379h/AAJd efWbmNefogkKnI3zBPZsD+ap5xldjvotJVirAyLOBCtNuqbZ+hbJOkcmVbZTmHW6Mdp4D/pfJg1U 0shHYMYgHKycK2ghjyCXQBHmvTn9R6T02lrXBjCxgHv1MgeC4N4qrdNbTZb/AKSzWP6reyg5llji +1xc4/nO1UOT9YBZ2ZIjht6bO+u2TaDXhS1p4cdPwWFe/NzHepm3OIP75/I1DYW1iW6u/eP8FEyT LjJPJKYIgbLrKSsY7WlrGbnEFpc/z8Auce3a4tPIMLoawXGGguPkszrNHpXtcRtc8S4D4qbBL1Ed 2PILFuekSE0pKywqSKSSSlJ0wTpKWT9k3dP+akpYcymT9vinrrfZY2tglzjAA8Skp2fqziMfc7Kt ghmlTT3ce/yC3OqOt+xWtoBLyCPbpzz+CxP2L1fGP6B7XgcAEj8qg7qHVMbTIreBETrH8Qq048c+ ISEq6M0SIxogi+qDAuxa3F10B7dGg9j4qxdkix0MPtiBqgW5mDl/ztex/dwEEoBwq3a0Wh3cA/7F JwgmzYK2+g1bga6RJ54RQxw5hZYZmUn2SY/dMon7Qubpaz+BSMCdiCkSHUF0mxGnHmnawHtHiqbO p0OBDgWz81aZmUOEteJPadfxTDGQ6LhIM/TjnuhlhnTX4qYtB5KkBppz3TdU6ICCNPvUHbj8VbFW sg8lR9MAkAT3lG0U04eCj1VkmT85RBUXO4nurNNIHPHc90pT0UIpKBtHEeZ4VxmU5oA5HGiGxh2w EnbGM3HgflUB1ZNkHWOrlmOa2mXO0HiFz1w4J5PKtu3dQ6i2to/RtMn4BVs7S97Bw0kQrWOIj6R2 ssOQ3q1SmSKQBUrEspNJbqCnDFJ4rEBs/NLdIJGo0UbbCZ3GQkowUkKHZd7k/wB4/a+lM3fvc8cS iAkkaQY1MIbCeGfGP9yJXuAkuBB8TPyWa2kkmG+5M5wN+2BJ+iQNdOdeAmOjS0mQD2TjWGuJJOsB BTJ0SNYjXVI6ABo9o5J5Ki32uDWyJ7DVEDnDmdJACSGAmJ28d/gnc6fcTAPIlM572mC4RynIbJBG vJI5QSrcS3k/AaDySa9xcIgM7+J+Ci4gCZ2iY8dB2SDpG4HbPgdElJiNztzYIiI7Snrs2sO8wJ08 1BokeIjQNTFz4HY99xSUl3vIkN+BGmpUpLZgRPY+KEyxp2w5zoOsARr4xwiEy8AS7tPIBSUp+r/c ds8/FJ4aWxMQdEz37HBvciS4dzPEqBIa8CDr93wSSzBaePok6wkRBgt9vbx0Th2mjoP4qBJI9p0O gPf5oKXA7HknUDw+aiYJgjUaE/7FIB07ToPPunB12/cT/BJTAT4aHUR/FONNZkxBn4poJ4HE6mYJ UxqYd20geaSlbgTGunimmeACPLVO4tI4lsx4D/cnLwAYPwlJTEkjnsdfFItdHj38k4k+0CR3j8ik CBpJ+fl3SUwOo4Px/hqnA3RIHPfj/cFL3GBBPg0/kTasIB5dpp4D+CSlbWjcdfgE2zk6EDXXxH9y Fn5IxMR+SDLmAlrPF3bzXH5H1y6w8wwVVNBna1s/KXSpMeKc9qWynGO72rwQRYQNscuEn5KD3N2B ogjz7nv9ypdD6tV1ag2g7Lm/ztQ7H974HstEtbENHh7fyD+9MlExNFNgiwgezQ+3c09vI8D5rNoB +05NR+kS14PgYgn8Fr2HWQ7bMku01jmB+CoZFgo6jU9rYGS0VvB4lsvadUY9QpM63DynOdfuoyDH qgiWEnuIk691VvxacCxnVMeyttlDg5rmH3F3BAaYmeIUeqdTw8QhthbbdwKgQTJ7+S57L6rbbeH1 sAdVoylkuG4+HinwxyPgFspD6vomN1PCywctlW2svNTi8Q+twP6Sslp0gmWrOzqauk33OxgDjWML 3Md7yxxO71a+7qyfpAcFc70bH+s1mNZjYVd1FDyLG2PaK4sJ9x3bXOI+a2qvql1PLYP2r1EuZMmt smD4gu4+SEoxhI3IV2SJWNA5WHZZZY+y2/Fsx2yA6ouadx+iDvGgKy8rKyraratoe0NO81MO0AHn cey7KjoXQelFvtNrHzv3nuB7SYj8qr9ez6mdIyMbDoDanMIOztJ8AnRyDi9MTL8EEGtTTwW2fmtD pgYHvc6WtEQ5vI0dBWc6zYP5R4HgrvR7ml9tbiA9wGwHuRPCnzA8B0Y4EcQdDqWY9vTX1XQ91oGx 7fv1+5cnUbGhzmGAOQe66LrNJqxGSIc954+C50sePdxBgjw+KHKRAxmupRmJMhfRstsrtaJifD+5 RcxzfMeKrvP5zNPNW6ySwT/ropyKWDVanunuP6NycATI08U1kGt0zxpHihequjVPCZwPwnhSLNNd VYbjssaHOsDnREeA8FISsEWm2tpiZg8uGsI1WK31AH/R8R3HiiWsZS2awQ7uQeQhMtMAkz2E+CF2 ml3BrXEeB0lQeA94J0nkpWGXSmZroUlPX/V+oV9Nqj87c6fiUDLwaczO9XJu9PHZ7XNYZsJHYBaO C0MxKgBADGiB20VC0S9zhyTqqIkeOR8S2SPSAxH2eglmFUKW/vnW0/2jP4KBYeXmJ7nkohOzRuh7 nuguJKOpQicG7vaOO5S51KWs+J8FNtRJAdJJ4Y3koqWEuhrBuPknbTudDpsd+4zgfE8KxkU2Y9VZ c0ONrg1rBIaPNx5ctSnFOOQ2G3QYLdu0aj83UpplQvumtWjiYGRZ4VVnjb/F39ywOsZNjsm3Dhja 6nGCBqSB+8dV19GXUMsUMgVlm/jRrxMN/tQuX+suI1uUMusey3R47hw+Hin4Pn9Q1rRbkvh0cOIK SR5SV1rqEpFJIpKUE5TAJFJSlIfRUO6mPoykpiT2Wp0Glv2j7S/QVfQP8pZbRucAOSVpstdRWKmA ca/FMyXw0Oq6G99nfszmj6J3g6HvofBV35DXTuJk8gxqsc5Tj/sU25TpVf2qZuO3RfhYWRJcxpJ7 8HyVK7olZk0PLe8OMhHpfuPgR+IRuG+3XX8UhKUeqjGJ6OLZhZ9XbeB4GUI5FzYFgJA7OE/lXQ7d xl3wjyUH47XkjbuHYQnjN3H2LTj7Fw6hjXGHANJ7gwpOwNwmp09tfFXsrpNO0vaRWRye33KHSKzb kljfoFus+SfxjhMgTp0W8OtENFtGbWfaCY/dKI3NyatLAZ/lBdE3DE6RA/O7FM7HGoc0OB7ESo/f B3iu9sjYuRX1Gp0bwfkrDL63GG2Az2dp+VHt6Pi2n+bgz9JvtQn/AFeaGzTeWfyXCUuLGepCamPF tU0ufrGg7iFbZWYGnwWC7D6tikms7o/0ZIJ+5SZ1rMp0ua8+O8f3gJpxk6xkCoTA3FO8Bpr85Wd1 fKFdWwaPOgQz9ZKTX7Wu3xwQInx0cqLTkdUyWktMdyBpCUMZieKWgCTMEUOrodExnV0uuIE2ePgs XKcXX2H+UV1lbG11hjdBEABctmVGrJsrPYmPyp+GXFKRWZBUQGrGsIgAUQO578JTCnYmY1Ki4yUh 4qPdJS+qScJJKfSA6BtGpPgNUgWQPaTHY+PmoB7Wunl3lyVMlo5IDu45+7hZjcZTOgAaR4cfxU2u tES8bQZPwUZaQPbzyeDH4JEuadxEzrpHy5SUmBkhxPPGpGiTWtJ2uJd4zwm3tLWl4AceWzJ1SYXz 4A6h58J47IKU5reAY/ld1JkHkaAcHWPMqJaXEuJIb+KiA1p157DiUEr2ODPcI85jj4mUnEObIdt7 yR2Sc0O1cPjGvzSJdDWtIAAHuKSmbdADMdtf7lE/SDgA5rZO/n7uU28Ej90cgp5lxHDR4D/ekpJv J0H0uRAiPikXPkNeOTAIUWucSCDB8O6l57jMfID+CSmXqWAwYI8Ph98pjvePb31BjT8U4Z+c1wLi InUj/ckJfy8bW8jv/H7klKDAx26CHGJH+v5E52hwjvPCiXPEjx4PP4lO2BtA1I+YkpKVudqYO3uX aD5d0t7iDA2nie/3JPJkskuPMxoB5/wThhDRtgHnXn4/FJTLbpE+4dp15/KohrtxbyPH+AT7C5wk nQ6n+7+9OAJgOgjVx7Adp8AkpYlx1d255/FJnG2OexI57hSkGdxnz/JPmkGQ7UbueB+AQVa4DneH MaHw+9SDG8l38opi0gAAQ3v2n/Ym2sDuSX8nw/18EqUyLTqWjjseZ8B/FMWlzoJiNT4TH5EVzj+b z59vL4lCe5p90z4xwSO3wCKranUcJuXjFrpDp3B38S1cN1vpN/TyX7ZrLoBE6H90r0EWbZO6eTJH Pn8uyDdi491Jbc1rmEe+R4/na91JjyGB8Fk48QeD6BmDGz8e9ryIdttZwC06RK6/M6vkUubTVWH5 DgSKmy9wB/OcTtAlUMr6u4Ztccdmx4EwNRI4/tJNpzrrjkUXtpziwNvpsALHhvDmHw+CknKEyJfg UREoilm5n1kvufUw0V+mdrzAgH9ye5VW9uffl2Nyb3XGmQCw7QHO+lxHZCvf1rHsdea2+m4knVwG /guB8VXOXmCq+uyp1bHnc94a4uIP8r837k4R7cP0QZDqSqy3Eax9eMxpsedrrCJj+2SdSus+qV3S aKw302/aCZNzgCZPnyFxjnY1dFTKqzaXuMBrgZPYQNQUfEZ1fHcHsrce5a0gmPAjujPGJQMb4T0J KIyo2Rb6nk3urpNlY9Q9mjU/JYeT1V+9zbGPYzhm7QO/zZCxen/Wqwn0cglrh4yCD5zr9622Oxc5 nvgh3IHCpHHLFL1xsHqz8Vj0loW3uuBY1sNOipWYwaNtvvafCR97Zha1vT7aPfju9Sv9x3I+Dv71 RseQ7a9uxx0Ad/DxU0Zg/KtI7uJm9BpuBtxXbLOS13BWDZXZTYWPBY9vZdsWMjXQnsqOd0qjMZJ9 lg+jYPyFTQzVpJiljG4eaORa6ttT3l1bTuDSeD3hHyMKm6s5GK+Q0S9p+k34+IQszByMN+y5uh+i 8cFBZY9s7XEbhBjuPBS8N0YmvyWX0LXtrLNSIB7jgqzX9FFxsd+SH1s2ucBpU4wXf1fMIe0tJaRB BIg8p5PRFVqqSh3fR007KZQskn0jHiEhuooC8iPxRaoInwQjDgCO/PxUqTrHyKcstLZYXS1oB29/ 4KuSQfo7QjH2uIUXHSEglGSp0tL7WN8SAoEwrHTW+pm0t/lD8qUtj5KG4D2rQK6SBw0R/BZ/l4q9 c6Md0d1VbSNm+x4Y37yfgFnx6ktmXRA9wLjB1lI0w3dYdgPjz9yVttGPqSKWch9mrj/VbysvM642 duK0l3+ms5/st4CkjCUth9VpkBu3b8mjGE2O2eDRq8/Lssq/q17jFH6JgMwNXGP3nKjZbZa8vscX uPJOqZqswwxjqdSxyyE7aPa22DOxMbIP0YDyO0OlrvuRjmMqaarjvvaW+1vJIGjvKVl/VuwZuL+z g8svY4w8jc1tJEu08QePitb9njGL2t/SOaB6rpkuA1D5dqqswIyMT9GWOoBDk+s93UaXEbRkOLXm SdsENn4hH6zjNsyLqnuIbDY28cD+Kq30PNxFZLi6wbCO0mTCs9Tya8b9LcDZY6WARA3N/gE/rGkd 7eStbtsc390x9yjKle/1Lnv43EnRDVsbNcstEyQKXdFTIJinTFJSwUnH2gKMKTWOfYGDUmAElJ8S kmbI0Gg/iiuWgMVtNTa+7Rr5z3Qn40/kJUPGCSyiNBpt5VmmvcpV4TnHQK5VhFp1BA7lNlMUmMSv VSQJ8uEaGgwDryApiobuZP4AhT2aE6Hw+HxUBlbJSNtbu/0Z7IrnU1173aRq494SkNZLztaPPXRY ufnHJs9DHn05hzh+cU6MDI+A3UZCIY5eVb1C8V1A+nMADSfNaeBhfZQC8hzjqYHChgYDcdgsc0mw /gFeiYGk+PgjOenDHZbEfpHdJvfHjE8eaYfRkHnxTAS3a8/IKQEA6yPD8iiXsBtiCBA5aO6nIcR5 6wfypBsDQc8f3KJ1JceI0PCSmRAcHQPKJhNtaQWvAcOdRPzKiXMYBvO09ggXZTWu9p1nVyMYyOyD IdU3o0HmmsHg+0SmdYyowIaDwBp+CrOy3fRdoddRyq/rh5hxh41BPBUoxnqs4x0blue1rSWNJHif FZPVH0XFt7HS5whwRxaAwh40HPwWTc8OcQ36IOgU2OABsLJSvdhukpiUyXJUrGyBMJk50ACZBTKE khwkkp9EJlzZ7HQDiPmpHUggA66nhCJl3MeHY/ipNZtE7iJ51hZtNxJA3cRtnjhE3S4Dbw3iOEGt 4J2zAbydRz591ZodUy5gvl1PDg0+4/PshRUiDwXyZGsGTOvn/cjtILW8lo5jUSEF7WQ70zrPB8D2 0Ug5zQDEdh/qElLNO57pcTGoEQB804cXHWNg78H58pbHPHh8PyqYaAASJMagefmglifc6CSY0MA/ inDgQRI9ug+PyUCQwAES7uOwCIdhaXGdEkMA0tHuO0RqRoT8EZ/pioEN7eH5eEGSWy8bddJ5+4ow DXt93A4gxJ+fKCWIZI2uOhgydT/r4IgcAPaDJ7mP9mqjthgcxoIaYjv8k7G8u3Ek8Hw8hHZFSSsw AOSeBz/qUOSXBrRtIPbgj46JeqTBY0lpEOHbTx8lJ4cG+wAudy46D8NYQpTGQS4PG5roBDuCPn2R AAxkuIga7ncfEpmMY1jtzpc6Nxmf9qm5zRG0fMzp4E90lK/SCXgS0/RH8fin2OeC1wBI5ie3aSme 9m4EsAbOscmfDzTsD3OO4gRw1pnjga/ikhiQBul58dONPDyTs2lrWtdDDrpp83HiFJ7ZI3hrnkSB 5j49goNbYCTI01buJPxdrI+CSmQgAieAZHcT3+JSG0diB9ETzp+aAms9jdzSQBBIMnTuTE6qJcwk tYZcPwB1ifFKlM42kud7i88Hy7fBMSR+aC4mROmo7mewURYA4N2wHaECInw0Se12795x076/dwEV MmkuJcNHaf7/AIlO72tJIaCTAHHynxUHiAA0w8nQHST+8pEQGuc4GB93iexSUjcbHObAHu7DTXw7 cKTQ9oOwbh58z4qPpjcS7x+jPDO3nKI4hrnEyRpujvHASUs9j3e0iBALHdwe5dx9yqX4ddmnpNeD Pt7N+Hg4q4bCHEj6IgwOHHwUYrYwOg8nQHQuPf5JKadPTWNh7WS6eHkuI8AJ0R/sjSTsJ9QnV3Yk 8/cjML2kCo7mnhx8e/KIbGObJ7nbuB7d5SU4WZ9WcbIJdGxzeHs9pH8rgqgei59Ab6ec62uOR7Xg DsHGV0VtlbQ4vhocB30gdgVnZOaN4bQxrTPuee0fwT4znt0Rwjdx7OjvIe60PFkyLnWB1k9gUJmd l9HvYy4hzHztLToY8vFaFmUCyX2SdTLRAOqy8l7bq9pbt2S4GJ5181NCROkhcey0itRoXqem9fxs oBrbA15/NcefgtC1tN7S21ojtpIXmdr7abgW+zzb3K2OmfWbKxiGXu3smDu1EeRTMnKA+rGd+iY5 eknorOmXh+4OG0GWMI7fFV3u9MkXNNesbj9H/O7fNaWD1TDy2h1Fm155rd3/ANfJXX0Y9jNu0Mdx B+ifLVQcU4mpBfQOoefsoovqNVgDmPHfX5rmupdGuxCX1zbT4jkf1gusz+jW44dZgk0uOordrS75 fm/JZ9eU5r/QzWim88NnRw/knup8U+sTfh1WTje+jyIceR96kbC5xc4kuOpJ1JW/1LoleQDdiNDL e7OA74ea56yt9byx4LXt0LTyrMZRltuwEGO7KULKP6L5qQcoZJmv5pwGoRejXrMgt+YTzDgfFQad rgURwkwE8rQkmTJ7pnDRLlEDZYmqa5Gq0Ogj/KTPIE/cFSI11Wl9X6ycqxzfzazr8SAhkNQkfBdD 5g9Dm3VY9HqPdtbIJJE/gsXM+sbQSMJhn/T2fS/sAfRVr6w2H7AB+8WgH8SuXUWDFEx4jqyZZkGg zststeX2OL3EyXOMlQS5UwArDDdrBsogAAUCfBLckpsYmVbi3erU4scBz5HxXQ42Vb6IsyQ/dPpv EgBwd+dW7x1GhXMNiJ7o7H5DqXUsLi3cHR8olRzgJbr4SIer6c7HfnNcXjawENadNCFnfW+yr1aW 1GWbXOHESTxooYHS7toysl/pN/McSdT/ACByfkh9Wo21Oqpq2hwlz7PdaY189o8lDGIGQHitkJJg dHnikOUoTz4K211dkgmUhoElLpikmKSlwrWFYym8XWSAD7Tt3CfPUKsxrnODWiXEwB5ldvg9Kx6s Sul7Q7Y0Ps3cSfpaKLLkEAL1tfCBkdOjjNy67tAA7+oddfFrocrGPVXaY3N3D80mHafyTqruZ9WO nWtdZRurefoBh0PyWNkdK6xicfp6xwB7+PJ2qhBhIemXCfFl9Q3F+TstxQAHAT3HYKRkiAJA1+RW BX1XJoAZb6lZGoB1b/mvV7G67W722NBd2cDA/wCmU2WKfmkTj5Nx4mA7k6QeEweGggAwBOnl2Spz ce6djvcNCTtB/wCk4LM6t1EEnHp0H5xkE/LaSEI45E0RSTIAboup5/qn7PR9EaOcO/krHTenOqaL rNHO4HBCH0rphJ9a1vtAkA9wtVwI0JgjT7+E+cgBwR+q2IvU/RdpMDST/rokS3dDgYHEflSxX49r 3seZLI3EHupvdjB+xhPt1cOdFHwkr7AYzDi46zENnSf9qlvmO0eB+8IVz20s3ucDOg/gqZ6nW9ux o22N+mCO/knjFI+C05APF0w7SdHNPHh8VXuy2tMN1d3cePkshvUMlrjW58tPEp3Wb+SfgnxwAGyb WHLewbFtw0j5/JD9Sp7dpIB7T3VXJvDBHJVM3b/pKYQ0WGToOtdWNrzoD7XfwKBY8ET8x5FVhc4C D7m+BTG0fm/cUeFFpbb3FvOp0PyVaURwJTbUUMRqpAJQE7R9ySlnalN2SPJSRUyB/Iko+aSCnv3/ AEn/ANUItHLvgvM0lnHZth9KZ/Pn5Jfn1f115qkkVz6jX9MKb/pf2SvK0k0ofWj9H+wEx+g1eTJJ oS+p3/QZ/WH5USr6R/rfwC8oSRU+su7fApdqv6hXkySSH17H+g75pM+mPi38i8hSQ6pfZLe/9lCs /nK/6w/IvIEkkdH2T/BH/jCgO/wP9cryJJFPR9hz/wCjVf1v4FFx/wCbr/quXjKSRQ+x1/Sf8P7l F39Jf/Ub+VePJJBIfXz/AIP/AI5RP87/AG3fwXkSSSC+wdmf2/yJP/mv+tlePpJJ6Prrfon/AIof lTv+mf6ta8hSRKA+wn6Dv64RK/oH+sP4rxpJBRfYqvpt/tfkUDxX8HryBJLqp9gH9Gb8P4pV/Scv H0kkh9Ku/nW/ByrM+if6v8V58knxQ9jZ/Nu+H8VSu/nD8W/kXNpKaKwuvn/TH9ZAH0fms9JTx2DE dy9L0b6LP6w/KvQKf5j5BeNJKnznzM+LZ9uf/RPl/BcR9b/5qj+v/cuISUfK/wA4PquybF7zp38w Pisv6y/0mv8Aqrl0lbh87BPZvKN/8381TSU/UMTJFHI+CAknFDaCM36AWekgno2X8la/1b+nkf1B +Vc+km5v5uS7H84en+s39Gq+I/Iuc7oaSby/yfUqy/Mman7ICSlWJu6buhJJKbDeFodF/ph/qFY6 SZP5T5Jju+gZf/K1X/FD8izcr/tT/Ud+Rcikq0PmbB2DMphyopK6GszHKdDSSUk7JioJJIbWD/Ta f67fyr0M/Qo/qOXmSSqc1vFnwdX02v8AnrP6o/giu+gf6wXlqSrdWbu9h9YP5w/Bcse6Akr+L5Q1 p/MlPIRcb+db8QqqSedlPc4v8w34Jn/S+RXDpKiPmbA2etxv52/4/wB6av8AnLVyaSnh1YpvTdQ+ gz4rOP8ATHfErKSU0dmMum/+eCsN7LESSKBu3cz+cKroSSd2R3TqLuUJJFTb7j4JOVRJBTZKccFV UkkNjwSKrpIpbHZJV0kFP//ZCg0KZW5kc3RyZWFtDWVuZG9iag0zMiAwIG9iag08PC9TdWJ0eXBl L0ltYWdlL0xlbmd0aCA0NDIxNS9GaWx0ZXIvRENURGVjb2RlL0JpdHNQZXJDb21wb25lbnQgOC9D b2xvclNwYWNlIDEwOSAwIFIvV2lkdGggNzQ1L0hlaWdodCA0NDIvVHlwZS9YT2JqZWN0Pj5zdHJl YW0NCv/Y/+4ADkFkb2JlAGSAAAAAAf/bAIQADAgICAkIDAkJDBELCgsRFQ8MDA8VGBMTFRMTGBcS FBQUFBIXFxscHhwbFyQkJyckJDUzMzM1Ozs7Ozs7Ozs7OwENCwsNDg0QDg4QFA4PDhQUEBEREBQd FBQVFBQdJRoXFxcXGiUgIx4eHiMgKCglJSgoMjIwMjI7Ozs7Ozs7Ozs7/8AAEQgBugLpAwEiAAIR AQMRAf/EAT8AAAEFAQEBAQEBAAAAAAAAAAMAAQIEBQYHCAkKCwEAAQUBAQEBAQEAAAAAAAAAAQAC AwQFBgcICQoLEAABBAEDAgQCBQcGCAUDDDMBAAIRAwQhEjEFQVFhEyJxgTIGFJGhsUIjJBVSwWIz NHKC0UMHJZJT8OHxY3M1FqKygyZEk1RkRcKjdDYX0lXiZfKzhMPTdePzRieUpIW0lcTU5PSltcXV 5fVWZnaGlqa2xtbm9jdHV2d3h5ent8fX5/cRAAICAQIEBAMEBQYHBwYFNQEAAhEDITESBEFRYXEi EwUygZEUobFCI8FS0fAzJGLhcoKSQ1MVY3M08SUGFqKygwcmNcLSRJNUoxdkRVU2dGXi8rOEw9N1 4/NGlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vYnN0dXZ3eHl6e3x//aAAwDAQACEQMRAD8A8/AT wnhPChtmYwnhPCeELTS0JAKQCUJKpjCUKUJQiohyrhFzx5qCNmCMg+eqEpBsGEjVZJOmRQpPtPKZ SbwkpbaU0FETIWmmEFINJU040lK1AMfTIGqQYpbiU4KVlVBgazG4ahRRg6NfFQe0fSH3JAqIYJ0y dFCk6ZOkpQUkwCdBKiY1TbypHUKBEJBOq/qOS3uUYTjkJIsul0v3GHCdT+RaRqq4LW/cs3pX09fE /kWu0SHfBUs5qZb+EXAeSA0Y5GrGrOyq2sJDBAlawaO4BWZnD3u7ahLDI8VWVuYelppapQnVpphR 4CSXZKR4opXCSQI8U24eKCl0ktw8UpHZJS/dO3lRnyP3JB3kfuKSmU+CflRJM6A/cU4Lv3XfcUEr hOmAd+6fuT+79wpKUAnS9/7h/BL3fuH8P70lKSCcB/7h/D+9Ih/7v4j+9JVK4SOsJos/d/Ef3p4f +7+I/vSUtATJ4f8Au/iE0P8A3R94SVSkwT+/wH3hRh8abfvRQvMJFyba/wDk/em2P8W/f/sSUvuS 3JtjvFv3n+5Psd4t+8/3JI1VKUpbH+Lfx/uTbX+LfvP9yStWQKR4UYf4t+8/3J4fqCW/In+5JWqk k0P8W/eUos8W/iipdMlD/wB5v4pof4t/H+5JS/dJMQZ5bPzSh37zfxQSukmh37zfxSh37zfxRQpJ KHfvN/FKHfvN/FJSuySYB377fxTw795v3FJVFSXZNDv3m/imh37w+4pIZBLuo7Xfvj7ilDh+cPxS VSktE0O/eH3FKD++PuRCqX0S0TbT++PuTbT+/wDgkpJS3da3y1Vt2gJPYKviN9xMzA+CNku20uPj oo5ayDNDSJLmuO4k+JUVJMpWFiQn2pwJKns80UOlGicQnhKFA2KWTwnhKErStCcBPATgJKYwmUoS SCnN6gItafEKtJGqvdSbox3gSFSU0flDBP5iyqhzodqmsaGuICetp3SdApWgaEQl1R0RKbOCoqTO UihdMkSAlIhJKkzZLoCdWcWtpBeRwgTQtdCPEaY/ZSGbtZQDotVtlZG10j8irX4g1cwwfBMjPuy5 MVAcLSlNuTljgYIUm0Pc6IAMTrxopdGCj2YJJJdkkK1ThIJ0lKThMpBBK44TEBSbwk6mwNNn5oj8 U1cATsNkfwUmN9wUZUqpLm/FOKBu6XTgBYI8f4LVbw74fxWVgCLR8Vp+oxjSXuDRESfiqObWTfxa QHkuFl549zvitAZNH77fvWX1C5pcdhB80cMTx7LcxHBu14HgE0DwH3Ks57ydSmDnAzMK5wtK23p4 BL5AfJCqs3aHnxRUCKSCuE8lMEkFMtzvFLcfFMkklck+KUlMUkkLyfFKSl3SSUvKSQhJBSkpSTG1 9JFlZh7TLSQD+VFKdmNkP+jU908ENJRm9N6i76OLaf7Dv7lBv1o680yMyz4e0j7oUnfWvr7hBy3j 4Bo/IEwxy9BD7V4OLrxLZGBm47Q++h9TTwXtIVburLOoZuYxxyrn2yYO4891X0kx4pRJ1Eqsdkzi ABIbHutqlCSScxLFLskUyKl0ydMkpSUpFJJSkkkklLJFOEyKFJJJJKVCZP2SSUxPKSSSSlJBJOkp SSSSSFkk6SSlktUkklKEptU6YwiFKMpk5TJKUlqkkkps4ohhPiVHNd7Gt8TKLS3bU0eUqtmOmwN/ dCjGs2Y6QayYqSYqVhVWJKNChUNJREOqejee9tY3OMBV3Z7A7RpI8UO6wZTSa5Gzse890D0XA+8F oPdNjEdd18pHps6VWRVb9A6+B5RVl1VDeHVv9wOgK02PD2+fceBTZADZdEk7rhOExIAJOgGpVI9U AdDa5b4zqgImWyTIDdvwmQ8fJryGy0QRyCinxQojRNgtPqLf0APg4LOK1MhzbsZwrDnTxDTE/FZ/ 2bIj+bcPkpoXwsOQi2DnSIUZTkFNCcstSmzlRhO36SSgs4kO1+SYuJUnQ4xIRK6iB6mhASvRcASw aIaD4q3hOZOx2gPMd0Fzt5a1jfgB3JWlR0hzMd19rosaNKx2+KjnIVqavZlxxPH6dQN0b8RzSSxx 2cwUzm2ENaBBIkEpNthsHgfNT+0bwNxALeEz1ebPUDsatgMe+JsYC0cgc/ih3EMqscYDnQ1re4Vv c+yGN5dorFvRcO1oPqPZbGrtC2fgh7gBHEgw9J4dfN5xJWs7p2RhO/SAOrd9GxuoP9yHTi2X6VAu dMR8pU/EKu9GrwS4uGtUSkASnsYa3FpO7aYnsotIhJFUaKQVGFEgtMFWMTHvySW1/RHJKt5PRMmq n1GObYIkt7hRnJGMqlIAllGCco8UYkgOc3ha3T8dmUyMuxtGMNN55J/ktEko/wBWukYefXe7LJG0 7GgGC0+Kxs+h+JmW4znbvScWg+SbcZylAH1RXxEsUY5CLjLSv4t7P6Nj1MdZi3OewagvY5oPwO2F RoaN7B5oTMi+v+bsc0eAJhO3IeLA93ugyU/hlRBPExGcCQRHh7urQ0NubAgEq9tDtCAfiqFNzbRU 9nG7XyV9hmfgVTy2D2LdhRA7LGsRo1v4LAyGWHKfX+duiAuiawkSBp4qh9mDX2ZBb7idAREJ2HJw 2Tr280ZMQnQGlFybMW1gJLeOUEg91tC9j5Y9o/rD/aqtrMeTsgn4KzHIeoa88Md4y0aNehk9lYQH t/SQNEUTHITywbMxykPNMAR4fen18vvTUrp03vjgfeo+ppwkpkkmBceB+RPDv3T+CSl0k3v/AHSk N37p+5JTJKE0mNQR8im3Dz+4pKZId/0Pmpb2odzmlo1lIKKLsknG0mCY8ymkDTlPQW7h6VE+ag0/ lU8UgUcjuoMPtUQHqkzT+SAZJJT5pnOjROY1ymPCC4h3JUd5adCdEqUdGwmlRY7c2VJJCkkxToqU mlJJJCkpSSSVakkkikpYpJJ3aBJVsUkkklKTpJJKUklKSSlJJuySSF0yUppRUukmlKUqUpKEimSU pICSB3KSnSJtaPmkdlDcNwCBos+5261x81fe7a0nwCzjzKjh1LLk6BZRPCnCaJICkY0tbfapbSpt bDU8BM4tV9NNogGDEpQf3imaU5IUnVZajubr+IUmXPH0XEE9woNd25CRYDxol5qBrZlbdeRDnktP mhSVKHDQ8KGqIQbXD3NMtJaR3CI2/IcY3u+8qIYSExa5uvzS0ULbuNc9tD6ZO1xG9p8RqpmFUru2 y8gOkQRMahS+1yNGCfmniQA2Y5wJlYKO0bbHDzUUSx115Nrm9tSPJDGqZuvohZGdUG0B5+k4/cEK PJXa2NsoAcmzNV5s/LYvcMh14dPNrUY9l7oYPi7spDEuOT9nqBe86CFoYrQCKqxyrrTVQHCrV7vp 2dz5KI5jZoeTYnyuOGONy/WXr/BHjdPowWF9hFuSRpH0W/DzUHWuEmdTz5pPsJPKgTKaASblqWIk DSOjUE1WEH6DuEXdWErGTxohgy7UQVY4Yzje0h07sQnKJrcFMyQDaHe5moHitXeLGBze4lZbKdCX HkQrOJaRU0fu6H5KvkgDEkbxZoTN0erZcWWMdVaNzH6ELEvx8jHsNNJc6t2rS3SR5rXeduo45VLq MuqhpMl4IA7yIIQxEg10Ksmo8fBzbMe1rS5wAjzEqFNLrXBjVuU/V5zaovJOW4SKG8MHjY7+Cq4+ OzHyHNOo/FSe9HURPEQj7rP0mQ4RLuWzheliM2tDnk6ucArLsotaCGlwdw3uoNqpsEiR3MOgH5KL r8d7PScDvmBzx5qvKpGyCe7bjcRVgADRN0qw1Zt5DSyu9kkdg4FYfV3OPULS47jI18RGi6bpmEbG WWV17WNGz1GiQDzque6107LxMh1twD67T7bW/RPl5FPwZIHKRYEqqurFzWKYwg1cbskOcl5Jklba DrdNYfswef8ASjb9y0XWilu8iQO3xVekCrp9bTo2sh7ndpJ/FDvya7QG1u3a6qnMcc7rS29EiEAL 1pIc91hgiB5f7FL1m7SAZB7qmBqVAZBqubuG5pEEJ3tg7DZbDMYm5HfRt2Or9I+4B50AHmq1rGNb Ln6dmqF+RS73Nn4Qqxe6wwdGp8MZA7LcuaOtUWwcf9B6oBIcfpdp8FXmNFfwrDXpy06EHg+SDn47 GO9an+acdR+6fBES9RifoxTjcRIfVACnkASVFhlNYYZKfTGoWQ7XUeCl6jXc/chip7gCO6HrMAao 0CushO4gyePNSae3h3VcktJBGqLTMSe/CRFIu0ieVFKUFMwTCfc7xKgO6dBTMPd4lRL3RykkkhBa Nxkoe1WHNUdgTrQjazX4KwzbH0GqAbAUxoECUhl+j/cCZ9QNLrGiA0gHXxSTPs21OZ+9HPkhr0Xx IvVruHgVGfvTE66ppkp4CwlsUAFplxGvZF2D98/d/tQqQWs15KImndVr7P5Y+Y/2pbT+837imSlJ Vr7HeLfx/uTbX/yfvSlJLVSos7AH5hLbbzs/EJJpSUvFn7hS9/djvuTSluPZJSt3i0j5FMXCE+5/ iU5e4jkpIYb2+KQe3xT7nJT4gH5BJStzfFKQlp3a37kvZ+4ElLyEk0M/c/EpbWeB+8oqXSTbWfyh 8021k8u+9BS8ohovABNb4Oo9p/uUKmB1rG7jBcBrHcrsm9Qxg3a2x/tEAQe3yUeXKYVUeK2XDiE7 uXDTxms7YM+EJQ4cgj5LWwrfX66++xxDWFzi74aLZyuoUCh7q7NzwDAI/vCEsxiYjhu9/BdDAJCR 4qovHpJjucZ0111KXv8AAfepmAjUrouKP0hPgPyoPv8A3fuIVnFENJIgkoT2K6A9QZ5LoqI8dFQI VvMdo1vzVVNhsumdVk9Yl6ZExxLpTiaC0bhsAaJKUJKNlpz3AsJaRtIMEHkFNp35XRf4wK8Vn1ku figNZcxlj2gbYeRDtIHMSubkKemuDYtdsSVIeCgOSpgx8UCldTx8cWl4M+1jnNjxaJUFY6c6M2od nEtPzEIdCuGpDUDjwkTpqtHqXRL8RuPc076cpgex/EH85p+BVYYdZEHIrDvD3f8AkU46boAMttad n6vfVsdVw3X7LCQ/b7Ijj4hazPqA0gl4fWJgbjqfkFv/AFB6eMTo7HTvde9zyQZED2hdLfXLWkjQ OHP3K1HDjMQTuR3YMmWcZGIrTwfIfrJ0X9jhjGOcQ/6UnSCP9iwASJheh/4y6GDHoe0AEdhHY/7V 56CBIPdViBGUgOhZRIyiCd6eu6b0vp+Rh13PoDnFrZ2x4CeQrg6E0O/RYzvT7AtB0+QRPqhtt6aJ AO0Aa+RcI/BdpjbTUwiNpaD5QtDF93jhhI4o5JdeJr5MuYZpiMzADanzzqzKcQsrZT6VxEuloaY8 tAVlbw7jQ+Ct9czbM7rGVa76LHmtg8Gs0Czn6e4LMzcMskpRiIAnQR6NyEpcEeImRrcpCddU+0qG 8Og9jp809b9dp7d1GQvBZhkoVtDolvIVgeCm2CgJGJsJMQRTVpsLh5jQouOdXt8HflQ8hhosFrfo n6QRKngXEDixuimAErraQP2sdkV3iWwSS0hPgGr7S11jQ8sM1g8bh9GVFkcFNWW0Wlz+3A8ZVQjQ hsxNSjLs7zR6WLa863Pne88yVzGduqzQWjke5dDTeLq/TfpYW6+BB7rG6pWCQ4j3NJaSq/K3HJIS 6trmiZYxIdENeRGg0KG994duJg+MCFXJP3J2glpJ1+Ku+3Rafv6PT/V7qTsN2x5mm3V45g+K3eo9 N6d1fH+z3D0mvIc19cAyOCNI7rjuk2AtIdy0QFs4mVdbVttdpVo2PvWXzOIxynJA8EoncOhhmJ46 IsSGzi9b+r37Jsbti/Hfoy0tgz4O81mBrAZDGyPJdkT9urfiZGrXTJ8IGhC5G2t1Vjqn/SYS0/EK 9yueWSPDM3OO57ju0uZwCEhKPyn8Fzk3FjqyRsd9JsaaKLBq0ANDSTMcyonRTq1I+anOg0YASTqu hPAdYSTEIruUB5ALnfIIxVNg6C6OyfaAERjBHGqZ8cDsnWsrqyqft54KK17ntLDBa7kFVSfaPPhT DyIQMUiVaIjDHlvHkUJ9hPw8F2fTb8Zv1O6paWN9aolu8gE/pQ1rVxCdHXVYTRdKijdXW+siDz8U n4p9Q7Gg669lXw8hzJYOeR5I/wBocdxfz4/7lGRISPZsCUDAaIsmloLZga+5wUH2sDtrNWN0BTvs Fgfro0SqoJJUoieEWwzkL9LaDgeDqnVcSNQrDNz27gE0ikBcd0k+0gahNogrVcJ0w1ToqWShOl5J IWhJPHimQUxsfsG4CR3UG1+oN9hOvYKVn0Y8VD1IHJHwR6aJ82Tq6uwlCIaOEnPlRMogHqiRHZPX ZPtPKIqgMGQrOqRCAukkkglSSXdMkpdJMTA8UN1rh+boihKkoMsDp7HzUkFKSPZJMUQpRSSSSUpJ JJFS8pJk6SlJgnSSUspNtsb9F7h/aKikhSrZNse0yxxae5BgpzkXuBabXkHQglQTJUFWe6kydJJC yu0CK2+PdUokgeKvgQAPBMn0DJi3JauUZsjwCCp2O3PcfEqCI2Ud1jwrGM3SVXOunirlIhiEjomA 1Z8IUqb/AKMdyU8BMZNXX/xmurP1pt2ElwpqFnk4Dt8lycq/1vqtnWOoWdQtqZTdcB6ra52lwEbo PEqhCsNUCgAuApjw7eKiPNONUCuZalSrsdVY2xvLSCPiFFIjRBLt4LM3reI3GuyXmrGePTpa1pA3 zqOO6MPqjluMMbaR5tjXuq/1UyfSzXt8W7h8WkFewU1VupaWjkAj8qt3CMIS4BIne2vIz45ASoDV 82xPqr1ypnp0WZFLCZ2tsLBPjDVb/wCZnWLf57JsI/l3PK9E9Fm6duhRNlf7o+5NPMDpjit4ZfvF 8jv6DTRe+m8F763QTuJB+C57qNBpy31CYafb8Oy9H+tVAr6s9wEC1rXj7tv8FxnU8T1Oq1N4FzBJ 8IMEqfmRD7vHIIgVvQY+WnM5zjJJ7Wn6Fk209PlonYXEjyBDv4oGZ9bOr3N9Bl5qoALQysRofE8r YowaqKH11QW7XGXCSTHguNbW6xxDefBZmLKJ8XDYoujkwcMgSLJFOkyRQwu13a7vimMkRz3CjQ/Z SyuwHae58fBTdWY3MMhIblJYAwYPB/Kol8Eg8qTpcOIcO3igyN53fIJwWHRuV2SBJRw7v4qnW8di rNcEauTJBkiWdjPUYWkSqdRNV7Wu+j2PxV5o4h34IGRS1x5nzHZDHOjXRM42LTOlvuGo7pWbLq5B gjvx+VPjF2wCzh2mvl3ULaixxb+a8GEwj1V+K8fLbo4mTW9mxrQ51bYJ8J7AoOTj+oCGgvB48j5o HTRZWx+4Q0iedZCt+sQdzDB8Qq0wYZDwtrFISxgSca2i6p0WNn48qE6aaLZyL3ZLNtwBePovAgz4 HxWW5jXSRoRyPNWsWUyHqGo7NXLiET6ToWx0xpIIPLjDStYbcckNM6DXuqXSiHVlgjcwz8ir9eLb c4vsOyvx7kKnzBvJK9A3eXFY41raNmTseXg8qv1bDF9f26ppHDbvCTwUW9tTb9jCYI4CWb1jGxsb 0NgLYMNJnc7xMIY+ITiYAkn8lZKMJCZqnAc0glTpa7UkGOypW5Vtj3OH6MOP0WzH4qLcm9vDzHgt MwJDmCYB2b5BJAGpJ0AVcMcbTvBG0n2nxCLjZW5zXTse1wIPmDMqb2uBLnd9ZKaDQIO64i6PRg5w HaEFzjBPdPY5QJ9qdEMcjagSSPIKZ5KhXodVLxKJQ3m5L2fV/NoH0bL8fcfGBYY/6KxVbtyLBiHG H82+xtjvGWhzR/1SqIgUEFnV/ON7apOsscIJ0TNMEFSYNeJKdYpQvZlBbSABq/U/DwQuFZcy5zf5 skeKGWNPk5N47XcFfXuwBVjGLSS0zrqEB7Q06GQUqnFtjT5oEWFCVF0Nn8ohLYf3vvCdOobLPQY+ mf5J+IS9Mj81p+8KXCkChZVQRen4s+4pFg/dcPxRCQNSYA5KZt1R4ePvRs9lVHqwNbP3nD4tTem3 s8fOQrH9pp+BBUPVb3S4igwg0rhtdG4HTkIDtO8qxeyx1jnNEAnSEB1dg5afuU0dmGQ10DASnJSA jlJOWMq4LxPCsyoYVZc8kRLR3E8q2a3fuNd+CjlIA0yRgSLa6SN6fjV9xUSyvu1zUOIK9sokuEXZ T++R8Ql6TDxYD8UeIK4D4NdjXXP2sBlT+y36+1aeLTjVuJcdXxBaeyK7FoDy4WgCDE6aR46SozmF 0G3HlPTZN/Vxbcd1TS48jlOwy0FWbaGCskukngAKvoBEQFJGVhrZYcJ0UmKfThN3RYlk6SfRJVLF JPGqZFSkkkklLpiNEkiipSSSZBC6ZOmRUpJJMkpnUN1jR5q24w0nwCr4ol5PgEW/Ss+eijl8zNj0 iS1Ckm1STlhUNXAeCvNENAVOkS9XUyfZfAaWxPIHhqpIbzYHEtbITb7v3E2l1uckFZr6Zn2ia6XO Ex25CMzoHWHatxXlTGcRvID6sIxzO0T9jR0TrTp+rPW7jDMV/wAS0x+RSt+q/WarPTtqDSRIJcAD 96Hu49uOP2rvZyfuH7HLkJw4IuX0/JxLNlzCPB0aH4FALY5ThRFg2tIINHRvdFuFHVKHH6JdtdPg 7Rez9FuF3TaHTMN2E+bTt/gvD2AVtZa0ne1wK76nN6o3Fb9ntdUx3uADgBDhMy4hWsMRkxmPEI8J /Sa2cmEhKjKx0fQxwk5zW8kD4lea3dTzAYvz2t8d2Q3/AL64qq7qOGf53qNU/wBZ7/8AqWlE8rjH zZofTVi92Z2xyer+uAqe/GuY5rtHMMEHjULhuuNDfQudw1xYf7Q0/FWXdV6QyScwvj9yp5/6raqP VOpdNzMV1GObrLSQW7mBo0Ov5xPClnPCOXOIZOI9NFuLHl98ZOCtWhVc2twL7g8CZHu1n5ob3You 9StwMn6ABA/FCzcU4zx+48S3+5CFOgc6QDx5rMERuDu6pyEGjAaOpXHpbnRsedA7T7k3ogGarBB7 ShU3OFE6vAO0NMEfiluYdTUPvhAAi1TkCbSua6NXCVUP84d/4I5Ac2A0M89Ch1sncDyO6dFjlrsy FektMhSa59ZkfcmaDPt0d3aiNIcIPtd4FIlIHbRNTlN4cFYIZYyWwD5lUTUeQpMcRodCmSgDqF8Z kaFvUYmRc7ZQ31LHaAD80DufAK31HpV+JXWLCHmJDh2cOWrW+r2ViXYRrqYK76tLh3d4OnwKuZlL cih1Xc6tPgeyrSnLioiqbMYDh06vG0BzbIAnXUk9lfqrxnAOBM/FVLKLm2OaDtc3QtPkoV3Pb9IE FLKOLUGl2G47jTo6G1p3Nj4ErFzi2nIdHJg/etJtm4y0weQs/qZi1ro5BH3FDlgROu4VzOuO+xR4 mcachr2yAdHfArct6g7ZJMyOVy7rR4Law3V211Ps1aGj2+fmpOaxR0kQs5TJLWNqNzjYDYCA7g+S yOoWh+U/naNACtnLtnJbt000gSsvqtG20XNdva8DcYiCly9cQ0qxonmQTE0bo6tItJEgKbcW4jds IB4VrEqAq3PHmFeryKtobtcD5wP4qaWQiwBswQwRNGRq3Mbg3t1hF9Qux2seIcDtJ7wPNXr7XNIY zRx7xOip5pexlLCZcQXREESf4oRkZHWvBfOEYRPDaB7am/ScSfBDJH5ojzKQY46uSLAPNTAU1SfC lm6OA8VNRaACPFScfABJSK0e1ARbXGCPFCRC0rt5C6Hp2Hj10Bzmhz4knnVYWOJta2JJMAea3WYt nrAMAA5JbzHdQcxsI3VtzkxRMuHip0DXWGaNEdlznU6RVbubw5aldNpc5wB8WmSgdTx3W1tAiWn5 lRYahPewWxzAOTGRw0Rs4pMiEwVrOx20GsNEbmyQVVVsGxYc2UTE0XRa4loMcjxUt8dih472mpun Gh1RfYeJHyUJ32ZxsNVt7e5j4pw9h7hIBsfS/Kn2A+B8ePuTdE6sLjFL/gs5X8mvbS4lvhqqCmx7 MOXcLgkKQtsHDj96gknrEwyLQOZ+ICf7TYOwQZSTaHZVnu2BlfvMn5qftsbuDGgGYnxVRWmVA1tO +CGyAJ11lLhAXCRLKoWsJDGtaDzylbk3scWBocR3AKere2A6S0mNxQMlw9d20mRyhQJ1Fp4iB2T1 5bzo9hHmFYa5jiPcBPcrM9R4HJS9R37xQOMdNEjKeurqufit/PL48BA/FBturgenWCZ13FUN58Ux KAx11KjlvoG7Xe6uSIAPZKzJfaI3DaOwVElSa9zeOE72xur3pAUCabZse+IOo7hOX3Nie+uoQqsg taQ0QT4d0alllk2k7Gg6vPj5DxQIAVxSPixdY785gPxCbcw81/cpZtxFolpG5oLS4ySOxVV1jnaE 6eASEdEGRvu2AccmIIPgCnLKfFzfiEHE/nwfAFX9E2R4T1XwAkLNNX0mdrR8wl6Duzmn5q1taeQo +lWfzQhxp9sdmv6FvgD8CmNdo5YVZ9FnaR8Cm9Jw4eQjxrfaHi1SCOWkfIppCt7bxw8H4p/0vdrX I8aPb8S05HZIK0Wg/SpHyhRLKO9bh8JR4/BHt+LXKZHNeOeHOb8ZUfQYfo2j5hHiCPbKKFEvAR/s 1nZzT807en2PYXOIB7BIziNymOKctAGuzJfXIaBr4qL8m5+jjomfWazDgoaJwA3WmxouLnA66ogc HCQgEKVZg/FIgIBbmKJP4qyg4rYZKK4wCoZbs8dlB7Y7/clvb4pxxCXyTV3RLXa4WC+qx1b5k2Vm HfMd1tnrfVA9rWdTJGjYFTJnz15XLVm1rgBqPEqZtpaS4Euc+NzYOhHgUjjEt6P0BTxmPQvSv69n h5rszLXWDloaG/kJVe/rT8hhqyX23MPLC8N/FolZFOXWckOrY6tkEBnPI8XJn5UPLWsdoY1hAYY3 qP2J9yRjYdkdYx/TFP2dhYAAGucXGPPxVPJ6fj5uVVTW6rC9Q+wEO2knz1j5rNORcTIaG/EiUa7L FzIfAdG0x4FEYuA3Gx+KRIzFTDet6Bg1UHf1OhzhoGjgkdpBJ/BZTqa2HY8C7boNp0TU+jWT7+fI FF+00Dl7z8A0Jw4h+kZfSlpgD0jH621nYznH9Gwt/FSrxMhjgYkjs4SEX7Xjdw53kXR+QKDsvG/N qE+biU65dlvtw6yCnYr3Ol0N+YCkMcBwIe0Rx75P4KDc4D6LWj5T+VP+0rRwY+DQl60gYhqZfgnv c99UWFtoZJa0A8nzhUfWEbbGor8+6xpmXN7zx+CCbGWfT0KMIkCiPsWZZAn0m/NsBzA0bWgzx5Ij GSNf7gqLnlpAadBwjVXTq7nwRqgx3Zbf2ZjxpJ8+Ah7HUH3a66R4ItdpdydFY2ssaGRM8AJhJG68 REtt0GxtjQ9iTXfm2CfMJn0X4ln0TsOoRgGWiRoe6NjfcJ4TsRRU1zYidE7qw4SEzqHDzTBr2lDT oVajcJ8DLfg5bLxO0aWDxaeV2tQa9jbGQ5rhII4IK4U6iHaFa3TvrC7DwXYz2epZWYoP5u0/vfBR ZYGVEbsuKYjYO3Rudcx6672XtIDrdHs76d1hesWvc3wJRDkX5VxyLnbnEyT2+ASsoa6wu111PzUR HDoWeEjKOndGXyeYVPqhd6TDzBj7wrrseI2lVc2twqO7sQZT8RHGFuUHgk5Xvf5La6bcRiCsxI08 ysrZ3BVrAtLCZElpkKxnjxQ8mry8uHJ5ujbQ8Bj3GHAzH8CpXYpyWA1tkxBCRvFjTOh7IZy/Tbtr 5OkyqkRMkAbg6OlwDhMiPTWqLG9Jk02D6OisnGxmNL26947krM9QsfJ1B1lW672uZDXCe0qUxI67 7sVgaUNNmy2zHdtkS4CHaaaeazepXepk+TQAEd+5gLnuOnwEqlYa95dZLXHXVOxRAlepYuYkTCqG +tMA17iIH3IrcHMdq2mx3wY7+5NVe0O3VmHMBcD8AhPz8y0e+1x7Kb1dK+rU9PWz5Jh03O3bn0ln 9Yhv/VFTPT7uX2VMH8qxv8CVRNhdy4n4qJSqXcfYi49i2rMJhjdlUj4bj+RqiMXBb9PLnyZWT/1R aq0hNKdR7osdg3G/s+twLX2vIM6NaP4laDeosyP5trmbe5cJ1+AWRRU6+1tTeXmJUq8mzGe5rCHN J1nvHdMnjEvEhmw5pQOukTvQd2mxgBHB7ydZVTLyQCS06j8qrsz3Xe1xDT4eKr5FmkDuoo4jxas+ TmQYekorb7brS+125x7+SiQ3/couMmU27VWKrZpcV3etuphV4xoG4lzxy3hHigcMCyarXMcHD7lf Za14kKvkgbuzq6HL5cZiI8MQQn3V9mNHySLmH8xp+Sq23hgPc+CAcy5pBLdDwgMUiLXz5nFE8Jr6 BsZwr9Alo2mRIWarORkCymODOoVZT4wRGi0eZlGU7jtSydJJPYFJ0ycJJUrmPJpkT7fPt5BUzCsU WFrNOD380CLCQW5YwjH8SdZ+CzXndY53iVd9Q7KwTIIMqq5jQyRIP8EB1VJFEJoTlIJyE2MKPU/W J9OO3j24Usl2IdMdhA09xJ/IZQEkE3pTEqQCbsnkzCKF9xBEGPNazALMHFLtYDxHweT/ABWQQZEi FsYZnp9X8mywfftKZPZdDdrdVb7qD/wQH3FyoErR6uPZju8nD7jP8VnFGOwRPdPhfTcT2CuiFTwi 0byTHCL9qqn2hzvgFHMEy0ZIECOrYCcITDlWfzWNY/z2n+5TdR1MNLjjFjQJJcYQ9uS73IsvmlB7 pmO3NDvESnJKZS/xUkZTJSihdKU0/NJJSpCbYw8tCfRJJTE0sP0WieUYZO5uxzA1zdNEzLq2Nc2P ce/PySd6TNS2XePgmnXQjyZsYIFg1e7nZlbxZudqDwqsStG4Ms8o8FFlYYQ5g0GpKnjKg1p4yZku eVJgl4T3QbHEcEp6GzYFJ0thr1U6FYhgTnUtHjqnGghNy/4Ku2OzJOmToJc71rCom96ntDSY1Qnj 3KcAMcpSAu1/WeCDKJk2EuDwfpCXfFC26BFe32SRyAQfED2lE1awTkQRaHe7xTbnHunLW9jKbaUV tnuqSknDCRoCpem7wStIiT0LBMi+n4p/TQ4k+2WFfKkyoPftmJ79kg0MdJ/Kr+BgMu/TXEiqdGjQ lCUxEElfjxmZ4QNfFpM3tJrDd2vbX7kYdPy7NW0Wa/ySPyraFmPQP0NTWkd4BP3lRdnXHuVD7xPy x+1sDlID5p/4rlM6J1CZNW3+s4D+KOzouV+cWNPm7+5Wjk3Hlyibnn85A5Mh/dC4YMI/eLEdKtrZ uNzC4cNEx96alzse39KIceCNR8lL1HdyVB43iCgDI6SIKTCAIMBRDrMfVfXtfDgfFUcrBuxz6lQ9 Sry+kFTZlPx37SdB4rZw81tjR+cPBMMZY9RqOy4ShlHDLSQ6tCnIZYImD4FTdW86jUeKuZfTMS8G 3FPpW8x+aT5+CzHuzMbSxhA8eQnxkJax0PYsOTHKHzC4/vBTq3TqUm1wQSJ8uyf7aw/TrnzCl9vq AhtX3p/r7MQMO7YrcCIjb4hJ7z6r6yNpqaOe48lRdmu9VriQ0SIb/ej9SzPTsECHuaCTz8FFLGbq t2xiyR4TInZOfV5IHwlUs6yKy0z7uJ4QG9RyJ98OH3FSvza7qtrmndBgECAUY4jGQJF+Sp5sc4EA 8J8WjuI0arOBO/e4DZwZQAwK7U0CoCJ8lNkl6a7sfJYhLLZ2jq2XvAEc/BV3cyNJ7Jt209yPA8pn OB1HdQgUdHWnMSFVQ7MHgmXAaT+Kem1gkPHuHCZzyBCg5s6qedGiP0h+LncJqUf0se3kz3sc7c48 6Af3KwGtczbY3cPAqkKyHtHMaq2HFR5BQBB3bPKV6hIX+1Bk0VU1Psrkbht2nzPiqXZXs936JrfE /kVFSYyTEE6udzggM0hAcI7BjCcNJKeEXHrZZZtseGCCZPcgaCfNPtr0h2p9qsNZSHe50D4Aj8pK hb6Rtd6IIrn2g8wha7hXqlsuGhA0IVd30lacNtJ81VI80oncqmNApvPMJ3uJ1PKPidOy8vcaWexn 0rHHa0fMq1Z9XOqtq9UVtsbzDHAn7kJZIA0ZAFdHDlkOKMCR5OYmlFfjZDCQ+pzSOZadFE02gbiw x4wnWO6wxkNwQsD4IjXkd+eUMMPkFLaB5pGkiwsd0ncUtEiAfiowktOijwkkRwnARQskpbUtqFpp YJKW1KErVS0K6yglg4B+EKo1svaPEhaW2THAHJ/3psiuiEHoFrPUBGgPmCULKhoA27SI0OukK4G7 3+mDDXtLR92hQnXVyN1ZeC1oEjyHEpRO6SBXZzjKQB8UT0ySSNI7KEGfgnrKpW0+KWqNiYxybxWH NboSS4gDRFfigXNx2e606HUEAgkHhNujSRE1fRniY7fsd1z6xZ+ayTBBjkKmGumYEjsdFebhZTXm lzw2qoCyx8yxrTwdOSewQrm0j9K2bAeA4bZPjA7JXqu4TWvRrOJMHaAPELV6cZwnD923/qm/7Flu c5w147BaXStca8eD2H8HBKXylEfmCurf0eg8w94+8NKz8jGuxniu4bXFodEg6HjhaXUml2I3QnbZ 28wqOflV5V/qta5o2tbBOvtEdkIbBMwNbVilpY6ufcdY8RC6X6vMZdhNkQ5kgxoTB7lcrXZtd7W6 nxK6L6uPeG3Uud6Za6SZ4kI9StOsR4OzBOgaP7Rc7+5O5tHpObZsBMiYhGqsY1mpEydfFQJBsMN9 SeAI/iiseOaH1hw3ANrc5pkeBgKW6yTIH8mDyjZVfpdQyWOaRLt20aiHaoRDdZPuH0S4cfcoZVZ0 bMdhqt6hDQXMI8uUi9s7TofCFLQGWkEu+lr+QJtjuByOLDB5QoJ1W3tnQhKU0N1dtAH55I108Ewr Zt2iWtI0fOqNBGrOU0pthOoJaGnWdZHkmh0B24bCJk6JUm1EkO0MJrLRHuOvikW2EkbRpwZ5QiNC 5zYjxSpXHQpZ1knRRe55bBcdvgnYWOMcEKLrGlxAEgcJ4WmWl3uiNZdrwFJoLDI0Kcv800+adqxa M/tNviPuUftNoJkzKiYKg5AAdkmR7phlOKb7RZ4/iq8xKUo8Eeyvcl3b4xWd7PuCRxKTrvd+CUlK VFcu7e4ce3CCuMPH7ud+CkMOqIa7sRr5qG49k1fUHMMPYD5gQl6zsbWyOGO8Bqispsrdt9Pd4ECV JuPlO4q2jz0V5udS6JO2fFHa9jtRB+CByyG8WPgiTpLTs57cHJPLmNU2dNJ+nd9wV/5J32mIc8NH hoE33p9Au4ANyftazelY0e573fMD+CHZ0esn9FaR5O1/IrBvx282g+Q1/IoOzKO293yj8qInk6X9 i0jH1r7XPs6ZksPZ48QtCl1nptZXVY4NEaNKgc5vav73f3Ib8+yPotAPbU/xTjxy0kFsZxx2Yy3b Jqyjqa9vk4wUJ9gYYeQ0+Eyq7XtdLjyUxMcABIRA0V7sjrbZD2nggp5VWTPn4pxkObpAd8kuHsuG UdWxuATz5ShtyWnQnb5Isk+KBvqGSMgdjbSy2zbrppwUKm6yiwFpgTwrGQ0utgaGOD3VdzHFwaWw Topo6xotSZImSO7u0ZTiAfFWXXAsIeJB8VjU2WVsAIBHEn+Ck7N0Ic/QdgoJYbOjajzIEaNlhk0s e02UEssH0qv7lWBeR9Ip3Pda/wBQe2BAhM53psJPJ4CmjYFNWchI2BXdiSJHc6ol1pueDqA0AQUB riXSi6eQPmjIIiTqOhXDdDp8UiI1VvGDHAtI3Wf4NshrSf5TihX1ta4tDgR/JId8pUfFqyGGlomg Eie/KtasJEbmlU+NPkrdTNPbp4nshNucjvIV9VOIPj/FCHcI7gyNXSfJB5d7dZTRs28gNhTwC38V HlsIoY8nbtM+EI37H6js9T0wB+aC4Bx+RToziImMiBrYtgyQkJxnEXvGQDXbq8nw0U5Cd1NtB2Ws LHeB0Um4mXbpVTY8u42tJTZEEijoBTJjBhAk7k20sx0mseRP4wq6PlAtyBXZI2ANcO48Vtu6l9WC NMQeXsg/gphpEaW5WQ8WSRvq88ptqeWgmADwTony7KLMm19LfTqc4mtg7DsEmZDW0msgnWY0ie3a U5jYOG1xEg+Y4Sa4bgCrPTsb7fnU4waP0jtRMaASdStxv1Miwuuy6mCdGA7oHgo8mWENJGivhinL WI0cDIcPRZHB1Veey7zA6R0rBc5z7W5BczZDmbmxzoCp24P1es0diNeZ/NaGf9SoBzcRoISI7s/3 cnXiF9nmeivc4D1bQaq3EVUkgCTqXEK9d16uprrWv37SWV1g6kj853l4JdU+ruKaS/pmPd60iG7t zY7zICx/+b/Wh/2ks/BGsOU8ZI8pUGT3c2OIhGJP9Yatln1nzRvD2se14gtI01VSu45D3hwDQ7sN OVL/AJvdaj+iWR8kWjoXWWuH6q8e4c/lUgGGN8BiPIsEpZp1xiUh4h16vqZiuALsp5kAkBo/vTZn 1UwKKxtut9Q8EhpHzC0q8XrYb7cfeOxbY0H8YU/2Z1vJILsSwOiBuLYHzlUzkziV+6OH6OhHHy5H 83q8ZkdLvozK8YkPNpAreODJhdTX/i0skOszWvb3bW2D97l1XR+nV9OxD+0G1Vvc7e4uIdHw3JX9 dc64V4NTfRaRuuthgd5MaYMeaMubyyqMPTW57sH3fECSRYOweSzfqK2qotortNnaxx3N+4NWDk/V 7qeNO6ouA7gH+IXo1mZ1V1z7GZFTKyf0dTWlxA/rcSq+Tk41gBzMk7h+a9waB/Zamx5vLHSR40Sw Y5aAcL5k+m2skWMcw/ygQo6L0DIt6W4Q17LSRo0CVSbhdOsdsez05197QOfJzFYhzXELMCGGXK1t J4xMSutyOi4hHsqFhedo2tj5y1Y3UugvwjJuaNwLmscYdAUsM8JGtixzwSiLGoc2kB1rRIABmT5K 9R7zvI8wP96r42M5zw8EOYNJBAMx4FWm0WAwwNkfEk/2YT5EA7rYxJF0xyLNgtcPpBuxp+OhQ7a3 XFgpc1xLWjbOs7QFcrx6Xvi9zXudJDRo3yBPmfBb2B0ndUMg7GOc36DKxtHzUcswiDpZZBiMjqdH nKOlZYcW3MYA7850mCfhCFRh1tNziWWekfaSeRwS1h+kurtwbLcOz0LGW3E7WNcNrADzMg6hc4/o eRjNsdkXNpcz6LWHcXT4FuiGPNxXZEewXTxcNUOJrPzBWQ3Y58eLgG6/ya2hNVngO3soY2wAgOHM HnQq+xmFWyqq6k2PgtsdoTPIILPDwTNwcHe7cdjHRscWyfx4TjkjrYK3gl3Hk1rbhkYrBSXEOsJt 3d3QAJ8h2V3G6XTltBfYawfaT5NOuiZ3T66XTS4GdNCNf7DdxPzUG3sYw123VVsaT7By7yOwlNMr HpsJAo+qml1HEqqfZ6D2uprMMd3cAYlS6Q72ZLf5LHfc6P4oeXk1PZ6dQ51c6ZHk0J+lH3Xt8aSf uc0qUXwG2KVcYp0sTZdf6Fljq69XFzOZHA5CjmdM6W2qy19jjaznbtAdr4fBQpwbLmhwPptJ+kQ6 D5y0I56bimxoBaa5IBdu5HcjxKrmYEvnI8AziEiPlvxLnXWVY9NRprAFrN8uhx5LeSO0K79Wy5/U XMeAPUr3Hw9pVu3FxKa3V2luR6f0GtaGtZ5EjlU7q88NbZhFpEe70msBE9oaJT4ZYnb7ZLcmE1v9 A9S/7BWC+/IrqA7FwH5Sqdv1h+r2GZbY69w/0cO/iFzQpznOjKr3MP0nXNa0AeO6AVSsrrDzsA2y dvjHzUwkD/YwHHWrq357OqdTfdi0uY01gFrokwedFF7HNMPbB8CFn105W021BwYOXDQK9TX1N7Nr rwJH0HmTHn4KOZA1sBlxRJFCJLF1NZ7QhuoI+iVYfjZ4B9tbiBpDhr8lXuuspIY5p39xBH5YQBB2 IK+UJR3iR9GJNrNCT80vUJ0cAfiFO37XW0OfjvDTruI0P+b/AHqo/K1nZ9ycI3tTGZVvba3tJDi3 UaaFIFkkmdex1CqNy2nQ6fJHxy68uDGklokkcR80DEjVIlegS7Wke4gkGWyIhVcx7gA1xBPeOER7 2tBk6jsqVlhe7VOgDdrZy0pYmHA/gkTHHJT+m6C4cNiT5nhRcdYUvgxKCc8aKPZODCClSefvSIke aZ35Uge6SmJTSVN7ZEhQRvRDZORpoPvTtuBEHlVkgm8IZPen3bYd4Ku8QSognxM9kgUhGlTycQqt mUmInjhOx72GWktI7hME4JGqKyymdkbvznO+ZUNzjw371Fznxyobie5SpNpg60eA+KRcT9KwD4IK UJUi0s1d3OKW+ocNJ+KElBSpVpfXcNA0AJvWsPdRgpw1KgriKt7jy4p2ptniVINjulorVdaFL91T T3j8izlbxbAGFpPBTcguLNglUj4r5jPZ6g+kzugU2myQQfiFYssYWlp1BQaBWCXN0j2uHc+abH5f JWUDjB7tZ5cDtPYpDXv96sZNXumNCgbQI1kHWCpAbDDIUWbXOAgIdri5wnsFINbOig4jeURupdhj XujMYywFz5Ed5hCiR/FQsJ4GkdkDqoFsgln828PaOW90+4A6DQqux0Ru0CK+GhoDpPcRwmkLwWRG o8SrDQXfTdPgJ0CrB0t81Yrw860TTRa9vctaT/BMl503OVkI2aJSFlDddfkVL1q2NOwAHxU6ehda vjZi2AeLvaP+ki3fVjrTWbnVNf8AyQ4E691FeO6lkH2tqXMEAmGP8G1jZDdobUBvaNxrcNT4/EqT stlRLbTvwcj6L+9b/A+CpM6fm07W2NcHt403a/EK9V0s5NTzkPNYsMODSdY7kKMxxAkk2GEZskht qtVnZONU++yv7TiVuLKshrQ5o8ju4V3/AJxMra0vrfUDBBLTtM9xtMKj+xMOpnp22XVsdrt3ew/g r5dXi4wN1gfQ1vtB0hvhACbL2zVR4rPkt4sh3PDSLHxehXbsp+MLy/3by5xBJ8tyi/quBiT9nxMe vbpPphx/GVTyeqdNc9u2lrgZLjJbMDQDzWdkV01iKzYHv1exolh78+SmhjB+YS8BIsMpH9Hh+gc2 4k2vedCSTHxKgNdFZ+zP3EgCf3XHVSZj2l3uafkrPEGrwklHi220XC2sEFsgH46Le6b1Cu8GvJyP RcOCY93z1WdVgue4NbWXE9jJVn9hPefe0M8wVFknA7mvFlhGY2FvRY9eJ2u9R38ogq7U/wBMwGsc P5IE/iucxeluxxDXu11iZWhVvaBJLiOFQywBJqRk3cZNCxwu9VexxgwD56KyK5EhYTXnbqDKPTc9 h9pLfOVWOLsWUSdX0iOyI3EcQHEgA68ws8Z97Rq5rgj19Uo9IUuYQxoiAZkecoRx66/goy7JOo5O F0uj18yxtbCYHdxPk0aof7Z6a3DOZ64bS0gOmQ4F30Zb9LVYP1qwmdXyaLaMljHsb6ZruO2ZPIju q7/qzf6eE31a8lmM0tuoe4sBDnFx2uGvdW4cpjMYkzIPVglnmJEcOg2dqvKbZZvySWWu7Fra5+Bv AP4qWd0+zIaC3Hteed1gDhp/UmUqqbMTApx22HIprFlbfVG4ySXNaYngKxj4rWY9YoyDjXN1eGBz qnOBkTXxHwgppx1I1emy8T01cJ/RurlhFWO8MAJO1hD57CSFlsx+r72tursxQDtNltbmtH9Z20/e u6HWxSSzMecQkEC9gc6k+e6JZ8HfehZ+Q67o12N9uGXZcwtrefzi7QfR/gpIynHeI16rCInr9LeP zLur9Of6F94cxwkAQ5rgeYMSlg9RuZbvrLbIMBhncGz+bBGuqB/zW6uWb2ur2/veoANPimq6NdS1 zclzfULm7LK7QQ1o+lIAKmrGR80ZHwYrmD8pA83eZmZD7dchuMQJ27fcZ+WvzXMZ2Lm2ZNjrCL5d /PEQCSeCdFqQMf03NutsYw7rPUcCA0ayNAQU2X1evcWtDST+a3V3z2wm44yhK4i7XTlGUakaafTs bIxbxkMpbc4T+ia1zmx/WPC0rrnbTcKX17XextbS48an3aIX7VuLG7nndAkNH8VWtznvkEEnxcU4 45Tlcgt44RFAtnHrZew33Wsayz3tIjfuHGjeFdxur0NraAD6olrwQAwuA5BEFc7XbawWVtO0bp0H iAe6i20+u5hcSHN9x/lHQfgnnl73Kz7xVAB2cv6xP2ltexjp1FYkz5ysl+fZk5G64OcBrHtHu+8K 5VnV4tRZXXWSRDC5g0PmfJNZ1BpZXiY1TRtg2WbQS88jn70ox4dBC/G0mQlqZ0gNl+9jnVGquPbI 3HXvAKuj124tNmNRN1j3AOsAG0NMCAe+hVvDx8Z7GjIeX2uMw4SA49gtAVUW3hlG0Cj9E1xPcfSg fGdVBky0a4dvsZoQFXe7hX9PyLxFzoe/+cfPuPkNqyc7pdNL66ccPsveY28ruHVf6OveP3gYk/MI VmHZaNrqg1pEEEjj5SmY+blE+rbsmeCMg8Dk0MpIrFgfY36e3VoPgD3UcbKdjvc5oDi5jmf52krp eodK6Lj2it4cLPzm1GY+O4rGyenYrQTjWEunQOBGn3K7DPCQ2IvuGpPBKOxDWqz8uoey1wH7s6fc UZ/Vs94/nIPi0AKs/Gub+buHkokOHIIjxCfwwJugt48g0uQ+rJ11ryS9xJPJOqW9/DJHwTMbZY4N qYXOPZoJK08T6s9VyYLmChh/OsMfglKUY/MRHzVGM5bWWlXn5LI3EWAcNsAcPxWp0w4ue9tL8Qsc 4wLat22fD84Bb+N9Vuk4QrsyKftjvoul0Nkcu2aA/euhxMnCppbRRtprbo2sDaAqmbmYVUIm++zZ xYJ7ylp2eKzeiDEZ6+PVZY9vDYBI8xthY11+ZZaKg11FRPEEH4uJXpuT9pvI+y5ddXi19bbAfvcE zen2ua37R6Fp/Oc1jmT9zio4cyYi5ATPnqzSx3pEmI60+dY9FdNosvySdTLAVbsy6iJEEDgnVddk /V7DsfIxazJHvkfPTahP+q2GPoVVO8i2EJZ4SIMgb8KXxBiOGNV46vMDq7xWGtfPigvy8az3W1tc 794gLoczotOMzd+z/WA/0bQ78mq5fPycfeaWYPov8HAtd9ykxCM/ljIeNrMmSUR6uH7GwzJwh9Gt g/shFGbS0QIA8liOxctga57HVhx9pcCAfvRWYtxB3v2kCY5kKWWCP75Y481P9wD6IM57ftD9mjSZ HzVUkyrGRjOY0WF07u0QVBlHsD3TqeArMaAH2NOYkZknqsXu27AfaTJHaQoP5UjEmOOyi7lOWLwl 7RzqUjJUdUlLgz8EuDCbVNKSGY5gptiXISlBKS2n0bXVO1LCWmPJQ2+CUyluSQsQR2SnxTkyooqX TyiU0OtDiJDW8u7A+ag5pa4g8hBNFdMY7aJBJFStqeEyUpKX0TiTwJR8GxrLHtft2PEHfxPbWDCm bt7yRSHvGjiJgkaabNECaSAD1a7q7GMD3MIaTG4jSVGVcyL8p1LRY01tdLSdsbu/0jyqMpDUWqQo spSkqKUooZSibLYhsiFGui+0xVW55/ktJ/Itav6v9UsALq9jT3cD/wB+hRznGO8gGTHjlK6BLjv9 Vph0qEk89l0A6Cxg/WcuusdxvaPwbKe3C6L6QrdlE7e9VZJ+90JozwuhZ8gvPLyo3IDwvVwWuMQS eNExc4hbQx+gsMirIvP8t7WD7mhHZl4lTg7HwaGEcOcC8/iUjm7RJ/BaMPeQ+mrgMY92g/2o9XS+ o3uJqxbXjxDDH3rYt6ll2EHcGQZbsaGwfIjVRfl5Vv8AO3WP+LjCb70/3QPra72YfvE/ggo+qvWb dfRDB4vc0fklXaPqLnPIN+RXWB2aC4/wQaMnIx3bqbHVn+SVfZ9YuqsrDA9jiPz3tkx8iFDPLzB+ UxH0ZYYsPUE/VNV9RMOf02TY/wAQwBv5ZVpnQvq3huDXtbY8fmvO93+a0ImPn9PzAPtWY8k80u/Q tP8Amc/5yuNyun0EV4gaS8e1lcffKqTzZhpKcj/dFD7WzDFj/RjFjS/pVThVU2qpx+iNmwn4bgJV 6S0CdB2VHqGW30IsaHGAXBwLwe0R2S6c7JbWC9rGV8sYS4w3+2J+Sgmbhx2f8I7s8YG6pr9b6tbg X4bK6tzch5FmhLtoge2O+qsHJ6i8fo8dtbTwbnHd/msBA+9Nm0Nyba7r2AmkzVtB0MgzwEb9pY9b wLWl+obIPBInX7k73ImMIxhxSo8R3QcchZlLToFUt6g1m67FFjXCHGhwc/aefY4A/iiU42Ja0/Z/ cazNjSNrx5PY6CFCn6xUWu24+JbkMboS0gEO8IJbBHxWb1fr1lrPVrx34uXUP0Vlz9jwO7YAO4Hw JTxjlI8PDwnwP5hjJEdXYvqZ6bw6trw8a7hPHxXKdeyeltxXY2MDuOriIDA5COZ1jqdjBmCyvHdI AH6Nhd2Euhv5Uevob/Sey5oYXmYLt4b8A0an4n5KxixjEbnO/AMM5GYPCK83kxt3ktme2i0cLOrx mNFle9g5rcZBPw7LaHTem4mGWZVHqvE7XkEF5P0RIKBb9XKbBX6B2WCsbiwb2gge5zu+p4hWzlhI a7d2uMc4nSraGX1HFsLbaaGUuafogyD4hXOn5bc3e3Z7q4+jHB8JhZ+Z0HNxQHuLLa5ianSdfFuj h9y0Pq/0fJde9xFmNW9sMue32SDwZLT9ybk9sYyQfraYe4Z1w/g32sqEF0sI7nT8VMmgCRcPgSCr Tun9VqbNdDctv5ttckc8wYWD1jrPUMXLOPTtrYPBg3fDVVscDkPpIP1Zpy9seoH7HWZYx0AOB8Du H96I8sr1sfWyf3nCfuWDi5luTYw77H2AEkH5RAVuvpL7yfVqvZa4kttABbJ8QU84Yj5pV4LRlkR6 Y26J6x0XFM2ZQscPzGMLh+MBVsr6z4172/Y6d/jMVny0Eqj/AM1eoOucxhre6NwDjEjx1RD9XPsj Rbl2tgfSZWQ4jzIHI+CcMPLjaZmey05M50IEQmu609tZYWCq+Rx7hHJ0hUH3Z2Q6XWXPnho9rVrV WdJpdXYGfaaXiD4sI8CYkK/+16K2g42Mxjeznf7IQ1ifRj+pTofmn9jR6b0z1snHddS9rWiXlzdC fiV0D+jYZE7NoOshY1/1hyrIHrNaBoBWBp90lUruo22mXussP8ox+VCWLNOV3wDsFRnjiKri83S6 piY2I0ZWPkbb8Yi1tYf9Lby0geITer0v0WXNfefVbva1pAGvxWM++xwiA0H5qGPY89OpbuP6Nz2a aaAhPGAgAGRJtb7oJNAU3ct2PY0uh8HvY4E/kCztjWuD6b31OYZaKyds+O3hSIHhJ80ynEaFMRlZ tkczMEkht0mSTLD/AN+Qz1KwHbYz0fBx9wP9pS1JAHJSJABA18T/AHICMewUZS7osjINtYpa/fvc A9w4/qt/ikGNaNrQG/DwQ7DttrDQNJgDiSICKOPE9ynAUi73YjQlvzHwTd1IjUfd96QYSig6tcuD RY88BxP3BPjUg7g/UkS74lNfWWtbWdS9+vzMqxQIc8+JA+5EnTRaB6ljQPXayS7awu9xkTMBNjUN tstuEtG6G+ZU3v8A0lx7Q1k+AguKv4XSr2YrbdwJf+k2+AdqFHKYiLJpljEyNAMsFl1eVWQ8uA3O APi1pcPyJYl1zLay5kjcPcEStt1GTXa9hDa9R5zo4fcp21iqwtbqzljvFp1aVDxDj1o2NGThPDpY pFVnurMbnsI0nWFcr6w+I3NfP72hVSGuPEgyhZLKa6nWFshusDRKWOBOsVCcwNCzffiz+lpk93QN fxVig9CsaRcwNd20I/gVgDqWESQXOrPg4f3KxVdU7Wqxj57SJUpxgiqry0YxkN3btHp31et+jcWH ycP4hI/Vbp9oJpzT8CGu/IVnsyrGD3VwPJGr6k0aSR5OaCPxlRmBHy39rKMgO9Nlv1LzGv8A1XJr LomRLNB5o1P1e+s9LmkbrGaHSwOBB40KBX1Cn9ypx8Wyw/8AQLVaZ1SljSS/JoDfzmWuLdP6xKaf 68ZHypP90gebHKb17CDTbiuZTuG57mnbqY54VmCdYWP1H63OLPQOddkUAgmmzaQS0yNQ0HlY+T9a s2720jaP9fBMnyxnXACB14tExzxhfGRf9XV66yymsTY9rR5qjf8AWXCxDLLSXDs0wFx1t+dkGbbC Ae0oYpYPc73HzUkOQiPnkT4BZPnD+iPteqb/AIwcplpilltXg6Wu+Tv9i1sH69dKyYbfXZQ8+W8f 9HX8FwJa3mBoq3qvBO0kDy0UsuUxEVVeLFHmsgNk2+pZfX8ck10vDGR7r3ODYnwbz8ysq2nEsG+o tteTJtBDnE+JdyuFGVeW7A47fBXOj3WV5ZfuLQGuB7DXRQnk+EEiRFdO7MOb4iBwvc4ORjXs9C4N c7iCJ3f7Vl9a6biYwDsaxoe52tJguj5cAKi6/wBNu9roeNQQePNU8rMDQQ5xc930nkySVFjwzErB NdmcziYnirRk/p2Hed1txB766BSf0usVNLbwLg6G1iHDZH0twWcym20FxJax3HmkyvMrB2/RHnyr fBOvn1HQtc5MZP8AN+nr3ZO6Tc0na9pn5IZ6ZkeLfvUm9QuH0gdOSpDPLhzCN5h2Kq5Y9CPq07Gu qeWO1cNCoEhTtdue4nueUNTDZqSqzSkyeUwRQqYSlOkkpkmSlKUlKTxIlNKYOhJTNhbqHcePgpWP Y53saGjyJP5UIKQCCdVBOmGiU+CSl0kiT4Qo7iipm0w6TxotE9YsDS1jWho4EAf3rK3FNJTZQEtx dJjMjZvW9TvsPvgwCACJiRBhVS9qgkiAAKGiCSd2W/yXcfVzpmC7ptNllTHZDhLzydTp+C4TutDp /Vs3CI9N8s7tPCiz45ThUTRZcGSMJXIXb3XVTZj4D3Y81lpA9kDn5FcnkNybmusdc6zaJcHmD5x2 K2sT6yUZdf2fLBYXf66FFu6Q22pxxnB7S0+3hw00hVcQOP05N73bOQiesDpTywiNE+qrFttDyxwL XN0LT4qbLwTr96tGPUatYS6FsBSCixwI01UwEwrwyCkJTAKQHdNK4KCdKE4QXBUKxi5uTiEGlwEd iAQqrrqmfSdCE7PobxLkOAy0q7V7gibunaf1X7Q1gyK27mDR0SJ7EhaeFex1LnOyKrNS4lx2OnwA J4XHO6meGMHz1TOuy7Gy7bWw+MDT8qZLkTIcI9Itkjz3Cb+Z695ZWA/03ua4zDbN3HiJQ77yC3Hq phtlZ1ngmSJ57hZPTsqpuEHbmywkWPc0uLp4hoGquMY20UZQpIcA5rnkhoDWcD0x4z4qP2OGR4ro Mxz8cRWlt7G6kKsfbd7rD/NioguPm5qOyyXtyLGeq/Q1yIDXd4b5rMx6KqK/aAI4IWhh2Xuh0wyZ iJCjlGFki9VCUqom21fkW5FZrdWA1wBM6/KEKz3hoe8yI10Ctuqx6wwOM727hGpHxCEaPUPtYY8e Ew70AlqsxaXXN3vks1b3AJ0T3V42GTY87HnX2mXO+De6uV4wY9rmhuhG6Z4+S0TkYVZ9lQaUOOQP cdlcMSPHycE3Xue26nHuuAiIrcw/9MaodvVczDeLsjFdjWuJ9OyxjtpBPcBrhxyuhbmuDiaWkl3P f8qkX5lxA2g+En/YU/34/pYx9qz25dJkfR5w9c65mWtZTjOtr/era4M183BsK5T9XsbJb6uZSRa8 Ak7p1+HZat/2+kBzmezncHE/KEq81p0sEFKee9IAY/7qI4gCeImfm0f+b1THVOof6bqXhzXESY7t PGhC0fsz9pAdtnuIBH+dKM1zXiWmU8KMzkas3TJwgdHCzejZVj/UZfvI7PG38W6LIysTqNAO/GIb +/O5v3tldptUdqlx8xKNWAWOeGMupD5nvsoyHVSBXZ72QOHT5o20Cz03agyWT+RdzmdG6fma5FDH u7Oja4f2mwsrN+qlVgBx7XVOaQ5u8b2/hBVuPN4zuOFry5aY2NvPcKJWjldFzsfWG2M/erM/gdVn va5ri1whw5BU8Zwl8pBYpY5x3iR9FkPG/o0dxbZ+UKaFiCanHxsf+VOOyAkKbk6IoqJCQa3d7dY7 9k0yChEoT3AHkT5JnDayXaCVYLQEOwtaHWHUsHt8igCuIa1dTrHC52jS6QO8caq0KR3ThrRUGdgI SZZLdeRoUiSoAMSwQUiABCRPKiXaBp5/NP8ABDVOjWu92TW0CYJJA5gBb2P03EY6TLgAHTBP+vK5 azOZ6ro9p1bJE6BW+m54DvSssLWH6D5mD+VLNGRjoapWIxEtdbewq6Vhkuexgl2pI8u5Um49leVs a39FaCCfDwVCvrgx2BnqseD+cQpt6g+w/TcCRyDAVAxya8W3i2wYdF2Y+VZlvcSG1N/Md4Dv81ct oa0e4iBy2ND+Kpsvy9wNgaatdpA1VXJyc5ri9tjG4zRNjyCS38dUeGRI1rskkAEkW2X4lYaS1oaO ZE8n71l9U3V4rgfziAPvUa/rCTc8uG2qfZ2dHnCnndQwMjCey5zdxBLCwOndGkiIU2MZIyAkLYp8 EgaNU8y6DMqDqm9pCkUir7QZVZWZR/NWkAdjr+VWW9ZyQf01TXjxHtP4KokkYg7hIkR1dBvVMN/0 2PrPl7h/BVb8m+wuZTYfSdzOgKAWg8hFDQ0QNEBEKMzSJuO3lxk+CK1oaIAgJ0pTlqpUXAHnsnJA EnsgPsLuNGpKZOtHDfhKjXU0mTwmaJ+COxjTykVBkwNBlo47ozDx4d1EbeOE+6DzoozqyCu6R9st dHHiqhrL3btdeAtBrxtG3VVb2kvkEj4FNj5UvkdO7M2O2gRxoquRmEsFTNANXHxKe201tMEydFVY zcZJ0CkjHqQxmR6Lm24DnQ9lEvJ5CMWCEN1ZHCdottcWtcAywaDQEchM6l0bmkOb4jt8VAghOCRq ElX3Vsd21+CUEc6KYLH8+x37w4+YTvN1fteZaeO+nkkqmABJgKexqg18GOxT7wknTh8WElNJUof5 ptr/AAKSKPZQB8FL03DUiAmDHnsVOHiA+Y7SkUgdwVBqfaExKUoIX0HCRKaU0pUq1EqJISJUUUKl JJIAucGjk8JKXTqwMMj6TvuTmirStmrzyfBJIa0SVNO6p1ejh80ySl2vc3gyPArSwetZmIRseS39 x2v3LMVmgt9H3QAHcnzTJgEai10JEHQ09K3qnSOrNFXUKg2w6B/Dh8HBVMz6qWgG3p1oyK+RWdHx 5disb02kyLJ0naG6kfxVnE6pl4w/RWOZWeC7X/NaoxikPklXhLZllkifnH1i1XtyMewsta6t45Dg QUevIOocJA1kK3i5Rzsnfdfsd++/3E/AJZWCXOc6h4s7bBDST5NT5DWjXmFkSasfYg+1sHAJUHZr hw0D8Uajo3ULRDanT3G0q3idCuseKzQ++7kiYY0ecf3ptYx1H2pvIehH0cl+Ve6IMT4BMRe4TY/a P5R/hyulZ0T7NaLMirYRwxmyPuJJKubunUVOssxbA1olznVQPjMBNOWA+WPF5LhikfmlTxpbSNDY XHyH95RacLIuP6vi22+cEj8AFtj6w4DbZwsMb3e1p5k9vbtWsf2hfj1Py3Gr1QZqI2sYe0kcz5oS zyiATDh8zr9iY4BI6SvyDzVHTbwPeCyz/Q0gbvm7X7lfr6Dbs9UYY3HgXlzz8TqPyLZqxsSp4Ac+ l2z3XVvDi6fOIgeEIF+bgU2uq+0B7x+feZPyB0UR5icvlDKMEI/NTXPRNtUW2mlo12sqDB8jqUcY 7WVRtLaxHtnWR+98UDd1XLtaaHV10N1bBFh+MeKvtwr9n6TIe9w8GNAn5hRzMjpKQ8l8REbRLVAs cCdug4bwtjEvx2Ma26gtMDUHcPmFQxahbe1lgIY389xBcY8I0QuqWvxcpjcZw3kHdXOpaDoROh4T ICMpmB10tdOVAHuXpKRj2NJo2PJ4HBB+CctLRFrJHkufGY8bXw1wmJBh2n5Fo43VLyxpafUadCx2 pB8JCU+XP6J+1McmmobpZWP5qdRr4yq+0GTBnvPf71ZqzMawQ8ei4+P0SfinuosLdzfe08EQq5xy idRTIJA7NZmRbW4bPDgjcI/qlXKuqvDffTOn5pgGOeVU9NsAWAjx/wB6c1gmGsc5m3SzdwfgkAL1 UT2TP6y5xmtrGfe4/P6IQX3tuO4s1PdoDR+Ck3Fq2gRr+KI3HrZqGwfElA10TqhrZaSNoPxGkfer dP2uQH7S3zPu/BLfW3RzhPknFzfzGk/1vaPxSFVumj2TKLiAJJAHmltscBudt8Q0fxKf02AzEnxO p/FFGnUsPUB+iC74cfek5jnHXj93gf7URMlSrrbRgK2jtHw0QcjAxMgRdUyzzcNfv5VmAoPsrrEv Ib8SAiOK9LvwQTpr+LjZH1Xw360udSfD6Tfx1WQfqz1HEY4MDcgbnOHpmD7jP0XQunu6pg1CTYHH wH96z7frC1xLcesPPaTz+RWsZ5jtY/rMExh8Po89bRbUYvYWnnadB/tQyYHmt+3LyLd4teHMd+Zt EBYWQ307nN5EyPmrIEquVDyYCR+jaF090C0u+zv05JPyB/2ItlrZ2g7n9gP4+CfaAwN50ARtBChq FCYs/rD8QnrkM2/u+37lFxixhPBkfPlJQVrCHaRBB4RXQgWAucGj87n4IhBci/HNbtTLnDdr2koW 0j/Yr2RUbcm0tMBoDhI8PaAq5tAcW2CD37j+9TA6MBGqHe9vcj4q/g5GYQ5rHywD6J1+5VvYT7TP wP8AAq3j1NxWuy3w5zDtoYdA5/O4+IamyqtQujxXoXWbd1OpjTcHVVwC6x8BrQdfd/cqGf1v12nH pBbSDo52hd4ucP8AWFnX5GXcSb7XvkzDiSJQg13JE/BMjhG8gL8F5zHaJP1bTXO+ITyD8FUOnEtU /UeBo6finGHZAmlcwE+CgWeY+agciAQW6hCLnPOv3IgS7oJj2SyJgHhKR21UWsLRJGiZ1gA05T1h ZkmR2RZPfVVhZJE8DlENwDZGp8EqQlUX2NboTr4BB9Ww94+CaO5RQu6xzueOwTASUw1U28z+KSmY gBPOk8KM9h96jKCUm8d9VIWj4IMyQ0cnhG+zv2zImNAhIgbrognZK27uIJ+KTrHn8wfeqYsAMPGv giC2rgAJpHgviL/SARXvL3xERpCduggKGm/5onthPulnDZ3CtxHKW7RJN+KVhRgfNiRJUODCIQou CKKYqbLHNG36Te7TwoJ0FXSnxu9ohp4HKjqpRIg/JNCSnUeGMG53HwSqdiOaXWP2fyQ3cfygKBsa QQdQVVc4MPJgqCMbGu7ey5eE+nhryb1lmPoKS5sfSc8D8AFQueXPJJnsCpOIOo0lAc5SQjTVyZZS 3XlIlR1KUOT2JfckSmDUoCSlEpoKmGOJgNJPgApOx72jcWOA8YRUjDSdFJocx25phw7ptfFLU8pK ZOc92rnEomMT6k8D8qEAiskEGE2WyRuG5LHCDrPZBsxQdWGPJEaCQCOFMKKzHZmoHcNBzXNMOEFW 8Jge128AtnSddUVzGvEOEhPRWKxtDoBdI+B5TuMEHut4CD4NhlbQ9rmgNMjUalZ2e6L3N0hvkPwW oH7TPh/BZXUWk5Lo1B9zSO4PCjw3xm+zJmrgFd0ButAADvu0V3p3Vr8GyayPMHv81VbRZuBcNrR3 doPxU4qZq332dnxoPgO6sEWKLXEiDYevq+uO+kVWEUud9J5G4tb/ACR3PgrmJdjln6G9+PjuJd6N jXkv/lOsaBz4SuDqqe97yPdDdxKt4PWMzCfDbXAD80lV8nLxIqApsQzkfNq+gU5OPW0bXY7R22v2 H/piVl9T6p61NmNk0OLHyPTxyLNw7bnjRZLutZvVQ2m+01YZMFkgOsI7buYXQ9M+r2J6TbGe6wCQ 1ogN/td1Wljji9UzrfRsRnLJpEadS8MMLPxbBkNpcwVuDmk6xBkSF07OsdQzsdj2Z7tzwN9OPXqD 4H2wPvXRN6JWRJsAB4LjKVH1cxKLm3VZJYQfcxgAa74tSnzMJ7jWOxTDBwWOLQ9Hl8jDtDGtuZa5 t5itjtbbXeTWkafcFYw+h2UuFtvSy9w+j+kraR/Z8fmuivwbndUxsmiH0VsfXYWn3NLoIdB7aQYQ bOr4Atdji0Pta7a6p5DTI8d6jlnnQERuLOpZI4IyPzX56I252JS5lOTXZgWOMMbe0Bp+DgSETMfj 1VbrHOe2yWt2AuJPltVC85uW91WNjWXbSHNLWk1gn93d7fmj1fV7r1u28luLYwRscd4dPMtGjdPB MFHU+nzO7P7EANcgvwDU9Z7mkV4WQ9vdzgxn3S9pWbkVsseLMl97HtBa11rWhjG+Bcz+9dAasjGs bTkV+m4jV7T7SSgOvrJdVewPH0SHDT4cJ0M3CdIiutFkj8PMxYPF2cjHq95iya4JD6vc0ACdSdP4 olOY1jWWvMh3taJ2uDj+XhaFNOGyoV1tAcG7QR9KJnRBsw6LNHgWahzXgBpBHEt4U0c+KW5IYMvI 8zEHhgD3rdt49lrmE/SIOkxMEA6xyrNN76z7S6s+HA+7hZ+Jj100Prp99e8wNfmDu41Vj7U5nttY HA6ABw3f5oTjOHmGAYZ1qOEt8dRc8hr2BzZIL2jXTyVhtmK5sMsAP7pkOn+qsP1AHFrZgztYSRrz yJR2OO2SQAOwA0UZwwn8oIZDI49JH7P4uk/ewzsJHjx+UqJvaGyKdzu0kQq9eZcCA2zc0csP9/Ks NzMF/wBM+meNdQTMchRS5aY2FqHMRO5pCMkNJN7C2T9CsEgfHQBHBss99YG06ayD/mqf2rGaYaHP +AIH4rJyOrXMc4slkGDWABp4zqjHlckv0eHzRLPj7n9jsgWNAIJb4+CkcupjZssaY0O0zr8BK5mz OyLCZceNQTuI+9FxmO9I2l26Q4wfHx+7spockOs/sYJ8wQa4XYt65hVgFpL54jhUbPrG5x/QVjgw XeXisihhtjyLnf7E1rBWfbr7T8dVNHlcQ6X5sRzzPWm5f1nOskCyB/J05PyVN92SXH1HnWdD3CfH hrwXfR/2JribXAN1gcxzrKlEIjYAfRYZSO5LBjfVMfPTyUhWK7g0ay4J2VXA+xhD/gjVYt7rA8tJ 92oGp5RJA3KACWwVjZr2vyC0GR3IPYBbz6gwTY5tY77jr9wlVco9H2y2kvsiN7fYopTugAZeTIId yA4wY1ohoAHgE7vBOmd9JJSP6Nnk78oTOa1wLXcKT27hHfsfAhRa7c2TzwR5hEIRljhy9xA+H5VD 6O5w7DT4lEcdFXyHhlOn0jwPM/RTgFsi0sizZbDTBc0NcfAcqrft9V22SJ5PK0baGtprAAL5kkjk 91mWO3WOdESSYUoYSqut1j21sEueQ1o8yrOZkEWNppd+hoHps7gkfSd8yo0/oKnZB0c6WVfH85w+ AVZLcp2CUXkct+4x/sU/VpcB2PmI/FqAmSoIttgu7GR8nD8NVKuo3bg2ou2iXen2HmFSEjUc+KsY 3UMvFfvpsLSRBmDI+aVdkghayqpupJHkRqh7wBDRHmrOf1O3OFfqMa17JlzREz4wqrdvfQpAd1Gu ii4k66qB5nxTlyYlELWY8kgmYeUi4SiplACYkdyoucT5KJlK1JhET4pF0IbXdk6VqZtD3ajTzKZ1 VnjKbg6Jw947oKVU0teHHSFZF7ogoIs7EIgtrY0k/IEcpsha6JIQ3HdYNurkSuh490kHyMKOM0Fx e75K0HgISJGgXRAJstS2pzQXEz8eUMNeBuEwjZDvUsbW3tyj7G7YCXEQBauGyaaQefinD5PBn71Y dWBqNPBDdU4D26fBGwipDZYDxIHxKR2jSZQyxw5E/gpV6Ek9uEdEcRG6ntnWIKhqOUQu1UCdZRQV uUt3mkQDqNPJN7kkNoCxkbxtnxSe9g4EnxVjJaw1epJ3g6jkNHhKpiwkwBp3UcTerLIUqy0ugRqO Uq8XIsG6ql7we7Wkj71bwL6cbJbdbSzIYOWWCQu96Z1Pp3UKRRjllRA/o8Bsf1QhkymAsR4kwxCe 8q8Hz1vTc53Nez+sYRWdHtP07Gt8gCf7l3uT0Jj5cx0fJVD0Gtp9xJ+CbHmYHdceWkNnla+k4zdX lz/nA/BW6cSln81SJ8Yk/iukr6biV67ZPnCsMZW36DAPgkeaHSKhyx6l50dKy8g7m1EH946I9fQM iQLXAT4aroGssdwD8kUY1kS+Gt7lxAH4qM8zM7aMg5eA31eet+qnTranB24XHixukH+r3WBmfVjq eKSW1+vWOH16mPNvK6TrvWq8BrRhXY+TY4wWteXFvmQ0R/0lzOV1vqmSNr7zW392slo/Kn4zlOpO h7rMgxDStR2c/bBgiCOQpBMSJkmSeUt4HAU1EsCao9kaAOTHxVPe7tom1cfE+CaYX1pcJ+Fts3Ut /On4KJzGj6LZ+OinjdF6tlH9BiWvB4dtIH3ugLWxvqH1y6Db6WO3uXu3H7mSmk4o/NIfavHuy2i4 rMpzrGh0Bp0KjZdZ7qy925vuY4E6juF2WL/i7oA/WstzzMxW0N/6TpW5ifVjo2IBtx22Pb+faA93 3kKCfO44/IDPyZI8tMj1UHyynGy8kn0arLnE/mgu/ItjF+qH1hyAD9lNQ8bXBn4HX8F6dXWytuyt oY3s1ogfcEQV2HhpKZLn5HaIHnqvHKRG5JeK6f8AUPKr1yspgY4Q9lbS4nWeTC06PqP0VjWi/wBT J28bztH/AEIXUNxrDzAUxi+LvuUEuZyn9KvLRlGDGP0R9XIZ0rpuIG/Z8StmsF7WguDfInVXKwwg MY0wOBBCvtoY3tPxRAAO0KIyJ3JPmy6AUA54xHOM7T80RuAJkwCe/KukApkEIWYdbB315S+xYvqe oaWGw/nloLvvKOnSVbECNAE8SnhIhKkWiuxqbm7bWB48CJWHm/VWlxc/DIY4mSx43A/PkLoQEtEQ SNmTHmyYzcJU8Dk4eRiWbMms0u/MePo/I8JzsFo2GS4Avj818awu6tpZa0se0OaeQRIWN1H6uCxr nYbhU92u0j2k/LhLQ7t/H8REjEZBw9yOry2b1/Axv0FlJutHgQA2fMlZFvXbdx+z1NqnhziXH8No Vfq3SOs9OyXv6jQ5jXmRa33Vn+0FSDgVo48MIxBHq033cfmOZlLJPhuAJNDbRtu611SZNwcPAtb/ AHLQwPrDU5oZmPfVYB9NoBa78JCxoUHtAHgTopAI/usHuZK+bTxdPL+sV1jbBQ13owGucBDxPi9m i1Pqzl5N7nMyWXFjQDWbANCZH0oG75rlGX24z91Fhr8QDofiF2v1bvsycdl1wix0y0aAgcOhP4QA s92ROtH6NtmVfVSHnV4scyXeBcDr+RUr9r8mzdAiwh3wnn+C0R04+q9zzu2vLw0fne76KqHGddZZ ZXqwvcRMj8OUJEfUJ4e2xa+VsA0ieNI481bxmO+xREmHafekzpW6S4kh3ECB+Kt49bK8YMte0ASH CIMzqmnJG9Dfku4CRr0P4OOyrIB/RsdMGRHjr/BGbgZD9XiZiQNT5rSdkYtYAaC+NBPH4qvb1G0g hjQ0filxyOwrzRwRG5YV9Mlgc/2j4iPDlP6eBU0hzpJgEM1OhnlVLcncf0j5PhyUF1p/Nade50S4 ZHc/YriiNg3nZtDAG01CG6DeZ/BVruoXFsOs2NP5rdPyKs8Pd9J0eTdFHaG8CERAdkGZRXZzGPDN rnWO0Hb8qqOz7nv9MAMEwfFSyay68vJgVlpU/QrY8uAkkzJ80wyPFS8AcNnUrymP0k/cJikhi4hr S48ASUOsEM930jJPz1T2e94r7Nhz/wCAScYBRQje7uqrzuug8V6n+sUWy5gIEz8AT+RVWXVw4kwS 8zOifEMcinvMbfIT9wWdiY32iw7jsqYN91n7rRz8zwFdtsFrvTp/SPeC1rW6kkqvlWMx8cYNLg87 t+RYOC8CAwHu1v5U/wAAtrqdggyb/WslrdlbRtrZ4NCCdEpKXknLSbUlqkkkpSUJ0kkLJjwnTJKU kEiFMN0lJTAEjhPoWg9xynLPBRIIPxSUskkUklKmETlDUqzOiSmUSpBiUJawglmGwh2uJIYEtxAU Wzu3FIDqq0zfaAAn3QCfBQ3JEgiJ5QpNrUzJeeSj7/FV2O2aEogePFCQ1TEpA+XSe3CfcChAqbW+ KBCRIstrTygWe0kDRWGDufkq1xl5SjuqWzAlRntCc6hJv0tVIxriueU+z4qRcQm3Iapbhc11HpyA TMz5Ks2G6Qk2l5t2Tr+RJ7driPBNAA0vdfIk0a2ZjRTZY5jg5hLSOCNIQmnseFLj4HshSr7PRdO+ t+VjNa2+sWAcuBhzh/KnQ/FdLV9Y/q/fQLXZYqcfpVP0cD815v6kcD71Bzy4yYTJcvCWp08mQcxK Om73+R9aug1H2F139UE/3D8VSt+vOIwRRin5x/5kuNk9ymRHL4x0vzWnmJnq9Fl/XTqVw20gUeY1 P934LGyeo5uUZyLn2T2c4kfdwqySkEIjYUxmcjuWW4ppTJJy1u9M6bd1LJGNS9jHETusO0fxXUYv +LwQDl5v9mpv/fn/ANy5jo9hZmAAxuB+8ar0XoOVdks9O+wbmxtJ5IVbmZ5Yi4Gh+La5eGOXzDVr 4v1K6BQBvqdkO8bXk/g2AtfH6fgYoAx8eqqONrAD98Sr7MVmmpKM2itvDQs+WTJLeRLbjCI2ADUa 1zuASitx7D2j4qyAApCExegbi/vH7lNuPWO0/FFhKEkKbWxvAATwmCeeyClfFSTRIShGlLpQkE6S rWTpQklSF4TQnEp0aVbFOD4p4ShKkLQlCdOlSrWShPCUI0phZTXawssaHsdo5rhII8wVynWv8XvT MzdbgH7DedYaJqJ829vkuuhM57G/SKkgckT6bCyQiRUnxbq/1b630hx+1VuFI0beyXMPz7fNZ1eL nXmKq7LD2hp/uXt+ZbiWVOruY21h5a8Ag/IrlsjqPRsW11TMdxe120hjQ1rSf5Xz7K7DLOtYa+DW lhjek6Dw1fQsyzKqqyAMV159rrPok+AjuV3fT+lnDpa02mWtALjHYR3VXqgr6hjmksFZ+lXYPpNc OCCqmB1S/JpdXm2EZOO707gTEkcOjzTiJyG/D4BEfbiTpxeJd2y/ErGr95Hbn/Yqn28Me5rGex5k T49+FSdeDOxpd4HgfihRcWRuAI1BGpn4lD2gd7PmuGX6A9m67Kt2wX7WjTwVT7TWHuAl866a6/Hh DaA8AulxHZxmCmfDS1xHt1B8pToxFIMjZG7N11h+i0NHidT+CG4Od9Nxd5cD7gppk+gx2WG1o0Ah IhSKiUkLFQcpkKJCSWk8S6wcz/BLcCxrj4akqnkdQc2+9jGa1h3uPeCOyrDLL6qzYSZ3Dy58AouA mVr+MCNbukLWFwa07j5KO8uJDTAGhPeUKlp2uf8AR09pdpz8VL1sesBoJsMahn95SlQNDVUSSLOj L2sED5nxKBe9vpuLjtYOT3+STslpP82I7DcXH8ICE65x+lTUQOA4OP8A35EeSjtuidc0fQE+ACTM S50uvimgndvs0E+Q5PyCn9ryWH9Eytkd2MaD95lV8iy6077C57hqC4ynDi8AsqI8Wd99WPS5uG0t 3Da+92j3A8ho/NH4rNVi9zjWC7SToFXUkRQWSNlcNJ4SLSBqIUmEKw3HusaBEN7EokgboAJ2aik2 t7zDAT8Fer6fW3V5Lz5aBWWVtYIaA0eSYcg6MgxE76OYcS9oktn4aqLKLbDDWn4nRa0BJN9w9l3t Du5j8S9v5sjy1QS0jQ6fFbKHZTVZ9JoKIyd0HEOhckGTCPt0R3YFcywkeR1Cg7HtZ2keSdxg7LDC Q6IoUXMkQiazAaZUtjhDi2fIpcS3hLXtq9MMJcCXiSBOmvBQ1cyPTNQk+4cA8qqGk8aog2ojXRjC JS0bxILhOoHMKTajydEYENbAEDufFIy7JEWJaQUylE/NRJ0IH3oWkxRW9mjuphoAhM7bIdyR9yed 3CK1YgJoUtvflPASUjITbR4om1LalaqYAlp0Oil61jdCJTObonIlgd34KOh3UyGUO4hCJmSmISQo DZRJO6km/SSCbuihmSYTfIJeSUFJTdq2M3AaGUO4Av07pnNcNT27prGkCVGBrbKTpTBSakPcPMJh o5OKwMXCHFJO/kJk4HRBGqkkkkkKSSSSUpJJJJSfCfsyqnfyhPz0XZYd1tTBZXqW/Sb4geC4dpLX B3cGfuXX4mQA0Sfa6CD4So8gB3ZcRI26PZdL6s29jQ4zPdawcCJXn9NtlFzrKDMGXM7OH8Cuk6T1 llzIJOmjgeQqOblyPVEaNzHmEtDu7ycFQre14BB0RIVama1wnhRhTElKlLQnCeE8I0hYJwlBTwlS lQlCQUoSpFrQlCfakAjSLWhJShI7QNTCIiT0Rxd1BKJUTawBCflAcKQYJnpS0zj3TxCYlo5KqOyL HfRk+fAQX3j854nwGqljy3crTlbzshjfNAszY8vBUXZA7Au/rHT7gszrHUOo0VBmDSX2P/PEBrR8 zypo8vEdPtYjmPd2n5Vh8h4kwFVsyCZG6fguRr6V17qFm/OvdVX3AMu+X5oXRMrfWxlbSAytoGpL jAEauUoxgdvoxynextBm4ll5dY7JubXtMVMIbqB+9ErCxsX0yXbd0ncDYdx+fmtt2RblQ3Csr2V/ 0guaS6HagNAgajxWd+aEaFo4ixd6jtHPOv7vtH4arNDW4/XRt0blUmR/KYf7lpkLN6mNmb064ci0 1n4PCIWl0CmKcpkkowIc49na/PunI5BSedo3Htz8EoTQdwuNkAsB7DsOrT9H+5OU7mhwg8FRbOrX cjg+IRtR116qhNCnCiUEUtCipFQJhBLgPqZ9pyHO/SOfPtbxBcNJ8UVlGSKtoDcfX6Jhhg+Zkp6r KiHmgHdrvs4dJOo8ghkVgEH3O5gH5cqMkksgiAAqzHewb7BzoHjUH+0oAB4+Gm3gBSZkHHEzLjoa +Q7yI8FG4OD2WVEMqtGgidpHLfkUhfVBrouI7aAjumdE+IUA28k+8A/BMWXTyDPgE6vFF+Cnc+Sg 5vtM6I7MW5wncPu/2qbMQ/4Z0gaxwEuMDqrgJ6NB+NbbUzbyNYKevpp5td8mq7bVuLQDAbOqk1sC CSfMp3Ga0KhjF6hDXj1V/QaAfHuigeadJMsndeABsrsmjROmlJSyYpymRUVEpj4p0ySFkkkklLEA 6HVQvqFrGM0ZsEAtEE/1vFEhNCV0ghpW4TokHd+VCDbGcggeHh960iokA8iU4TPVYcY6NH1CJkSO JTh88f6/3Ky6hjvJCfifun7kRIIMZDxQveY2g/3KAU3U2N51+OiJZkj0G1ClrC3l2p3HxM/wTvJa fHRAT8kw3HQaBR8yluPZGlttvFwsnIkUML9upjRPbi5FP89TZUDwXtIB+a0ejdfoxG+nmVFzR9B1 Ybp8W91t3/XDpNdEUtttc7kEAffukfgoJ5MolQx8Q8CzwhiMbM6Lx5EnxHiExCu5WbX1O2y70RVb oGNrAawNHjHJVQssa2S3fHhqFKL66HsxSFHQ2EfJ01hOfvlN6gP0gZ+78E42+KKKYPAjRQRi0x5I JH4IhBCuyYcpJIoXSSS+aSm4XSPihySyEVzdklsbedpTN2xBEOM6HzUY8GUoWcp+/mE3BTn6SKxV g0BUEQ6sKEjFR3XTJJJy1dJMkkpSdMkkpcrqOkBt+KwO52jUciNFy66D6vWE1bfAkfxTZjRfjOpd Ab6LIcND+TxUnXWVXC6l0Oj5H+sEe1rXhu4d4nwlVLaXVnXVvimdKX3rfV6jovWRa0Sdrxo6snUL o6bW2AEGV51SHFrXNJbYz6DhyP8AYt/o/Wjv9G47bR27OHi1Vs3L/pBsYs16Hd6wBOEDHyGWtBCs AKrw0z2pSTAJ9IRESdkEhUJ4Tb2gKDrwPJSRwyPRackR1SBLjuq7snw1+CYvsPAj4p45cdTSw5ew bBsaFB14VV9rB9J+vg3lCdlMH0WyfFyljhj2JY5ZT3AbTryZgz8FAvcD7iGjzKpHMe+QHgAchvCC 65upJLyOY1Uwx+QYzk+rcsyaW9y8+A0CG7IfPtAb58n7yq++dQO2kqpdlA2OZRZ6rgP5saaAwXaa n70+OOyANbWSyEAk6Adm8+0k/pHSfAn+Cr5GbRjsNlr2VMH59jgwfjqq7bHbSH2MY+DtAcPpRpp3 1WUzoV/U7wOs3RWyfTEF2+edu3g6KScODcxGiyE+PYE9nQz+uYOPjOtquGTbtmumvTdP8rWEPoPU cjqGNZkZWO3GcH7WDXVsTO5/KDlYXSultZnvbva2GMrguY7SBua7XtyrXTuqM6gfUFAqaZ4BABHb XTz+CiM4jh3PF16MgiTe1x6N4vESBPn2+9UGnqOUHuL/ALHWHua1jWgvc1pjeXvkCfgr7ySGwSIM +E/eoemdSxwbvMkjVOWuVkUU52E7Ewcl9NtTg91tZglxHtL4jdKwel9XvttGJk62Q4NfwSWcj7l1 WLfj2+rXS0tcx36QxElw/LouOzKxX9ZcMtG31G+6O59zUiFAu1YTtJ7jgKh1Hc7M6dU4yTcXn+y1 aRYD8lnZn/LHT54i0D4wham+Qm+KkkQgli5oc0g8HRRr1YCeeCpobfa9zex9w+fKad7ZI6xI7M4Q 3aOafiP4ohQ7NAHfukH5d0SiO65USU5USghYlDefaT4BSJQchwFLyf3SkdlDdxLqrarLxEECA4ck SIKFWcnf7zAd7Tp8lo+rdtLvdDWtbB17cwfEITS95LnAOJ4BZ/dCjE97pkMdqJa1WPPuadznD6R7 HzlXasN9nT7C8bnU3Ag+ThB/IFNvqBwLK69p1ks7/MowfeOW1be4DY/JCZOZO1DVdGAG7Wbjgc6T wjsrYBHMeP4IvqsIAfRt8TW6D9zpThjHjfS7dGpB0cP6zf7kwyPVkEQ1ct4qp3M8R8NVVbksf9P2 n7wi9Rc0VtaDu90ys9WMMAYWWDNMxlQb8AiR/sTELOrtsa72Hk+PirAzNrttoE+IKccZG2q0ZQd9 GxBTFJtlb/ouBPgdCnI7d0yq3ZLB2Wn/AHplJMUVMUk6ZJCkydLlJTEpJymKSloTJ4SSQt3SSSKK lkikl3SUsdUKzGqfyI+CKUkggi92lZhuH0Du8uEE1uaYIIKu3XtrEaE+Cqute/6XHgpASd2OQiNm HkNU5hp058VEvI4SDzOqKxPjWMrlr5G46uHgrQyKYgOlZ4M+aROqaY3uvjMhtX0ssO5ronkcqmZB gHQKYKWxpRGmi2Rtix0TJ0SdB1RKnV1u97Q5pEGe3mEOwbXQNR2KKK0u1iExCaZS0KKGQ4SlKIJC eElOi4AgN/e5+ATOZu0iR4IpaDaf5Lfyqe0RA+ar3VNmrtzXt2PLTwkeAUfNZDg4dwgNgs+ClBsW xEakMmahChEboYUHiHFGO607MUkkk5arRLRJJJStE4BcQAJJ0ATKdFVtlkVCXNBd8m6lI7JAspWY 4H0z8gtTozmssLW6ag/wWe2xto0EWdx4ouNkHHt3xPZwUJJJ1bYhER0D1TtGz4EJrBNTh5aIWPk1 ZdO6szI1CO3VuvcIhgI1Q4p9jh5/6+SK9ocW8g8scJkHxH+xV6NzXkDsDI4mPBWQQQHDgHXxHbX/ AGlOidKRLe3X6P1d7Xii8xc0c8B4Hcf3LomZ7C0SYXD2Na5vcFplrxpB8QdAhhuXYzffk2Wn81ph jR/ZbymHDG7ZBnNUXvW51bj7Xbo8NVP1XuHtafnouc6SMrGrbYYawjdt7wtd2Xc7g7R5JcB2ACjM dS23Czl7gwIbrsdvcvPlr+VZ9tlsy0B08ucTogkvcZssOnLWaDX4SfxThiJ6k+Sw5QOw83Qt6gxg 5bWPMyUJ+SXQSXOkSOwj5rJy+qdNwXxcYtcN2yJcQe/+pWZj9b+sWVkOfj49bMZrXbDt5IB2y95n Up/Bw/orTO/0no7LXtYXuLamDl7iAPvdAUa2stYLPUFjH6gg7gR5dlzjel9V+sbpz3BoqkelIDh8 G+B8Vv4OKMPGZh1kBtDdoBO5w76jRK9avUK6XWjYDWDQN+/VV8jqWJjv9Nz3PtGpqqa6x33MBj5o z2gAE7nkkD7+8aIOPRRjPtDGgNtcbHESXOceZ/gkhq4bMi3OszH+pVU9payiwAGTB3Ha4/IHhBu6 fhtzLbnOLrLBrRWS0OgwdGxOvKt+jc7OGSLXCkCPSIGpIga+AUHV4leU61kHKIILQDqfpEDz8YS2 2VvuqvpfTfa92JUH6ESwSD9yuaP/AEZbII1kwFGv1XMBc3aTyEQFjNrHOAc7UN8fgl3UN9Gvl2VU 0usvbvrHuLAJ1Hx+9ZbevVPyBXTXtj2wNTI1Gq3HtDg5pAPeCqjv2XhMLnenSHTJ0B18+UwCPDKJ +i88XFGQ+qcNsdabN81vbAZHCeqtlbQxujR4mVQw7jZkNfjNc+qwE2WEwwR/Eq9vre7YHmT4acJY pcUbrwVkFGrRUZbL7La2Mc01Ebtwga/x0XGdW0+sXTz46f8ASK6q7NzWMv8As+GXvqI2hxgOBmYn kwFxuXmfbetYT21urfU8tsa7sd0p62npSs3qWmf01w/0rm/e1aMrN6j/AMo9NB49R5+YampLoeaZ IlRlBK6hbI2vAktOo8QeVJMdQQgRYXRNFTXte3c0yD3UbI2OnwKia2k7mksd3Lf4jhRYXhzg924c AxHx4QBXEDcLh2g+ATEqI09nh9H4JEorDusSgZLgKXk8RwjEoNo3N2+JhI7FQ3DUsexuUQP5p9bC Br2ADvyoo2ja0EEEewzGnzUntJqaWkHIoBAB19hPf4cITbS79FkN2k8btW7h+78VWu9m1VblsBgc C3QTqIdKcMceHNM+Dhx3VVzqaXgiGvHDWEyQfEBSdbeCdrd7HiQXQOTqEOA9/tTxjt9jYLCNdpd8 NQoOe1rwdpHkDrohb3NOtZPm0g6/Iyp1ZZsMMtnsWv1/6tDglvurjifBp9TtDxXJ3kTJiHfPxVAl XeqOrNjAwAEA7i3ifKZVF30T8FcwD9WGpn/nCiaN3tA1J0KmCGkROk6eEqLQCIAO4H6Xl8FL9Hxq 5vE9wZ+KkYlFgDZrcYHJdoD8lKnMsb7SZA7chMQWgOB9o7PQZbyJ+CCgSNnRZk0u0nafvCLyJGo8 Rqs3ZNfqccwfh/vUWX21mQfh2TTAdCyDKerpkHQplWrzwf5wT58H8EdttT/oujyOiYYkLxOJ6rpK REcqMILlkxUiExRQsl2STJKUmhOkQQYcI7iUlLJinJAEkwPFVbswDSvU+PZIAlBIG7Yc9jBLjCp3 ZZdpXIHj3KEfVsO4yfMp7QaxsGm6CTzKkEKYzkvZiXSUxSbCR5hFZbEwklwloipf4J4UdVKSgpUF OAQdU09in7aapKXTjYdHMkdjMIclOHdklMnUs7Ej8VH0oIMz8lJr3DnUeCd9gjT5JWVUxtIPAgqE pFzjqm3I0h2W/wA4/wCI/AKYBOkITr6Ra1wa8/mukR8PFGfkVAhlbQ537o/jKqm9NG4AO7Wza/0e 7mDqqTAePFadjXWMIf4SGjiVngDdPfuFJA6EFhyD1Ws06jxCjaNQVJwhxT26sB8E8brK0KFJJJPW qSSSSUpFxbfSuDw81nUbwJidOEJJJQNNizGyapssAa06tcXAbvNuuqnXYLOdH9vAqmptlNlHRlx5 KPg6ONlWYlm9vE+5v8V0WFlV5FQcwy6NR8FyldwcA2z5OVmi6/DsD2HTuOxUY00ZZR4hYehZDckj xJ/H5otrJaXN0I7fBUqMtmQW3tPMT4yOZWg506dz9/8AFGPVilpTJjgSHCQ7w7/xP4J6tG7eNTP+ o1UPpQQfdA4/j4/elU5xLmu5BmBwPxhPBWEO1jZdIoroc6bS2NoBJGpAlXwdB8FgO63h9KwmW3sc 8vsLB6YHhOp0Wvg5dGZi15FDt1bhoe+nYooaXUOs0Y2TXi5DfTa/6FjuIj6Q8ddIUGZoDZqxcjIG sPDQznwFjmn8ETOy6cbKqrdSbHvMMdydTGnhCtUtLHOe5+4u7DgKSGUxFRWTxRmbl0GzTf09nU31 Zd+M/HfV7Q22CSGmQHBruNVo+rhMrZW+n0LKxDA2S0gd2/6ym9RzgQ0R2lL0WvZstl/hqdI4Px81 Fk4p6g+rp2ZMfDHSvS5/Vsfq12XQ/p9zK2VgkE6kO8YAMiFcodaby/KLftpY1j3NEMeBJBA7FVOo N6izH9OizcWEktb7S5vbjuqWHj9TY5hvIrttcPMxPJ581DIGUI5D6ckZAGu/X6MkTUzD5oEW7z3t Nnol8vIktOgj5f3pqrC7cw1msNMAHghQ+00uynU7S2xnBI5B8CikgHVTjzYz5NbIxr35lWQ23bUz R9ccjiJ8NUgzBbmC0wMpw2zJ7iY8JhQyK35F9Vldjq21kbxGhDTx5T3SubgtzanW6XztY4D96YBP nCSG+SPn4Kvl4rclgkFr2GWPPY/BVnnLuc6oksbJG2rQ89yVfrrNdTGAH2gCXGSkkigDerSsxup3 OcyzIZSxxhpqaXO2jke9Rr6Vgtv+0OZ6l86veSfubwFesadm7Ulnujjjn8E7Nu5wHcggDwIUdATX 2TBE5kWEEQy1up41H+xNW3Hn0q+/Ib5ImVAoc58NDPdr5IIya7GOrxqja4aFv0Wz8UhKMSRe+quE yAPbRrW035llmPa19GOwg7q3Ab9T7SdTHdY7+mYdOa/J2Ftu5ztSYBJ5AW852Yw/p7asVh57kDyK odV+sHQ2Vmls5twEQwFrZ/rnj5JssougLXxxEhrNtY/6OsKl1eux2OzIpG63FeLmt8QPpD7lHE6j S72vb6LnHQTLfvV1yfE2slEjcUwoyK8mll1Zllgkf3fJPKzao6fn/Z+MbLJdT/Jf+c35rRlEoDKV ElIlQJQUvMa+KiO48ynnsgWX11e5zojQph0LINQRszcCYI5HCaZEqnb1bCY3cXkzwADKk6zNNfre m3GpdqLL3c+YY2Sn0ei29KPRslVMrJorbDrWsPcTr9wkqvkhzsivGNz7rbQCG6VV+4SNQSfvVG3O BxX0AMpGg2VsBL9ddzzqlwXoVvEBqEz+r01keg0vLSSCdBr491ebbXkUtuboHgEs/dcOy5pbnTbC 3DZ3LjHwDTz+Kjy4oxiDHdkxZDKRB2blYJaQ1uw8EkfiiCmse2yxsEyJPBPkEJ23QTE61uT7GHR4 2k8+HzCrEE9abQodLKUVY7TBsaCPBju3xVfJpxgRYw6cPADgSPKRCLAEeqQ0jUP/AHmjn5qsDkZI cWRXT2tfyR22tRgDd8R0RKq+UeDRzfT9c+k7eyBBgj5aqu8+0ol4DbXAEkDu7lCsPs+avw+UNDJ8 xY1tkggkRyRqnLWh3M8Q4BM0DkFzRwSPFPpuLWzM/mjQhFaycXMBJ1afH6SCABqCivc5o2vgB3fQ nVDAA+aSmerW7uQeQmeXOEO0DeAm3RoIPc/JJ9nqn3OJPaeEkLGvTlM15boPmmIcO6cOJMd/FJSd mXZUI7eHZHZl1PEH2/iFROohxgqMEc8oGIK8TI6uqCHCWmR5JLMbbY06HVWast7vpAOjmeU0w7Lx kHVswrOD0zN6g/ZjVlwH0nnRg+LjoqjLqyR2PgeF0WF9ba6PSxszGbsBDW+gdkz+8z6JUUxMD0iy yQMTuadXpn1Qw8PbfmO+0XN128Vg/lKXXc3o9jPRyKxe9v0Q3Qj5jhY/VfrHlWNcWkY9DeADr8Fz GR1K62W1ksYTq8/SMpsMEieKZ+gTPNGIqA+pQZlxsve1mlYcdjedJ8VGuqs/TcWu7AiW/ONUwa2P bz490ocOCrYAAakjZttg2FoBYLGDgtM/7lQuO6yAIA4B7Ird53bZBaJMcwq5MnmUigBkNfgkdCnb HyTE/eEEqKZPylpykpYFPKb8il28QkpWkJfBR7p/yJKUSe6bVSgQpVV+o7b3PCR0SxnTVMUZ9D6i Nw9pKZ1BfYGUtLiew8UAQkwO34IIHcok1fu/iVcb0LqJEhgE9pT/APN/qX7rfvTfdh++PtX+xl/c l9jZfQQ1oc8wXASTA+4JzgcA6jsQB/1Snc07N7Y9pBj8qK2WgQdwInxVcylVgtgRjsQ1jh3tP6Oz aPBxlULGuruIPIWyH2Hs0RrJA/uWZna3FxMk6p+OUiaLHliKsIH6kOCf6VfyUA6DxoeVNukjspWI dUCSciCUyeFikkkSrHuuIFTHOnuBp96SkaZadHQ7nwbHAA/u6/iVX6lhfY8gVCYLQ7XXlKwqi1FJ swoqbNWnyQOyY7rjRWabwBss1b49wqsxwna6f7k0iwywmYl0GWWYzxZWZa7kdnBb+FnVZVY2mCNC D2K5eq8s0PuYeQjtc+h7b6HfDw+BTNtCyyAkLH2PVsiAHGANP9f9yZzZtEff8PjCp9NzWZNZ1Isn VpOs/errTDxHnMc/gn2wEU3cKinLovxspgsYY3A6zpyPBY/RrndH+sZ6TvLqbpaWkQJjdW7nmNCt vpjovc0/nN+ei576yfq31swckab/AEifk7aU4LOvm9Xn5OPjAOvaXbiYPYRHA8Sp012l+8mKoljT zx3lLMyqsZnqWAEExqYAOp1PbhEx8hl1DLho2wbmg8wUlJWtEhCqyq7LX1QWPrMEO0nwIU/VaTDe fDv9yx+uZj6bKa2UOffcDtsDtoa0c7oBlImheyYizW/Z1ci+usteXCWnUTrBWSOrC/Nd9kpdlvrk AN0aDxJJgaIRxmnBcyvc22wRZY5xJDnaR8fLsj9D+r7OlPstFrrbLQGukQ2AZ0GpUMLnOROgFUGW fDCIA1Juy0cvrmXj9UqoyqZsaWxVUZ+lxuf4eQWr185AwxXi5H2a17w3cJ3OHcNDQ5xPwV4VVh5s 2jedC8AA/fygWN9TJZa2oB9Ic1ljtAJ+lHxhTCIDCZEuXg4WeMSrHe+6ttLnPdkWQ0vJO6GsLi6f MrSy3dNZkUPytovJApcRqCTtH48KeVi/bqvSc6yosOrxAmRrEypZP2ZtbX2M9Y1n2bQHOBiJB7JE gJAJYWMy33OrJ21g6Nr0JHmVboYKKGsHtawcuMqNIyrWhzGekw93coWWOm02NGbe19hj2OeA0DxI JURydhbMIE6HTyVZ1DGbIDjc7jawT+RCqfmvbtraKBH5/wBICdFWs+sfRMYuDCX7TAbQ0OBj+VIV N31s9c224uMWmisuAud9LUAyGjz8VHklI0RpRXwgBYr7XXOLUXbry68ju47Wz80St72NLCRW0amO I/rFcXmfWXrmU0s9ZlDD+bU0A/5zpKBQ+7Movx8q59zn7XsL3FxkaRr8U2cdpXsvgN4vU/WTI6Jk dMe191JyqwTjtDg5+4dtJ5XK44pezUgO7wqldLRo1oEorvRoDXEw7u3v9yUgCKBLJjBju2jWBzqP wUqM/wBC1lZdure4NAPifBZd3UnulrBHx1/DhBx68izIrscHGHB068A8ynY8UhqSsy5YEVVl6fNx W5dBqcdrgd1bxy1w4KH0/LffW6u4bcmg7Lm+fZw8ih5XWsOiWg+q7wZB/FY93WXuyDkUViq0t2F0 kkjzHCnGvRp7bvTOe1olxAHiVm5PV66zFbd57EHTw5XP3ZeTeZusc/yJ0+5TrsaKmhx4JHnCXD3V xDo3R1LPzL/Qqeykn6O4xJ8JdpKpMfc+ywWuLy2ZMyNChm2kaisOd3LtR9yg/JsdpMDwGg/BOA8E GR6lnd2PyKnZnXvqFT3lzAdwDtYMQqhcTqmRW2kfc5xkuLiobimTSkhmw8rS6ba8MLWsDoOpmDqs tnKvdPrZY97XDWJaRoR802fyr4H1aOn6tjT7angnUj2kGPnCduRlkR6Ddp5L9DH3oLRbVr/OjQn9 +P4q1U6uwS06j808/cq0gOwLZEj3IZ0Ooc4tfDLZkBwlsj90nUFHtoeXAl24jQgef8lB2AgEgE8/ FTZY+sFv85WOAeQPIqKQN3E/RmjIVUvtDiZJm+w/yigWHQKb3S9xPclDs5Cvx2Dny3PmyY1pOjiG nTXxUmVP5aS0eJB2pq2UuB3EgnjgJPYQ/YDub49gihcXMaS1zWvjh3b+9CcSSSe5nyTjaOwcfPhR k8TxwkpdzwT7vdAgEeCiQDq3sOOCnc7cSXCSeSExYY01HkkhUub5eRSnvGqYOPBMjzTzwQPikldz SQHAzyI7hRBI76eCdzXNIPY6gpSdN2oSUqWnQiFOoEAnn4KG1ruDr5rX6LVFdj3CQ4hpB8ElOehF 9gyWmsbnt+iD4rcyOl0vk1jY6e3EfBZrOnMcC+wkucJY0ac8EpEqa1u5zg/Ke5ziSCPD4JNhrdvY 9z3TZFRoe2vcHue33HwKMLGNAbY0s7B3LSnClpQljTq38FEhw8wrD6GnVvH7zeEJzLG/yh+KSrYD cBvGkGJQHiDPijkluhGjgmdUGyHgyG6dtUEohwkdE8QNeeyiSgpcQpCt5EhpIHJAUAQrOLlW1O2N Jg9gUCmNE6tcAgpa8hbbsbHyYbawMuPDxoHfEeKp5fTxQ6Gz8RwUBME1sySwkCxqGjATE9kgCSlB BhOYlayp1EixpHMhREzHirmJj++X8tKEjouiCS28pnqVCoN1+kT4K70THbXW6wiS46E+AWYLnC02 A6kwB5I+Z1Y1V/ZsbQge54/gnZsMRy8Yj55nXyZcOb9cZy+WA0dLqPWasRvp1Q+7w7D4rE/bPUf9 KqTnOcSSZJ8VFVvuuPg4eu9sn33J7nF+jtw+DvnvPCqfaLQ5zaTsqmN5EgHwapH7SyNrwSdYfqD9 6BXRdY4treWiZaw+PeEoxAskhEpHYAr2GzQutc0H846T8AhW+oQHneW8B7+6u0YrB+mtJfB1c7U/ 2QVHMBewud+bG0ToERMXQQYGrOng5x8eydh1hTgQoEbXJ9sNUQxsEO+Kgi3dihJ42WndJjOa2+tz xLQ4bgfCV2DKamtgAED6PkuLXY4NrbcSmzkuaNx84hIroJmwO4HhpKw/rLXJouA8WEn7wta/Kx8d v6WxrCOzj/BY3WerYmXQKKQ5xDg7eRA0QCZbOMpVnUjxCiUgdQnFYGRUNZ05RDyhnlNC+SRr507+ CPVaWajUdwqiKx0gTz4JSinHkILeqe5jhfQ6COR/ArcwupNyg0OgWN+kD2HH3LmWPcwy0wVaY4ki 2k7bG6kD+Hko9mYgTGm723T3luS0HSZH3j4BYv1/YW24WQ3Qje2fMEOCJ0TqbLra22aWtIkfPn4L M+ted1S204mfW1ja37qS0fm6jR3eVJEteYovXYOVRd0qvIsL7aiwBz7BDnkQC5wPn3UD1HFNbXU3 hjSS3Zy4x+61sko3TYHS8c3jaBjsLxGsbFDFGCca09MYygtdtsLQJ8T7hM6KSExE3QksnHiFXw+K 2Lm4VWQ0WPsbY/2g2VvY3WO7hpwii05+S5tLgKKPa+5vJcddrT+Uqh1IHGw3226h5DTY+SRJ7dkb puZi4uA05FnoscXPl/siToADr9yjyy9wjiI8gyQiID0WfEt7MbXVjNYwBrQ5sAfFWnOPYfM6LBy+ v4ORU9mGfVfW02zBAhnmdVi3fWbq98w5tLT2Y3X73SmCQE5/RdwExj9XtXWsaJe+AOY0H3qjkfWL pONI9drnfus/SO/6E/lXFW2X5B3X2Ot8nuJ/DhM3a0QBCRyL44e70uR9cKyIoxn26c2uDG/5rJVG z619YLdtJqxWdhUwE/5z5WQTomJ9qZbKIRDZv6n1C8zfk22z+88x9whVpBO4jXxUTwkAe6X1XMi8 qx01/wCtBrvo2Ncx3wcFVcANXkNHn/dylRlV15Ve3X3AEnz0TZCwQEjQgnRm6pwcQdNpgk6DRPj5 NNd7WTuL/ZI492g1VbqtlhzH6w0w4T/KAKp7oMt1cNZKcMdx16hZLKImgNu7oZ2TaXB9ftbaJMaQ 4GHifigYdLcrI9Ox8NgudHgOVLL3PZZPAe2wfCxsn8VWx7HU2teOdR8iIUuOMQRe1sWWcjer6x0z 6gdAxGtcWOzLdDusMN18mqh/jHwcCnodLcdtVV9dzf0bIDi0gg+cBcdmfXP6yZNYpdmPqraAzZTF cgCNS3UrIszcmxu19jnDzMn5lSmhswWjcC07SIITSo7ieVFNWsi4Ji4ppTJKUlKSSSlJk6SSlkk6 SSlN5CvdL3fawGiSQdPhqqHCt4Njq8ul7TtIcNeOUJfKfJdD5h5vQCqDDmEGOw7FRfRS8Hc3WNHc OkeBVkg2gurMWRDmgmZHdv8AsRW12OaHWgtrI/nHwzX4mJVETbpi5wufQWtd72OI228EE9nQiubZ 6VhgkNDg4NBMA6hWMqnCFTGEl9ryIDRA2jWD/tT5l9zun3by1rNhArZ7W/gkZjShuaSIHUX0t5lL 02v/ADodHB8vNMoF0PMnSCr7QLLY5mhHmD5KJJA8ipsuIEHjTQ8KZZVZwdpJ+X3pKQEf68JA7TuG pB76hGta8Ae3SBBCD8klK3aEcTp4hJrQDrMDu1LaORpI0BTgND9ZDUlLAknUSfLRICDAHKfeRIGk pAax490lLe4HT7kjEe4R5hTLHN+jqPPlKWnR2hHY8pKRlvcQfyq5i5d+MAGGW92nhVHMAIjlFSQ6 f7VrdQ8EFj9pDe4krHZm5DA9rHQHxPcwONVN/BQACJSUdkZcSSTqSpV22M+i6AeR2+5E2VMafU99 pGjQdB5mEGPBFCQ3uEFg9N3dzZE/JFZlF3842f5Q0P8AcgNarVdAbDrdAYhvcylaatnjlr3y6v1G 9gSQJPfRSy6rrTZkOH0tSSi7/TadgGnA7KV7Wmqil7m1ueRucfogE8kppK6I+qXqzcSrAw8JjW+u 1m+54GoLvcB+Kw7GlphGyHtre5lT/UAMeoJg+YlV9SddUIRIG9rskhI7VWigCfNWcQ1tPuHwPdCr 51MIjWFhg/RPBRJ6LAOrsV7bGiD8CnePUc1jvpN58x4qhjvtrII1arzLWuLSYkKOQbMDp+xiel1A OLRqfFU3dOeHy4jQaLYbaCk5rHJvGQvliidnE+wuFk9lZvcKqXu/OIgH4qzaA0rP6jaHBjAfMp0T xEMUoiINNPc7mdU0SmnVPOkBTSkS114SkJfFLVNS7Dce54l7C0gazp9yeuphduMho1n/AF7qb8wy WhhnwKCd50LgNusjXU+Mqr6jv6W3oPGmza/1G+pEFuj2/Hg/3oD27mGR28E1djt5Y4zIIBHhCeNz Y/IkBw6KJ4tXNM8TBTvqe1rS8QHiWnxHCPl0ifUYJHDvCUN9k0AOO4/m66hTA3swEUhf9D4ISMeC PFBT4rJKVhvUMxlAoZaWVt7N0PjyqydOQouLiS4kk9zqUydMkhSZOkkpmdQhuUxq34KLk0Mh1ipW HUY9bP0loL4lgrE6+DiYVYJ05jZtskwdPBFa4tIc0wQq+0kKTXke1/PimmLJCZBdDGs3XMtYdlzH B3hMHsu9OJQ4MutHrukOBsAdEkHQHQLzYGfI9it2z61ZluI3EY1tLgwMNgJLjAjQ9k0aMszxgVv1 e2ysvEoaLb3toaGgEvcBMeS5/J+tPSsdj6sCt1thBAcwbGAnuJH8Fy0PucX3PdbZ3LyXH8VYxgKz 67mgtYYa08Od2Hy5SM+EaLY4rOpbmbnZrsSml7tls+qRJc5rT9EOLp1PKo7DY42WONj+7nkk/ik5 7rHue8kucZcSkDGqiF/az1ENzpzR6lojmmwfgqgIhWulv3ZTh41Wf9SVn7nIR+eXkFxqgm3hIncF ANJCmK9ol5DR56JxIQAT0YaqbWkhQsyqq+Pcfw+5Vrcmyz+SPPQJASPSkkxjub8G062msauk+Df7 ygPzXmRUNo8Rz/nFVS4TOrj58JEl3P3dk8QA31Y5Zj+joyc8nVziT5f3pmvIcCNIM+ail5p1MVkm yW51NsZAJ7t/iQqiu9SO84zmiS+kGB8Sp4vR8m6HPHpN/lc/chHYKmRxFGQXkMH5+O372Cf4KkZH yXTU4lFABA32VgAPI1gLncn+kW/13flSiUSNsH/SPnr96GeUQ6hp8o+5QKkYSsmTpJKWSITpklKS SSSUslCdMkpSSSSSlij0vc07mxLYdJ/kmUAolZbALpjySUN3qruo5LmtG97t4nbV7Qfu4UZy7Xg3 ADTQkk2Qf5clZnTrbGNDh7/5G6HR4iVd+00NPv317hEWA6Hx3cFVJ4wDoG7DITqU7KvQP6MNbP0w 8kh3x3IPVHfqryDG4gOaQTqD+a5SdmYjAJPqWGHCuuXHTiTCo9Qy7bq/dVsY87gSeI7ADgJQgTIW PqUzyRETVC+zRQjEmURDBE+7hW2kzIYW+z6XglsePo6juEiGuA26HxUjuA93uakhevIc2YPl4j8V MmmydAxxiCNQqwbr5FOSWtHbWdySbSOqezUDc2SAQota/wANE7LiCCP9n3IrXtkfmkc9wT8ElIS2 OyYRIBnRGsrIbIHt8QdEKCJ7aapKX9Tb3n8qTyXjSPh3TbC6YGoE6eCYAAncNPFJS7ay2CdPJSTC QOZCdJStnqS3yQXMLHbd0x2U3Pc2QO/KkyjTdYdrewRCCUTWlxIA7SfgFNmI93cAxIk8jyVg0MLf bG3z4RaKqaqXEEmyYa3wHclIqGqFlddZhpD7Bz/cpDaHS/6REn5JnWNYZEEkwShWbmt1GhmP75TQ CVxIZuyQTsa2d2hPH3Iebd6kAabBtg6IdbnMsa8AEtM6qQl7i8iSST80ipEyok66DxRfSb7WiAXG B/tTl7W8e5/4IYBLwST5lLUo0T+mz1XBuoGnzRmskQdI8EPEDgCHj6Rnd3VoAjUa+ChmTdNiAG6A h1Z1GniE4s7hE8514gfwUXVsfqPaRpp/rqkJ90mPZkzKjkooyhzKpOqfrpx3Cg71KzDgR8U6onYr eOQ3DduyA4LKueXWElWC6QqrgQ+PFPiAGKcid0+Pj1uaLLnbGHjxKsnIwahFNO90fSeqTnE/LhN3 lIxvcnyUJVsB5rk6nzTSUktUVt9XdpLMd0uBsLzItmQ4fOYKIX7iWPaDt8vyo+XiUPc3YTXOoqmG knwKq5NVwhriK9Ic3XkcajnRUhISo3Xm3zExB0+xpXWV/aG1Vk+ZHGvZHbp8uUJjWV2OL3MknTXt 81MOIkMaT5zH96mNUGEXv+CRwYQQRoREBZ9rH49rXsMAEOaR2I+Kuby0+8GY1I10/BM5td9cN93n 2CUSQUSFhzyZJPMoTtHFGdW5h2nSOyFYNZ8VLFhkGCSdJPWrJQnSSQtCSeE8DukpTfzgou4Uxzp8 1AodV4+VTQPFEZU559jZjklNQ5rQZaHHtPCk617hEwPAaBIlAha5Yxph758mpi5sQ1oEd+6jKbVC yv4QFbiDrqPFTkFDSDtvmEqtV026LDuFZkkmGkeJ7K1kWAOFTdW16SOCfzj96qYpA338ipst/rHR v4qLLi3R2o81HKOt9maMrFE79WxqpNmP4pqbKCRueWA86SpZF+NW8ip3qtHDoLZ+XKGvZfw95Bu9 KbGUTzFdk/5pVMvqrHvdJ8G6/ip9MybHZLp0b6VmnA+iVmOeDyS7yCaMZM5X2C6WSMYitW0/NMxU 2PPk/egPsc4y92vgNShb3RA0HkmClEAGCWWR6si793TzOpTc6kyUolMS1vJ+5OY7XSMd9FHefzR/ ej04V1urvY3xPKVIMghDpMNEk8K1V066yHWnY3w7q3RiU06tEu/ePKsAyjSwyJbGCxjcfQfQr2tc RJjce6OHAtkkl3YDhQxQDUR/Jd+VTaAGjumDb6rzv9GIkl0LnMwbcu0fyifv1XTal0gSCOVRt6PX dkOuteQHfmN/vKbxCJNleIyI0Dhfm/A/lUStfq2DRj47HUs2wfd3J+KyCpISEhYY5xMTRYpQnTJ6 xSSdMgpSZPqkkpZJLhJJSxCSfulEpKWjRO3gp48U/wAOElN6m7G+yNbdO4EwRyPmpMquewPs/S1n VrXOOkeHZU6632Q0D2krcrYG1NZHAiEyXp+rLD1abU1S/DrkuY+qz80fRJP5EPKtuNbK3ua5s7hA h2vie6t2VNcQXt3tAjaew/knsqOXVXUW+mXGRJDuxTY0SEyBAKA8FDaWjkSZ5U3H2lQYQCNJUrEz O1zpb7UnlzRDoIPE6kJQHO/d7QEnbgIOrfEJIYAR4QVIn2hpGg7ptCdOE8kaEQPLVJKxYDqE3vbz qPJSju0wluI+kPmkhky06x3EGET1muBBEHjT8hVfQGeJ4Tl7gOJHM99Uktgs5LdQNJbx80MsOp7C Neyi23uDHdF3g8iCTyPD4JUpanHttLhW2SNSEzmOYdrxtI8Ve6c5gfZ7huMBo4keSsZLaXUvdY0G GkidCkpx/UrrbMbrD+CiA+1wNjtoPE9/gj244bWLgz2gczpPiqY3WOkn59giCghuigNIG4geXKe+ 6iqtrKj6lpH6QngeXmg+leQdlsjwPKC5jmGHNhKkArGTqSpgCNCSPDjVDEd+O6LDQCW6gpJYdyfk jVCusTaCS4e0BBA7HSSreU5tjxWyva6v2l0zITCdV4GiPY0+1jBt8TJ+5OKYJ8lJumnBRB5cppkU iIWAgfl/2qYIA0J8T4qOgMHUT8pUmsOpPJ8fylMPiyDwZtG4S6Y8fL+5S9MAmNfDslEe3kfl/wBi eeTHujTz+HkmFeCx9wBkfD/Yq2bW51cg6tOoHH+9XSQQZ0I0kePgFVzbG1tAbwTqPD4ow+YKnXCb aTpY0SfceyFuJMqTnB5klNCsNUlW4p5MJk6SlJJSmlJT0GLnWUs9G5gyKP3TyB4gq/WKsirfU/7V jga0v+m0+AcsbcAAJgfMIuLYarg9ktfrqPGPJVJxsGt/wbkJ60dvFtnplWSC7DJJb9KmzRzSqDqb WPc142OboQRMK83qNN205zSywaNyKvafmFasBfW117BmUfm5FWlg/rAcoAyjv/L6pMYy1Dke5vLt sf6yk53523a4CQ5v8QrjumC79Lh2tvbzsJh/3FVXUljix7DuB1kRr8k8SB81hEgguZ67N7QAW6EK hY2BPgtN4NZ9SsxGjp4cPDVCz6ay0XVCGWNDoH5pPZSRlRDHKFgns5qSQRq8fIt/m63EeMGFKSBu wgE9EQbOqcR21+CuDplo1t0Hhx+VFZUysAta0x35M/FD3I9NV3tnro0mUWP8Gjz5VhmGxvued0eP H4I28/Lv5pAmZHB/KmmRK4RAYvYz0XBoAHb4rMdytFxLu5M6Afx1VCwQ4oxUWLASSAJKeU9RAtb5 nVFuq1L2CB4JywGkJKaUiPDhLRJK2qUeKlyltStVJmk14W7/AElkfJo/2qIIcJCJfpiY7f67vvMf wVYS0yPuQGv2riaI8kwftP0QfipOuc7UBrP6oAQ5DgCNFIBBcCS2Onki57if8FZ/1KqQrOIYscPF jwPuVR9gBga+ZQGpP0VIgAWyhRNjW+agS53PCW3xT6Y+LsubHO8vIJtvikpdkUbpca5lLpcwEHv3 C02Pa9oc0yCscArXwOlXwLDc0MOu1usoGQAspESdAEk6otdb7DDRKtsxaWaxuPidUWYEdlEc37oZ I4P3ijopdWDuI1EEDzRAGjSJjxSBSlRGRPVlEIjovuKUpgClGqavanVG+ph2eLdR8lzh811V7A+p zOZaVyrhDiPBWMB0Ia2cagraJJ0ipmFaEoS5SOiSlku6dKElKiOT8ktTpoPgpBkie3jwPvSlg/lH y0H3oWpbYPn4JyA3Rxg+HJTj1Hce0eATtqA5QtNMSd4DQ2I1nklHxKsZ1wbkuLWH84dkwaJg+3zK dobtmCXToZ0Q4kiLZpFdbyyo79pmR/thXar2We3hw0IWefS9MHcdx/dG0D+9JpcABo3X6f8AeopC 9WaJrR04CHZU14hwkIVeW0HZYZ/lBWJkaajxCbqF2hDm5OE9rS5mrVWZuHYeC2iAq2Rj1HUQ0n8q ljPoWOePqHPgOM8H7k8ubqdQt/pf1UdnM9azJY2sGIq97wfA9gtGv6lYddbzdkuc6DtMbQPMxyge YxxNErRhmejxogmOPJOXOb9KCPHstfqXQ2YdTbsS45DWGbJaIb59wsnc4fSEjxT4SEtQtlEg0Vto dq3RNJb9JS2tOrTB8k0lujh805awgaj8FLcRzoFEDt4HRSkjRwj4apJKxa068eab3t+BUoHLTH5E 0ng8pIZIoyLnM9Fx3MdA11PyKEkC3e3cdoB5HiklI+1jHNAbvge1p4+alXlZThthjWnQ7QAhPeXu JYN5/BGZbeWbCGtZ4NCFeCr8UWx7DLDI8CpNyPzHj4gqcCfNM5jXD3BPWMHV0xuAI/k9kJ8BsN7o 4ocxpI1B1EnVAfEwgVwVV9No/d1Ry8glxG49yefvQqhqXH8OUSBGn3JhC8FINh4OwnsdfxTlpBg6 E8eag1pcYGs8/wC1GZ7Rs+lI+j4/3JhXjVdrWgbz8Ph5BEBkwYgcDw+KaA4bmdtS3uB/J8U7YnbI Mc+A8/io2QKGhOkO5Pf70wJdwZP3Ex+QJ/on2iZ1PmPFSLo5HlI5PwQSxdcxjXPdo1uk9z5NWbkZ HqkACGN4H96N1BwhsO1b+Z2CpzKmxxFWw5Jn5VtOyfUJklIxLykTCSZJSkk6aAkp1Y90EadyCnE1 ndu47x28E4a1wkyAPFSaWDghpHjqfxVa21XXZQ1nZInkHt96JS7Ipfvx3Fp7jQt+BCEQ6x3uJcAd J1B+KmzFdqWtI8zoD96BNdVw12DfrOLmndkt+yXt/wANWdD8gimy6quMxgy8bhtoad4HxCzBUCfc 8GPAzr8kbH6hlYpiu/ezu17SR8AVGYk7fZ/BeCBuK8UtuHU7GflYrjYxg+gXAkKq+pjXNrLBIrbA cDzGuitufgZoLh+qZJ13VmWkjxboib67iauoD0rNAzLbqw/E/wB6QkR38jv9E8Ng1WvUOVsLD+jg E9wAIH3Ji950LiZ7nVWMnEyKbdpcHV9rA4FpQBsbM+4t0MAgKUEEd2Agg9lAbQXkwwD5k+AUCHP1 PtHYRoApuD3kF+o5jtCidCQBtB5MwnDv1WnsxAJ0AgfGfwT7QBE6uPhGgUtI83eInRO2SNDE9vL5 p1opGQ4u40+R0VLJA9Uxx2WkGl4178CJ0+Sp5rIc08Tp9yUTqohp8EFXQNPaYlVCNFdx2vsa3ZW5 7+20Sn3ospBZT+c0E+IQtv3LUPSuo2S8Ulo7F0N/ig2dLy2Mc8sBaNSA4E/IJKB11aICcBI6KO+O EFyezWmoH83cPxlAJCJaYx6p5JcfloEDVEBEkjTLVMHRDr4KcFApiaTUH9MIOkO/IVVcPcVZq03v /dafx9qrv+l8ko7lU9gslqknTllMYUkySSgyV/AzX4z4ma3fSBWcjg6JEXoU2QQQ9S17LGB7DuBT crDws5+M6DrWeR4LbY9ljQ9hkHVVpwMfJsQmJDxZJ+FHlIpq9luKbXlNKedElWuVy+ZX6eVY3wcV 0xOqwOss25Zd++Af4KTCfVTFnHptopd0uycRpPHeFZay0J418/BOTWOJPkNPxSBedGjaPL+9BK5A Grob4dz9ybdJ9jfmdSpNpH5yI1rQdIHxQsJpGK3O1cZ+Kk1jRoBJUiWjn5x4Jb9zYaBPw1hCymgu 3b+cdo7HlRLgDGh8D3UTBbudp8OJTSXAbRPmkpkA9zg0j4BEY3addJ0Hmm2H6RBA8uw8VItAaId8 R/EJpKQGQMSI3f3+CYPDW8Fx7t4ASMtIJ0Hc9k4kPBHuceJGoQXLNcQ4io7gR7gi1XmoAtduB5Ye yCW+/wB/t/lcyfkpepU1pY4bndnN5SOqgadBtwsDRWC6xxDWsHJJ0AVLOOQzIdj5LDRZS4hzDqQU bpuLZm5ba32jHaQXGwiTp5CFb6r9Ws2tpy62vuxTr9oaDEfyoRjwga79+ipSJOn2NbpnX7cCQxwI 5Ijv8Qt1/wBabXYjHPDK7Htk7ZJPwaeFyzcAFsgAj4q0yhjdeT4Jpx4rvdQnk22Y/tbJy8nZe79C 6W7DwAdJ+KqWMdU9zHfmmJVy2hj9Yh3iFDMJdsfB3ABr/MjupIkbBZIE6nVqbQdRz4pFx4cJHing HVvPkouJiCnLVMJ3AiJHciU+4jRwj8iYSTzqn3EaFJStomWmPyJpM6jjun2jlpjy7JjPflJCkStj XzuEjSENHoEMnuSl1UdmbWADwHgEvaAnPx1USnLVSAeEnWQFB7w0ST/egTZaYaNEkhd9jnOgGSU/ p7WOLtXcAfFGrqbWPE+KHcTDQOSZQKtytXTueGl/pgmC48AeKLbg5dVbLrAWsf8AQcREqVeO7btc JHYHmfv0VmzOynVtxL8g+hI2seAYjwcBKiMj0ZRHu0g/IE/RcBzpHzUhe8H3VaHktOpVxtMeytu4 ckggz8UmsBkOBEcaQT5DyTTMdl4ie7WqyaiRLixw47QfJWXMDwLBoDyBwHeKi7HDx9HXvI4TGgMr DKnem4ncdZAgRqmmjtouFjfVl7SRMkkzHcn+5O8gBx4A5d4eQQGXPBIv9pdoLRwfIeCHnWhrW1g6 8x4f70hAkgKMgBbUyHh1hI44CEmPKUqcaCmuTZteUkySKFwUkyZJTJJNKaUlO2CA2HczydAZTD02 y4uknSOVI/P5qD/pD6Kq9232S+tsI9Nu2PLX71B1peCC4z31lQHLee/CZ/y4/wBfmkOFR4vp4My4 gHXgaAhRa5xbOwtA7gqTPod/4pWfQbxz25+actRuadwBIkak+XxWph55NXpZbfVxzo5p1IH7w+Cz q+HfE88fNGZ9Ifw5/wBybkqtfovx8VmnQw8iqkW4tsZGDu9rudjTq0/BVs/p9mK7c0l1DvoPGoMq vifz5+lwf5v6X+7xW3i/8i2c8H+e+h/ZTBfF6fquNcI4vo4IA7kaakd5SLC4DcdOT3Cn/gm8dlHu fo/S78qXVi0UK3EwAHTqe0BF2s3AEutc7hjNRH9ZLJ+gOfn9BKr+bs/q/mc/L+T4psrTHh/32Nz2 gFvta4/mt7DzKizpeT1Abq/bWD/OP0YB8VBvJ47c/R+a1+r/APJ9PP0f8D/Mow8FT31+lbOe3H6P gGHfr9w5PFYP36qN/Vsx420xj18BtYA/GFXr4HwPCg/6Q47qUeP4sUv5UvZfdZJssdZ21J5QXE8S YHmpngKJ/inhYfFrvaRJ58VDYSQBrOgRhyfimo/nmf1h8OUj4JjelscpwN20cVgMHyQVKz+df/WP 5VFAbJluyZypDlRZ9JS7oFQSztx3fynAfIalAf2Rn/zDf6x/ggO4CIXTWSTJwixhSdMkkldFbwEF Gb9EJILJXMDNOO/a7+bPI8FT7hSQlVa7JhxXo9KxzbGh7DIKeFQ6T/Mn6Xz4+SvqqavTZtjbXdY6 JkikihR5WR1xmtT/AIha6yutf4L5/wAE7F84W5flLkAE8BFGNbtL3AgeJ80bB/nHcfR+fySt/nT9 L+1yrBtqiuqJtY7hTAHA0+KYfSPPHZM/kcpp8UjwXJHB0PE+aYudMakdvySou+l/fynP0m/SSSsI D4B47FMCXSIjwPgon+cd8e6M36Z5+iePgihgxkNIJ3R28/JEZWTDdvx+CQ5Zx3+KnXzZzwPo8fNA 2uFMmDRw37TMAEaphtALSJI8P4KV302/1fn80/5n5vyTNVyOCWaO1PITvta4tAYA4CIb+VDfw7ng cKxgf2Pl9L5oo6sWYt1kbzsb4d12/wBWafqng4Yyrnsdlt1e+4SWnwY0z+RcuUG/6J5+SZLirXb+ qyR4P/Rm/wDWXqPSMvNFvTaPs419Rw03un6WwfRWz0T69U4+J9n6nW976m7a7a4Jc2IDSNI+K4t3 82f9T80w/mxz8/4IHh4Rdp14v0Xpc7pt2dkuysOqvFNjQ9mI124vH724DYC5ZJJDzW8FljdHMcII K1+gf8mv/n+fzf8A0WsLP/pr/wCc+n+f/OfNDHx2b+XomfD03SlQdAHuUz8/4oB+kf48qUMZRXgQ XNaAfFV9znACJPip5PPf+CGOFINmKW67ZIMH4p57EQkz6PblSdx2RWrbSPo/dwmJPdJvf4pz9Ht/ FJTFWmCGD4Kr3VtEIksShvtDR4nwUnf6wqp+n8/zkSgUzZW+50n6Pcqy1jWja3TyUaf5pvHyU+6Q UVnEgEd+EMH9MAORA8lO76PfkIdX0n/x5+aE9iuju3NjXQDAJ58T8FGyoWAseAD3d2CJV9MfS478 /wBlTd+bxyeeFX1vRsaVq1arHU7arxpyxx0Dvijh4OoeYnUzz5NQLv6PZxz+dzypYn0Kvp/Pj+yl KvqqN/TxT6xDjucNQD4eabZLWl30TzzLk7fl9Pvz80r/AKLvpc9uf7CauLTzMlrWmsw9/GkQB4Kg TMidU7vpnnk88qPdTwqtGCd3qskkU3dOWLpkku6SlwmTpklKS0TJJKf/2QoNCmVuZHN0cmVhbQ1l bmRvYmoNMzMgMCBvYmoNPDwvU3VidHlwZS9JbWFnZS9MZW5ndGggNDI1MzQvRmlsdGVyL0RDVERl Y29kZS9CaXRzUGVyQ29tcG9uZW50IDgvQ29sb3JTcGFjZSAxMDkgMCBSL1dpZHRoIDY4Ni9IZWln aHQgNDU3L1R5cGUvWE9iamVjdD4+c3RyZWFtDQr/2P/uAA5BZG9iZQBkgAAAAAH/2wCEAAwICAgJ CAwJCQwRCwoLERUPDAwPFRgTExUTExgXEhQUFBQSFxcbHB4cGxckJCcnJCQ1MzMzNTs7Ozs7Ozs7 OzsBDQsLDQ4NEA4OEBQODw4UFBARERAUHRQUFRQUHSUaFxcXFxolICMeHh4jICgoJSUoKDIyMDIy Ozs7Ozs7Ozs7O//AABEIAckCrgMBIgACEQEDEQH/xAE/AAABBQEBAQEBAQAAAAAAAAADAAECBAUG BwgJCgsBAAEFAQEBAQEBAAAAAAAAAAEAAgMEBQYHCAkKCxAAAQQBAwIEAgUHBggFAwwzAQACEQME IRIxBUFRYRMicYEyBhSRobFCIyQVUsFiMzRygtFDByWSU/Dh8WNzNRaisoMmRJNUZEXCo3Q2F9JV 4mXys4TD03Xj80YnlKSFtJXE1OT0pbXF1eX1VmZ2hpamtsbW5vY3R1dnd4eXp7fH1+f3EQACAgEC BAQDBAUGBwcGBTUBAAIRAyExEgRBUWFxIhMFMoGRFKGxQiPBUtHwMyRi4XKCkkNTFWNzNPElBhai soMHJjXC0kSTVKMXZEVVNnRl4vKzhMPTdePzRpSkhbSVxNTk9KW1xdXl9VZmdoaWprbG1ub2JzdH V2d3h5ent8f/2gAMAwEAAhEDEQA/AOEUe6mFF2pVa2wjeNCqVo9yvv4VK3lSY92PIihPCeEoUrGo BKE4BTiUkLAaI1Dg1rgRIJQ9fBLXwKBFpBbE0SJY6B4FWW34zWOczduA4MeEeKoSR4pbieT+CaY+ K4TpjtS26qUt8U+hPITlrDalsRoCW1K1IdqW1G2pbUrUg2lLajbUtqVqQ7VYpYfQLo4JUS1XMdg+ wvd5uQkaC6EbJ8mmnGqYaqQBRWqgyn2ptU8pKVqElFz2ggOMEpB7DoCCkplCUJKQCSlgEoCdLlJS gS0yr1XVbKwAa27ROjZbyI7FUY0SKbKIluLSJGOxdI9VoewmygOshvIBEgQeeyoOcyyyXANB/dEI aSEccY7JlklLfV068fozqyHW+8B+oJHEbfpBSu6Z0wNc9mVDQSJJafzQ4aDXnRZSaAh7cr0mU+4P 3Io2NaH2BpkCYPigwi0/nqCkHVadmMJQn0S+aK1aEk6RCSmMJQpJoSUslLvFOmS0SrcU+5MkhQVa +4SmLvBMl4JUFWrceEySdJS7NodLuFMPHgoJ0iFWv6h8EvUJ7KKXz+5CgmyomeUoRGY19n0K3EeJ 0H4o7emXkTY4MCXEFCJPRplKJ4klaLMHHZq87yiC7FpHtDWwhx9l3B3NOezGyHAxWQOdx0ULazW7 aeSJV12exoIbJnn/AFKq3WC1+4CIEIgnqEEAbMatnqt9T6Ejd8FqCzHrb7GtbpyspKJSMbVGVOi/ Pqb+dPwVezqDj9BvzKqgJ0BABRnJm7Ivfy6PhohwSZJlPqlHinLb7rQAnATgKQCSlgD20Tx4p08I KYho8FJOAkklUJJ0ySFQEydJJS0JJ0klMYShOUklLQEk8JQkpvKJU1F3KgbDF40VK0aq87hUrk+G 6yaNOmCdSsK6dMnCSlRx8VIBMpapKUpQmTpJVCW0SFJLuEFK2N8EtgUgnSSw2eZS2HxKmnCSEW10 c/gn2v8AIqY4ThK0o4f4BaGAKnYjqrHtYS46EiYKpkJoCbIcQrZdCXCbbTunVR7LhHy/vUT06wcP BCrENnUBIAdtPggBL95dxRP6P4pnYdw8ChPxrw07QCfim3PHD3D5lP6lo/wjvmZR9fcLbh2P2tZ2 JkzJYSoehcPzD9yu+taO4PxCf7RaOzT8krl2Cqh4sGggQQeO6JW2o/zjiPKEhlOHLB8j/sUhlM71 /iEiZdvsSIw/eZeliHi0j4hBcGgw1xcPEiEZuTj/AJ1Z+4FEFvTz9IEf2U3iI6SXcETtKKBlLXCf VY0/uukfwUjiu1LX1uAkmHjt8VYbX0x/+F2/GR+UIjOn4D+MoN/tBA5QN7H0SMN7cJ/wnNiE0LW/ Ylbv5vKYfu/gUzvq9lctsY77wiM+P95b93ydBf1cpMQtJ/Qeot4ax3wd/egv6P1Ec0n5EFOGXGf0 wj2cg3iWphUGxtp8ED0itjpmFfVVeL63VmJG4eRVH0yfgmwncpAGwEzxkRjYamwpiwq2a0xrUnEx 01NqaCrJrUSxG0UggpIpYmLUrUjTaqcJiEUMElKE0JKWKR4HwThpJAAkk6BHb0/IeZgMb4koEgbp AJ2awSlaDOn4zP567d5NRm39PxxFbASO7olN4+wJXiHcgOdXj326V1ud5xorVfSMpwmwtqHmUWzq 7jpWI+GirPy77PLzJkoes9gr9WO8m0zp+FV/O2eoR2Ex+CmcnBp0rY1p8dJ/isxxsd9JxKQaAlwd ySrjrYAN1/U5Ptk/DT8UCzLufxp8dUKPJJERiOiDOR6rONjvpOJUS0KcFMQE5ax07JCVKITJKYwn hOkkpYJQnhKElKShPCcJKVGieE8JIFSoSSCdJKkgkE6Slkk6SSljwkkUkkKTJ0klLFJJJJSkk6ZJ TeCZykEzlA2WLtQqVwVw8KpdyU6G6zIiSSTqZgXCQSTpKV2Ugm7KQCSl06bb58J4SSpP3CSXcIKZ J0wSSUv2ThMnCSlhwn7Jhwn8kKSuSmSSBSUseU6bunSUslEJJIqWI1CRCfukQkpaE0KSQSQx7hSh KNU4SSFQnAHgkFIJqVg1s8DhEbub9EkfAkKI5UgkUi0rMjJb9G+wf2ijt6lmtH86Xf1tVUCeUwwi dwF4nIdS2ndUy3M2uLSHCDp2PzVPYOxITtHdPwlGMY/KKRKRlubYbD+994SLXeIRAmMJyEJa7wH3 qJB8EUqJhFFISPEEKDoRjqVEhELUJAUSEUtUC0JyGEJipEaqJBSUs0ljg4cjVGdk2vGmn4oJTpFV qJe76TiUgAE4ClGiSlgnSTgIKW2p4T904CSloTEKRCYpKWTKUaJklLJoUoTJKWhNClCUIqWhKE6e ELUtCeEo1TwkpUFJOlCSlk6SSCVBKEhKWqSlJQl3T7XHgJWO6RGR2BLFJTFTz+an9CzyQM492SPL 5pbY5fYjSRhjnuVIUN7koHJHuyx5DmD+hXm10lZ9Fg5CkGtHATTmHZlj8LyHeQDU2k8BP6b/AAKt 6JpCHunsyj4XGtZm/JmmcnSdwmtIMHKrdyVaKrXDU/BPhutns104STjhTMKk6aE/wSUv2Tpg2OVK D2+5JC4TpgnSUul4JJJJZBJLzSSUpOE0JalBS4lJLUDXX4JeCSV0pSSSUt3Tpu6fskpZJOmSQruE 6bkpyklZJLsnSQt3ThLwSgpJXCkFHVOgpkPpFSlRH0inQSylKUyUd0EshwEpTTCSSl5TFOm0lJTH solS0USkph3USpHlRKKCxKiVIlRTgtYHlRKmUxRUwUoTd1IJFSgE8JJ4QUsBqpQkOU8IJWhS7JQn I0StTHumKfRKEgpZMnShJC0JKQa7sE4reexS4h3XjHM7RJ+jBNHdF9B/wUhju7lA5IjqyR5TOf0D 9dEHdPCOMYdyVIY7Bym+7Flj8PzncAeZaycDyVr0q+wThoHATTmHZlj8Mn+lMfRrBjj2KkKrD2hW WtJmATGpjwUmVvsO1jS48wPBN949maPw3F+lMlqjHd3IUhjeJV1mFkvr9RtZNcTu0AgJsbHfkWit mk8uPA+Kacsu7JHkeWGpF1vZan2do8SnFLPBaFfTMi2t7voFhhrXaT8yq1+PZQ/Y8gmJ9plDjJ6s sMHLjSMY6eCKGjgJ1fZ0r9ZqodZ/OM3kgcDwU3YGI+m1+Na57qR7g4QE3iHdkEscdgB5BzUkR1Fz XNaWFrn/AEWkQTKuYeD/ADtmRWXejoKh3ce2iRNL5TERqXORMfHsyLm1Mjc7ieFazzX6dbTjHHuH OkNIRujeiX/zZNrQT6k6fBInS1kp1Dipp0YVt14q4EkGyCW6JX4N9O5xYfSaYDzoCtmh1lZ32Orp x5LRWNTu/rLP6o69jhVZebQ73FkQB4ICRJWRySlOtNnPDXO4BPwC0rcBgppDazvcxznu15DZEqfT cmx5DfTYymoe98an5rS3g2bAYLdXDxBCRkeIBE8kvcjGurzPZI8JJzwpy44RlMxjX1ZEjVrAR8in KE62youDIiwFrp8EYoNNROm7lPoOVO110k0t8UvbDSC4u/OaRp98pJSJwoj/AFCcSRqkpccKQTDh OkheEx7JwmPZJLJOkEklKSHCdMDrwgpko+Pgn3TwEgklSUJ0kkLd0k55+SSSmJS7wpJuElKgeCXd OlpOiSVkgnSSUt3TpjynCSlwl8EkhzqkpfUGU4OkpJAd+yCl58U8khMkTogQkFUpSmCSSmW5KVFu pUiBxCSWJPgoEp3aCFApUi1EqKR5TFEBBVCjCeUvNFDApjwpHzUSiELd1KFHupJFK4T+SQTxCClh yn7pDlOglQlPymUtElMYTsbueGngpipU/wA43VA7FfiAlkgD1kE3o1g8JxWwHQBHx/SNn6XRoBjv rGiv4VWM+254h1YECZkCNdAqpmepLunHix3UBp4OXEcKbabHsL2tJaDBPmVo5zaahTDYe10CI2gc n2n4q8bNhLWnVrTubIB0Ez7RymmW3io5KAMYgW4lOHkXFwY36P0i4wAk7EtZS61/tDdsDmQ6f7ld 6cDezIe5u9ztNznGDPYpXVOdgO2T6bSz6X5oH0o+ZSvVRyHipA3prZY2y9oNn0Q0EkqGRi41L62m xxDxueYGjTxAWmWY1JaTXJpadjxoYa2T+VVMhld+cyoVEgMEw6CRAiSfBASWxmTLUnYpm9PwxYHb SWhu6CRB07jlU8NmNdkuHpE1wXAbtRHw5WuWkT7QGFpaC52ngJA8VTwmOGVkVMY1jxtHsJgAESAS kJbrIyNSOrLHxQ6rfXUK/UaQR/aGmvkFXpYW5ORdU5jBXuGwg/R+AV/7O55MNOx5Zu10PuJcqeCx huynEAs+gGDSZOg/BIHdMSakbbLan1gCC7GZUW/SAmdSYVXplk23in9HWRLZEkE6BW3Vb6jjh7GZ JZtdqTDZmFTwBTU1+54Bc8NJ/ks934odCqOsZeLoWVEsHruJ2NcCBy7tuWNl0sZmuprnaHBonU9l ptyGOrD2XMYSX6vkkS6eFm5FtQzjewmxocHSdNxHKMb1XYYys+RdVhnqrweKqQFnXZuMymynEY4e qfe951jyTftNwybrxWJubtieFS7JCLJDCbuXYaO8GMubj51n0aayXfEcKtRfcen5F1X886wnTkSq AzMj7P8AZd36LwjXx5Uasm+iTS8s3cwlw/mr2ZUdeunk3urWE4+My3W6Nzz34UunXvGJc0MDW1sJ DwNSSstz32OL3uLnHknlFbmZDafQa+K5mB/enGOlKOM8Aj4ur06l5xg3Kb7S/dVuOsqh1HHvZk78 lwiw6EawB5KvflZF7g615cRx2hQfY+wgvcXECASZ0QESDfdUcZEjKxr0dA30h1WHiGay5pss4Lij G4jrQaHe0ja7w4lZABmG89oTe7d5o8KfbHFd9GQTlDBLTD+OzkTzCmIcMI3INo1BR3KL9cc+T/4I x3RINF53Pc49yhvOiI7QwoOCsBgO6HVFx3RaJG4DsdQoFhU6hteCeElLGx28wYE8K0OAqkHfPmrb RoEFLhPKQTgJKUmP8U6R/ikhdOkEkk0ukkkkpTeEoSb3+KcIKUkkkklbunS7/JPCSlkkoSSQqAkm KdJKpTpu6XZJSgJcAoC0HJGOBqXbQ7zUtEbEqL8pjwBuYJkiU0mha6IsgdWL2OY8sdoWmCExRcsH 7S+TrMmEIJRNgFEhRIUJPh8VKEzRqUkUKKY8J0x4SUrhKU3kkglfUa9wlvHZNKRSUs4qJTqJRQt3 USpd0xRQskUkxOvgipRUCE1j4A2nnnun3AiUlLKQTKQ4SKmXcJJgpQglYcpBOAkAghcJSnSSSt3U qR+lCip0j9KPmmy+U+TLywvNj/vBsLS6bY1uNa0fS7iQ0HdDRrys6ISBVQvRTx8QrZv55Y80OFoe az6bh5giXI7s+tzshpIDQ1wYd07idNAspLhClnsCgCdmxRkuZj2VTHdkfvSDr9yV2Y+3Hax7nPeH FzieI7BViU3KK7243datp/UbrKrGP1L9Gn91vdoTPy92R62wEbQ3YSY0EdoRcTp7rcay6ASYFeus zroiZuHSKBZjs2tY8sscTPGiVjZYPbEqrUoT1J5a1opq2t+iCCY+8quLbWuJa4t36ujTzWo7p7Ws o9MMvewEuZxuB/OnyQMvFuca2ihlJcYaGmZPOspAhEZY9gGo3JyGuBFrpHGp0UNzwSQSCTPzWxD6 t92wNseWVhoAdG36R4VXqVdRy9zHl5sMua0atQBTDICa4a03aRrt2i0g7XGA/wAT8VEMcSBBk8Bd JjsAqY2sGtjJ21uA3OA768LLtrtOe12W70C8y1w7RxCQlaoZQTIUBTVGFlunbS4wYOndQONcKHXk QxrtkHmVu0yWMc529zdd/jJdrHyVbqZaMNgdO02NmOYDUhLWlg5iRlw11cyzEtrorvdG22dseXir FPSzbjNu9Ta5wcdpHZqt11tbZjMxrnVssY5zRZDo+DU3UczIpx6PTtJL9254AG4DThKz0T7spERi dSWljdNdkU+t6rK2gmd3IhWD07Dra02WWOcWhx2NBAB0UMT7MOn3ueHkmG2RpMn2wtA0ueHNYP8A QtPwb7ikSbWzyTEjrQunH6hiMx8n0adzvaDrqZPwRsqjGotqNlTvS9MbtsiXnzSzrrR1Vz6TD2uD WkCe0K/eMn7fUTBo8D2ge5yNnTyVOUhw2f0baeTXgUYof6MW2D2McSSPM6rKXSeq17dxaJLHP41g fRXOEyZRgdE4JWDdtnCGxtuQeamw3+s7QKrJmZ15nzVtmnTLD+9YAfkFUhEdV8dST40k04OoPKgZ YNNWfkUk4UxcIIyZ+CsYdHrg1yAC9skiexVZwjVvzar/AEgtc5/9ZkfijDe1S2cjNp9DKtqmdjol VyFo9TqD+rWsOgcQf+iq1Taq7mueA9jT7mHuphIBh4SWvtKfaVt0W9BtH6asVOHENMH7kWfq3wdo PwcEuJHD3cFjdUVvC22M+rx5LfvcE4Z9Xo5b8nOS4vBPD4uJEp4W0W/V3xaP7Tkxr+r374n+s5Di 8Cnh8Q46Y8LS6rg42PXU+hpG92pknSPNZzuEgbQRRXSSCSKF4SSSQUoJ0wHKdJKk4TI1GP6rbHFx b6YbwOZMIEgCyuxwlOQjHUnQIe6eUf7K394/conG/lH7kz3od22fhnNfufih7pI32b+X+CX2c+P4 Je7Duj/RvNf5s/aEJCdF+znu78FE0O/eH3FL3Yd1p+H80P8AJn8EajMlFNL+0KPpP8k4ZId1p5Lm B/kpLVtBsa09+VZryBQd1QAJ5J1VRzLJ00PknZRcB7u/EpkuGVXIUvx4M8b/AFMifJJbc66w2OAB PMJBRFVngPvCl6dg7fcQnCUAKBDGeW5gmzjl/iqHJTpCuyT7SmLXj80o8Ue4Wnl8w/yc/wDFKkx4 JT7X/un7kxa8/mn7krHcI9nL+5L/ABStKSWs6hMiFhiRoRXmumKSYooWKYp0ySFlEqSiUlLKL/on 4KSZzdwI8UVNQ8BO4kkk8qZqHCY1jlKlL08fNHadQUFrdvCKECpsZNzb7vUawViANo40Q5TBO1Cq FJu9V0ktNUh5JBRUAknSSUsi44/SfIoRhFxvpn4JuT5Sz8nrzGP+82EydNKqPRrwmhL4J4JKSmKk AngDlKUlAOljXVU4lb2N9zrWiwnxH7qXVAxhqpLWsBcXPLBGhOn4KrXnZFVbWM2gMnadomT3+KjZ l5FtIqseXMB3a8z8U2tWAYpcd+Jdlz6rDW0sGwCs1awZcdOPISqWdXXZfTZVG+x5a9oOsh3Kpty8 htgta+HtbsaYGjYhD3O3b5O6ZnvKVKjgIN29BU39PaGlwaXBxdwC7u0LKccpnUQ94Ndr3/gTCrOu vcGgvcQz6InhRN9xsFjnkvHDjzpwkAqGExuyDYrZ6UkF4dqTvgHZqAO0nt5rHr3ZHUybTuZW5x1/ dbrCqfacmZ9V8+O4qBcZJnU9/ikI0iGEx4tRqNHarsigNseym9zS6tp42CYn71T6g+x+BQbQGue4 u04iIBWcSSddU5c90SSY0EmYRpMcFEG9jbunK6fR6bXuDnUMG0jUkkcBAd9jy8E2k+m2jftYDqJ+ iscpapcKvYrUSNuhiZNXptxKmtYbBNtlhkT5AqzVk4hrtwxcGVgACxx1cT9IrFiUxCPDapYQdb/3 28/JZiZb3YJBaW7Q4+7XuRKsY2bQ+h/2l+1w+mdS6zwE9gsjVPuRMbSYQIo793Vfm4/oWW7pvtbs FY4aO3ZZMJ9yWiIFKjCMQaKWq5gxraXmN0OZ8Qq6f2ppHijXgrQHca+KTup1tLnBoBM6aKHdGxf5 9nxUp2cKO6jiPe2G1uY7gkyWn+KN0msi+5hA3M2Exrw4D+K1qYDDI7jVZfT3bOtZTDw4fkc0pY90 5QAGr1oBnWzt4Ib+RZtn03fErW+sgDetNI4LW/lIWVb/ADrvipSwx6rU/wA61PeP0h/qpqp9VvxU 8ge/+yiNlst2wzVjfgEnaCU1f8234BQyPdQ8A6x2RQuC4NHA7BEtY87drYAA3IT2/oXNHLQCB8Fc a4OqDh3E/gipudZEYOOTp7h/1KxXFscrd6y3/JlJ82/kKwjwUyK6W6pb4hPuHilynhOWrS3xSJHi n0S0QUsCNdVKRCbTwTwPAJKWkK5gAuZkAaw1pPyKqQPAK308HbkBuksEx4Sm5PlLPymmfH/eDM6q VdT7XbWCT3PYDzUCNo5V2p78eur02hznQ+wEcyYaCqL1UpEDxWGJjtq9R7nPaDtc5gloPglf0/Y4 NY4iwjcK36Eg+CtFlbWv3t2lxD2g/RJPOn5ExhjvWa0WhrY90kHSfkhbD7kr3cpzSCWuEEdio86K 3kk2Ui5wixp2v7SDq0qmdU5m4rjfUL3VWVO22NLHeDhCnj4duSyx1cRXEzpJcYAC0MvE9Ih/Ubnv qYGtqDdXGRMeSM8en0hxqaMbd73ETIb2k8klENTJn0BFamr6OIayx5Y8FrmmHA8hFdU8Vh8HYTAd GhI7IVNtReN3v11aDqfuXSYNT202sfS2lrALaWzuO46bnSXISsMpzRhCxUvIuNZ03MroF7qyGET5 geJHmqzQtDrTg21kb52y9z3Ehx8Q0mR81hfbb3PJrburB1gJ0YSkNFkubhijGWQm57ABvmAEwkq1 muqyW15lW2uqwBrKdA4BgglwHmgMqseB6bSQdN0aaefCbVNnHljOInsCmqxHW492QXBjKY+lpuJ/ Nb5qrytp7afsdFWcZbWC/dWWggEfRa0alY4DZ9v0Z0nwQW4pmZl4FhaIqd20VQK3kGWkeX8VTe5j fpOM/JWsHynzcP4v/uih0iF0imBa7UOJ+5Iz4/gpbc2lcJimLT4pbX/vD7kUK8VEp4d3ITa+SKlJ u6WvklJnVJDEhR0UjMJo8kVMY1RAoge5THwQKV04Ta+CUFBTIRqkEwBg6J9fBBK6Sb3eCXu8ElK0 U6n7CTEyIQ/d4J9UiARS7HOUJCcd4pvtH8lMcl/7oQtUtfJM9qHZs/f+Z/e/BL9qt/cCY5V37rUO D5JQ7yS9uHZH37mf3yz+1Xn81qb7VkfutUYdHZKHeAR4Idgt++8x/nJMvtWT4N+5L7Rk+X3KHu8k 8O8pSEIdgj73zH+dl9rL7RknuPuS+0ZPiPuUfd5JEO8keCHYI+9Z/wDOS+1f18n9/wDAJetkfv8A 4BR9/l+KUP8AL8UuGP7oV95z/wCcl9rL1b/3/wAiXq3f6Q/go+7yTQ8+CXDHsPsR7+b9+X2svUt/ fKW+399yjtf5J4f5fejwx7D7Ee9m/fl/jFcvs/fd96bc/wDed96aLPJKH+SVDsEe7l/fl9pVLv3j 95TSfE/eUtr/AC/FKHDwSodke5P94/aqJ7n7ymIHn96UP8QlDvKfmjQRxS/eP2rbQlASh/l+KXv8 kkcUu5+1W0JtohPD/JKH+IS0VZ7lvnlExzFzD/KQzypUmLWH+UFCdmeO4dtkkRKz8Utb12/dpNTv yStCvz4PdZrmkdd7w6t3Hm0pY91+YaDzW+tLdvUcc+Lf+/T/ABWVkCLnfFbH1wA9TBuH59evyIWR l6XHzAP4KWXRrR6o6xD2/FEyPpt8wUIH3D4qd7pc2dOe6Q2RLdPVrS0eITNIBaD3I1+ahTZFTRA+ 9M9w0J0hwPPmn9ENyylrrHxoJ0T11+nSK5kNEAqTZMk8kypEaIJdDq+vR6z4Fn5Fz54W91Ig9FYf DYsAkHj8iEVS3ZDsnhR3QP8AYlu+P3FFC6dR3fH7kp+P3FJTJOo7vI/cUxsa0S7QeaSmORaa2COX GAoY2dbRaXbiWu0ePEKF9rbYEe1uso+Nj12FrBDidZ5KbMgDVlwCXGDE0QRSTNvtL2MqJ94kfNXu nWZoIZky/QOB7gM0gj5qln2VVvZqC5p4HYJ3Z7aaxZQYsDhB5keGqgMbgAI7unkzcHMylLISI1oD p9j0THGt9doi416ua4QCTx4oZ3MDpMCd+0DSDwNPwWbh9UrtfsL9pdwzaCPgEf7X+mg2ta2vT3QI PkNdQoDCQ0IbscmOQ4oziR5s8obaHDT8xnxLRqqLQd7R4kflRsi9tpAr/m2/R855KlgsotymVXNL hZ7RBiD4pBsDSBLf+sVkWU1Ds3cfyD8ix+u5NtTMfAY79HWwPs2nQvdrr8FfrwTkFtzDNTn7BWSS 4CY1KodU6ZaMUXggxtO0TID5ifuUmIgSFufzmP8Ao3DE2YHiqt3I9R3bSPBdb0DNb+zL7HF2+pgL mtG0mHfS38klcscUMjdcyY4BJ/IFqZVN2HhepuAa6KwGk6+0O/ipMwBAiOpafJCjOUzUYxuvxZ5+ Sy+x9ha2sv0DW+J8So1inHqLdazOoZ4kKlj5pdWMW0Asdwe4JQLLXgFriS7z8EBiNVdJy87GZBEB URwgOycbFbjNtqymvc7U1EHdPfyRcHfZuoLgaXe51bn7QSPztJ4WJhWuORXUP8I4N141W8Om5LbG gWMa4uLWEOjUDdIj4qPJExOp3dHk+YhlwkfKY6Uejb6pc2qhlWM4MquaCGsafc0ae5zoPI4WUDCu W4d1jDbfbL2N13kn8/Zp4KvkY9mM7ZbAcRMTOkwo23hMYjhErLUvJ2uPksoudvn71q3EbDKpvw7b 3hzTt3aEkHkd1ZwkCOrifFIk8waF6BBW7bYI8dVb0VnpXQxkPt9WyWsEDZzJ+MQreX0G2lpfS9rw BPpydw8p7p3vYxLhtpnl58PFX0cswmMKJcBp3SkFShgKvFRKlIjlQL2+KKl0N1rWmJUyd3tZq46A caqDsHJBhzYcSAB4ygSBuaXCEjsCWNu86NBjmQo0uJJaeFo3Yj8BrKrQXOcNxI8f3UOvFFtZew7X jXae6aJg+XddLHQ317NcDVSCiCJTgpxY2YTqITykpdOmCSCVFKUimSUpP2TKQSUoJJJJUpSSSSSl JJIL7zMM+8pKTJKuL3g+7UI4MifFJS6WqSZJS6RSCRSUoxCUJkklLpkkCy0EkA6DlJQTbmjuEpB4 VQvBSFmzVqSi2ymSBBaCO6g6wBFDIlLuhiwEEgcJeq2ddEk0kTTolzqlCVIVKUmUkklN2RKQsawh xMAfwSdWB9N/yZ/eVEloaWtaACOeSot2a617Om3qOMWbg4x2MFBpzKn9YqsYSWub6Z0jU6LLq0qA 8yjYR25tLvB7fypCIBXSyGQDpfWyTi9Pd4At/ALHy9bGnxaFr/WUT07Fd2a4j8D/AHLIyTIrPiwK Q7MI3KBw0KArB4QNpSiqQUAlAhPsKeCAnWh2mB4q3NG4gaBTg91Kr+bEeX5Ak7lNBTIU2cuXdFnw DfwKwzwtq1xPR3jsB+QrDNjZ27hPglHqqTMcJwot4CdOWrpkpQ7L2s0gk+ASUllVMh5NhE6DgI1d 7X6cHwKqvMknxKSqKgfDlPVubYA0xOg+agAVaOK9uJVlabXWFoM6/ckSKorog8QI6NUyeeVYaw20 tYxoLpggDX71Cyv03uaTMHkd0bGybKZNLRMQSB7tdOUDdWF1VMiXfVHdS/GcGuI3kSWg/R+Kdtu2 CoWeq+zc8GXpelcNDW6OZgoVY1UTRPCNG1jXfptvZ/HxV5pcCC3QjgjlZ2HTY68EiBXytQNVbNQk K7O/8K45YPXtfpvssLrGNgPcGjWJIE+Ko5XUHWMNTXEtMAyfDhH6g7bjujvAWQTonYcYPqLX+Kc1 LGRhhQ4o3I+bMuUjfY5grc9xYDIaSYB8ghApKxTjcR6Oj0bpdvU85mNQ9jHfSmwxoOY8V1tH+Luv e26zM9R7dSw1yz4GXLh8TKsxMmvJqJD6nBwjTgr0nG+smJfUyxrYbYAXAHWVn/EJ81AxOE+kijp1 bvJxwzjITHqu9Xmcz6k9S6dd69bhk0t9wdXo5vxb5eSreteHbi924EmZMydCu5oznZFgbjsJYD9J 3E/FYXXvq7dj+pm12CxjjusZEFs+HiFWxc5PJLgzECXTpbrcpDFjBjEVxG3CN1xBBsdqCDqdQTJH 3qb3vyr91hgmASOwAhD2FOXekxzu5VoCzTPzMxixSmBRA0brfs9Y2saCeJI1Q7HscYICpstP3KRc YlSjFTgyzmZs6lu476qnbgIPfzRbL/bLTPiO6zvV0gqIvOrZ4QOG9UDKBorqTGuIvboTo/8AvVAk wreVbNZb4wqasYvlprZvm0UTyoklORyolSMaCywkx2CtdNyG15LHWAvAPtB4VEmVKp+x7X87SD9y aRYXRkQdHpM24XVtcNXD8hVN7m1kNbAJ7qxRZi21B7rHMYdQB7nHxHkqeVZQLXPr3FoPsadSfioY kfLR0bM4GuMkatR42vIS0Sc8veXRE9gkCp2od14HgngeCYJ0lK08ISgJdkklKgJ9o8SkEkEqDNeS njQapApFJSo8/wAEoPj+CXZJJS0O8kod5J5TJKWcXBp0H3o1XRrbKm2b4LhMQq9jg1slaOMbw3ex 8MLd0SfBMmZCqNM2GMTfELcvKxLsckPEgfnBFprtFAsLTtJ5/wBitXsftPqunfz3MKlfcHZPtJbU QNvw8U6JJCJwiNfwSa+BTa+B+5HsGO0Aby10cnVpQQZEo2xkUsCByD9xT72+KUpSUkLFzfFNub4q RKWngElMC4AEympoGxwePpGQ7wUy1p7D7lOi5rK3NgTx8ihIkBfiAMtezSfjuYeR8O6EQ7iFp33B lcA8iJ7qjvJ45KMSSFTjEHdk55axo7wma7foeUJxJOvyUmHVOY1OG06Jw6QJGqkWudO0ExzCnRi2 vdEa+CBpcL+1i3dWRP0H8FFRc+r0mMq5OmvwQYPiEgVSjRXSTQ49x+KUO8R+KS1uFRTk6KEqNlYt 0ZHmpUu25FR8HtP4qPAKjMOB8EUF2OuuL+lsH7l0fi5ZF8+nTIg7YPyWz1N4+wuO3cG2hwA51M/x WTkuY4s9Rr629hEn8YTjt9UD5i1kNFMSY+jOhUJMwgCosdfNIzCnud4piTHKKnco/mW/AfkScp1M aylgGstB/BRehFM2r1PJsqwqqmGG2OcHfIrGGhn8VuZNH2npdjho6p5eJ040WVj4j3vG/wBrfOUS QBqgRJIAS4ld1mjRIPiQNfmrP2PIn6I/zm/3q9iPbvZUIDp90d4Cv6DsEwZCejLkwiJAu9NXC+xZ B7N/zm/3qucF/rj1HtEuhwkaBX8zqxJcyiGtGhf3PwRun4YtxvUtrDi86OPgjKZrXRbCMb2ukWbQ x2K5rK2tc2IeHBY4x7oOmjdJXTt6Nj2Haats95MfgVi9TaMLMsoY32CNkzHH0kzGd4g31X5ZRkQS K6Oe1j3GGgkjkK3vu+wnFNckv3h0jT5K/wBMOLa7Ha1gFjQ4WHx00lbuF0uvKyWUMDWusMAnjiVc w8ucsOK+EA9WpmzDDPhHqsA2Hjshh3h54gTB7p25GxkNAhG6lkMsy7AyPTrcWMjuAYlUjE6KKUAC RdgMhyGR4qoy1dvDf07LyMep7vb9Fw4PCNmY5pptsqsllerZGpErAbLSHt0c0yD8F0HUL6rulB7H gusAhvfj3aJDGK06FPuHXpo0K8uoMaxvvsOu4efMo4FzuxWf00Tl1g6jX8i3ZAGqgyQHE3eV5zLj x1EgjxcjqG8Ujc0gT3WYVrdWcHVsaDJ3cD4In1UxmZHV21WDQtI+EkBSYwBFr8zllmycUquq0cYA qWx/O0x4wYXrVP1Yx3mBYWx5N/8AIqwPqnWBH2h+3mIbH/Up3EO4YPtfHCD4Fdd9Tn4mTjvxbf56 o7mieWn+5dk/6sVNj9I90+AZ/wCRXF9Y29K+t1LKyQxu1ruJh2h/KoeZh7mKUQdasV4M3LzEMkT3 0NvYVRS0NYNG8BCuBuxbnXOAfYHMrB4EhQt3taQ10zoCQhYT2jcTDnNOvcSufEa9XUF2b6B4ht7i CHNIc0lrh5hNkWfowByRwVf6jiinOyGxO55eP7XuWZeYeQeeAt7EIyqQ6i2jzXNZpw9uZFA9krJF Y8yoPyWNBaddvJCHlWuppEcn2gqvi1WZDgxjd0qWurSs3QbDcyt8jv4KItmyRx3RD0XNLSW1xt11 PKr2Nsx3xc0tdwQfDyRBB2VKMhqQ2bfdp80P0yna9pbM9lLc06AiUyyNF3CDqUfpEpvR/wBZRoMc Jtp8CjxFBiHLIhxHgk0N3e4kN8QJUrGkPcB4lQ1CkYurqY1+HS0CtzmviC48ob3V2OgPBJPzVCVK p214eOxQ4a1XcROhbbqdvCgQQrDwYnsgEyU3iK7hCwJTykEoS4ijhC86J5SDdFF7wCBEk8JcRVwB mCkoB7JgiFIgDulxFXAO6/Kkk2i1wloP4KLmlpLXaEdilxhXtkLpeagDroQn93+pR4gjgLIqJMAn wT+7/WFC0+w/3JcQQYyDXeXPJJ1hW8C+50UDU/mhU1KkTZt4LgQPin8IOhQJGOodV9GQ8OfY0hrO dFT6rXRVZVXU8WPayLS0y0Gfoz3SGbmPqe2y1zq2jRp8ToqfB/IncHDEdyVGfEWQeZ15RGXRAdwg iQkNE2kW3JSUayXMB791MBBKxSTIdj4gBBQZueB3lQbcRYI0Due6gRKiDof9e6IF7putkmU4h4Di gS4cHRFsZa+No3RoPFC9Nw5+5EaaIkbNsXS7VWcDGdfc1msT7j5ImD02/MD31N3NZ9MN5E9yPBbe H059DPaA3vrqU2cqXQgZHwSY+NULBTthh1+5KjEq3W2gQ1xOweQ0VjaBqD7oj4Sh32spqgaADhQ2 W1Q+xy8ltLLLH3AvI/m47Ss9SuzDda5oPsOsR3Cgpoig1chBOi4S7hMknMbaKh3UiolRsqzuE9TN xk/Rbq4+SThopXu9GoUjRz4Lz5eCaey4Dqejomx92EXESS9pAHxEBUOoOP2qxlrY9MyB5eKuYV2z D3mfZDvbE6eEqp1i6t+W28NhpADm+MGdU+vSgSAndbtU2Y7W7iNxPAGiaz03NBaNsDU8yoZ2R613 ta1jGiGtaICEy1zeD8khH7USmCSK0X3+AlOT7ZKuY3TvtFZuL9jewhPb0ixpBa8e7VrXcwh7kQav VPtzq6bWJ1Cm2sNcRW5oAAceYHKK+xuhkQe4WR9jyDMN3FvMEJ8ex7bPTcTA1APYpaVoUakiw68t 27ZJbM7exKPjmvhzRHwVRrhoiNJn26KCUSdy2YSA2DeAwWP9Ys2uAPuChXhZ+fa1lEPFo0YXbNo8 /FUMqx3pOE7XeHYx4FWMPqJYQ4Eg8BzTB1EQUBCUY2DaTOMjRDWzMXBw3mobb7G6O2F2wH+sTqtb ANjsRjSN2gcQIgfJZ13SnvPqYz97Xn8/QiVDJud03GdhttcH2D3nmB4gpxPEAAbl4rBGieL0x8Ho 2OaWbdonk7tBHxXGZzczKyH2mp7juIaNp0b2jRN9rynna22xx/rGUS3F6o1gsJs2u10eT+Qp8I8B 1I17sRHHtZpP0TGvryw62tzG7Tq4QOFsZ99rMSz7K+L9A0tcA4eMLmWmx8zZZppq4pGvxc4/Eq3j 5icIGArVrzwQlISN6MbMPIa0veAO5kj+9BrqcbA0kNn853CewtaYaZPcypb90eMqIWvNXo2BgmNb 6v8AORDSzZtOQzTiJI15VM+SQcUakNpfgm4n9H8WzUK8V4uba2xzZhsHumtzbbdXuPwBgINjHta2 wj2ukNP9XlDku9o57QmmF76pE60GiRz9ZmfCVq/VnMx8frOPZcdgcQ0v7fNZtuDkVNa97dHCQUKt rt0jlqRApVm6fccQzP8ABXgRC5vpXXcMYlJusJea27y1pjdGq0B9YOnx9J8f1SmmJ7IbtxMiF5L9 enFn1lteCZ9rgfD/AFhelO67095GywweZa5eb/Xar1usfaavc2+GN7ajj8qMRW40Vqduj0+K9+Vg 03Bwd6rA7dxrGs/NV/tDsWx1dkAjUEdwfyqPQKrqOkNqseA6kuDiZIAGqxM/r+LkXA1MfvbILjoH DxjVY8cEpZckQLiCXXlljHHEk0ZBPn205GUb7W7iIkSRMdjtK0Oq4P1f6l0KrP6c5mHl4g/S4xn3 CdQXnk+BXLnqM2EPHsPcchEozbxTbiNyTXjWncaw3duI4HkrkcM48NEx4art4rc+XBkxR4a4x83Q /VRw25bmU2O2BzXOafMCUfoOGwVi95OhOg8Aqf2l7b63z72ugCNNpHuW905lFdYBEVER8FZkSBXd pY4xJvs2mZONYwM2OrsPZwiR4gjRc7119DnDY4Pc06gFbraqmixzSRLfaXH83yCw+uNqqZXHvdZJ BiNsfDlNhXFpoyZb9o3TUxrXXEU101FzWFxc/wAGjcdUhW9h3vLGnQ7QdRPkAYVOsPLg1k7naAAx yrbemdRcT+jMnxcP71KREdaao4j0JpK7Jra4Akkd3N4/EBQszKh9AuntMJj0jqPJYNP5Tf71Tups quDLW7SO3+5ARidiukckRrGvMM3NZY4uB5Kjfi21MZY5pDLdWO7FWMTEsuljOAQ97x2aFu5uH9sw 6cSqstrYBteQPaR9LvJQlPhIHTqux4jkjI7GtPN5rFa11jgRI2kfehhrmuLSBI5lXKcR1Tn73BvY EnsgubOSQCIMCRqnggksRgYgWFzbkkAbhA8kn23PgkNbAj2tifMohwmlu9trtp7Bv/mSh9mp/wBM /wDzf/M0tFa1/axYX7gHHQ+SOAFGvHx2kE2PJH8kf+SVimmiwkMc8lvIIA/78my8l0dNy17i5rIa Jc4wFr4X1eGXSJcW2n84cBV68OttrH2S8MM7dBr960KOqnCO5oga8EAkefZNPFpQ82SPBrZvs4fV On3dNyHU2N3D82wcEKszJ2iC2Y4BXSsyD1eq6x7A5tR97nxGo0gLm201tscLC4NA3e2J1MN5TwbF HoslExII2KnZVxO4PI8kZ1n2mtrj9MfnI7OmYNjA6u57/wB6IEflU68DGrEB7z35/wDMUyUojbce C6MZnc6Hxc4nx0ISFjgOVr14OA582Nc8eG4ifuarba+iM0+wVu/rPud/34Ie7HsVezLex9rgtuB0 dp5qN1gI2jWOVu24vSX1ueMVtLO9ge8R8N74WSMbEszS3Fc5+O3VznaIxlE60dFGExQsG2kfDgjs kHbHtcOWkH7lru6VTaA+h0jv4rOyMb0X7C6D3T4TBKyeKURrSb7LZYHNYAGF257+zW8yVRdBcY47 fBXmZO3GsqBJdYwM3duyqemPH8FLOYkfJiEaCMpSiemD3P3JjU0dz93+1NtVMqrPdB4OgVna4dvx VSsDe0+avAlMmapkgAQbRlp51/BV3ul09lYvc5ten5yqEnulCyLKJgA0EzGPtdtrBcT+bC08XpVd bSckEO5gaq10rDrxMUZVgBvtbLJ1gKD73ucS58DuYgIWSaGy4RAFncpWsxaWEsYBHjqVlvpovtdp 6R1I8CUa3JwmW7G3lwHLmtJaD8XQVZb06h1Lch+Q1rX6s8x4pwjSLMjQDk4edmdKyfWxXQ76LmuE tcPBw7q/b9asq1wd9nprPfZug/KVL9l9LuL2uzPTeZ9J5BLP7XtkLJtxLK3EfzjRw9swfvTqB31R U47Ah2KeoX5GLdkVUlxpP6RoPAPdUcnqxvqLNpa4954Wl9VLqqTfTkCG5RrYwkTzuaVk9Yx6MXqe TRST6VTyGpoxgdFHJIjdrMre2LDq06E+BPiiodD3POwk7Odo4nxRi0dyR8QiTR1WiJLFJPtH7w/F D3+6O3ilYVwluO7qKkUwBJAHJ0TF43TY9bSHW2fQrG4+ao2vL3l55JV3Nf6VbcZvxefEqloU2O5l 32Xy/d+10sXXBePFh/iqPUTuaxp0dAMfJTyM/wBOhlFOjtsPd8TMBUC5xMkkzyTypRsxS3UYJBI4 EfckNvZRlKDOmpSQ2K83IqGxlhAHbkKQz8nfve8vnQgqqfxRcetthIdwgYx3IXRM5EAFsDPvDpMF n7gER8Fq9OvZmvYx8P8A5TgC4eOp5WGWljiw67TEo2Fa+m8lnP0gEycARpoWaEyDR1DudT6YcQNu qJdQ4xry0qvW4wNeeFotzHX4u6d9Vg221E6f7CqP2f0nRuHp/mzGo+ChiTVS1pkIF3FV1W+p24cK hTj5DnltYkt5WxWwRJI2/u9gE2T9Yep09TycSt7RXXa5tZiIaOB7YUmIyINC/BjyiIMSTVtOt2fW Qz03nwA1Cz7KM7IyHWOpseXHktP3Le/bfWD/AIcDWODx/nJj1bqp5yBzH0f9qeIyBsQ/FYZRIAMz SXpX1dAqa62txe4S48R5LYq6SajLayY4khc7Z1Pqen6zpMH2tCi/qGaLdv2ols6uaW+HkFHLDklu B9rLDmIQAA/Jsda+q+dkXi7DoHv+mN7Br46uWZ/zS63+dXW342N/gSrX2+8xuyn6Eg+6NPlCj9vt 0nJsOpn3lPhHLEAenTuWKc8U5GWovs08j6r9Ux6LMiwVBlTS58PkwPAQs1mhC0M7Oue0Vi17mke+ XEyqGgIhSR4v0q+jHLhv039V+6cRPwTmq4N3uY4M/eIIH3qLRrqfvTlqSmv7TfXQ55DXmB3gnyVr B6W45rqrHbPR5jug4OFdk5LG0O2vDgRYTo2DytprnjMtbkEC2QC8CJgcwo8hIGjNigDVjZldjNbT Z6m4tJnkAIVFX2R1b2MG9jm2OLgDMagfBaD7mWbKwwFzTuc46iPBGpxj1TKe1gdVQG7cizg66e3t I5+ChskUdmyIxBJ6unV9cywhl9NNbY+k0NdHyCR+tNuQJqbRsJ9ocGj8q47AxW2dSd0/KJrfW5zD tbulzOWxLeYWvV9VR1Cx32F73kfSZ6Y0niPcSl7WEGql9LYRkyEXY+rpZ3Wn5e3GNddJbzbX6cT4 +P3JU3/U0FrOoZVjshpJc/3Bo+Ba1Vmf4uepmZ3ADxbCtV/4tMsgbnGD5gf99ROLHsOP6KGWfXgc rrPUPq7e2yvpz8ysvESHksf/AFmP1/Fcm4w4t7jghdIen9Npu2gWPLXOrcA8Ay3wjspdb+qmPidO f1Cm50sDHOqOuj476J2MRjoBLzktyGUtSRp2eaDg9uuhlJx0UST8kp0UtMNpsS1rL2l/0eD89FvY thx3jGuP6G3St/bXsVztG03MDvouMH4FTGVk07q2Wu2DQNOoj4FGeK4iQ78JXY8vCSHqM97aqS17 QGV6myT9HwhczmZf2qzdG1jdGNHYKL/tNmN61tjjVu2taSYJ8vggjRD2jGieosJnm4xQ0HVPiVMf kMZYfafDlahwKyCWHjUzosUEgyNCOCugwqsrOxhazaGD2n4t5lQ5zKNSBoN/4ceWnGWPKPVvGTRN bBoWhRDcRu9uQwAWtAqsH5rh/ete/BusrDGvrkeclEwek4VNg+0OLrXja2/TbW88P2nQx5oQyg10 K7LyUrkcRGSAF3t9F+hANxHVw0kOLXSO6Nda6phILmhpJLTxx21Wrj9IoycY2V/q2bV7Lw36LnN/ O2nseyp3YVjcO27LcGva8VtYBBcDoTJRywIOoYcEuIiETR2p5MYlOQx9tJIe3V9b9efAqo3YLyGn 2zoTp2WpZgnBsN9b99DtCDyD2lZLa3m8uMAamJ8in4zvrYYeYxzgeGYqX5+LeqadgjwQrg4E6qxT O0fBAyTqpWq1958Ug9w1BISbEGfwS078JJWdbZ+8UNz3HkkqT4lQKSnW6bkvo6RlFgJ94LvAaBo/ KqDQPTseJkloP3z/AAVv1RV0FlLR78m9znu8W1xA+9VAYx48X/kH+1MrVl4vRXZETBkaFOMjIb9G 14+DiouUe6cWKyNkvr3/AOkf/nFMbrone7/OKZRcdEqCrPdi5znGXEu+JlbfQhW+lzSBJMOP4hYa tYt9tA9arhvtsHj4FCcDOJAZMWTgmJHV3rKq63FgPucYPMkLEzGhuQWDWCAjXdRaW7mFxf2DuAqY c57w4mSSSSmY4kalfmyRIoLOcQVHck5MpSwK3GUi6UxSQUElLCTv8OEdlruDGvCB6zeGktA4hRF0 cgH4phBLYjLFGh16lPkOaWNEkOnVqFWwvfJMNESfij00jL9jntrcPot8US3AvGz0y17RBcxpkjzS sD0k0uOCUzxxBlDw/g7GZk2Y2Oylv7ojvAWJfl72bWOIDv5weIHAWk0HIxRXkN9J7GwHdz8QsOPd HYJYyKofVjzQnEiwRY0ZSIWr9XcptWeymxtbq7XNk2tkCOfGJCyY8E7XOrc17TDmkEfEKStGEEjZ 9BttpuxXuqp9N247gAPa0H6W4N2/JCLmfZvs7m/o7Q5ldkAEOdq0aR2WSOqZb8P7SygOyHgOsYwH 03/ynM4VpmZlMrpuJAttHuEaR4QVGcgB26tgQkRfF0eerbZjWZWHkWlr6Wl1B5G9jg8jymEOhjeo Z9z7ATvl5A/ld5RevZpzMkepS2q2vQvaZ3A8dlSxsq3HfvqgHaWO82uUvFcWAij5MaR6OQ5r9A2W lXqHU3P2jQeZWfY9z3FztSeSmaSCHDQjhRyhxdaXRycJ2tt5trQ702cAcqmnc4uMuMk8pkRGo14K M7nxV1um+rGOG1MOQ/8AN+iPNCprNljWjvop9RsG5uPX9BnKilrUR1ZICgZH6NS17rJscZc4yVXs ftGndHPdVrxqAnRGqyZNWw3TynBBCWz2bp+STddCpGNRiNE7dB5qewd1JldReA9xa08u5gfBJKLl 0qdby1wMDzUyGAnbqAdD4hRfBCCgaN9md3898QChucWPDgdeE7HAsO7VwIAPkiMobdpu2kIbb9GX WdmO5SMa91bXF7iD+aDCPj4bbrIEvkaAuKlTQ1rI3E7Rp5qVWSamFrBDjqN3ZRykOi+OGe5Q1WnE zHVyHVOE7SSQD5ean1Ij9tZZ8bCfv1R8PpruqZoNjtoGr3ViD5D5qHUC2n6xXuIlldzSQdZA2qTH W7FlBBET9GqXGSATA80pPitj619V6f1TqFeRgVejUyoMc3aGyQSZhoHisZSMSxKUpFMkplCfgJgC l3jwSUwGPbk5DMekbrbSGsb4k9lu4/8Ai9+sl8F1TKRx+kcQfwaVgP3G0Bh2unQjRdfj9SsxK21P fY5zQAQHv1PxJKhymY+Uj7GbGIEeoH7W/d9RvrJnY4xsvqNDaht9jWkj28dguN6x0/F6ZlOw6MoZ zq5FtjWBrA7wadzifNbNmde65z/VyDU4EGh1ztmvj3VOynDe4uGNWzyG6Pu3JkPcB9Rvwql0xAio jh8d2v8AV/Nrqzqqb3BlT7AWvMQ13Gs9iF1HW+kMe37Swaj22Ec6fRcueFdLPoVVt89oP5ZRnZWS /R9ryPCSpJWRVIiRHrbFpur3Vc6H3cceK63o9DcXpDK3kl1rhY5wE/S+l+C53G+xPxi6213rgu31 kEhzRr7XR96qU9Str69g3WWuNbw1pBJgMtlnHwKUMMjGUjtGvxXzzRFAblbq+7D+tldwMF1lNpPG roDvxldFmWU9OznZNTPXGQZcWXFjmEcj2ng9ljfXDDc/Lxb+C5r2WHw2fpP+/Fc4zIeanF9xaRo1 gHKMok1TFGYAIPd6uzq+TeywC+wCwu2l1rvZ5A71SdZdy/IB+Ly7+JXNG+4/nu+9RL7Dy4/elwy7 hHFHsXZtbUHhwcJBmQtXrP1lx8/pb8FlAre9tbTcXD8yOdJ1hchJ7lJKj3RY7Jn1hg+m1xPIBlQU Wcyj4zaHvIuO0RprCcFpQ8GfuVzOoJroymD2XtjT99uhCJ9gxn6ssj5grV6VjUupbjZDw5mNcMls j80A7x+AVnlgJk45GuLY+IWZCYgS7IcnorrK6amXMrrpbDg6ZL/zjp5oP/N9g+llt+Tf9qvF5fD3 fSf7z8XHclChzyMskjel0PIbL4ACIsebQ/YeO065JPwaP/JKzi4tWNW+puTcGWRvaza0GPiHIsSo O8lGRehXiVbM6Di40+kHknlxIn8AFY+20uhpqLpgH3ETPwVI8qVMm6sDxn7k3249maPN54xEIzMY 9g9DT1kUBoZR9FuzcXkkgcTpqh5fVxlsNduO0NOp2uI7z4LPLtUxOqdQYxKQlxA0d7SWHCfW6t+N ua7R36Ryp5WB0+rBtvqxRW8NO1/qOMduCjlyq9TMYNnnA/FARHZWTLkl80jLzc6t8MVW50lTD4bC DY/hPYVm8JzqomW6Rwoh58EkuhgdGu6hW+yuxrG1u2ndPMT2SzOiPxMZ977muLI9gBnUx3TYXUc3 FxbG0Fray7cQQSZAjTUIOX1bOyq/SucCwxIDQOPNOIoC+qAWJcPRpbJ9rSdePc4nRRs/ma/5Rc78 gTPjazyYE1mjah4Nn7yUJ1xaLh8qNyi36QTuKYeKCGZIR8Omu57vU+iwTHHJVQ+RlSa5gY6RLuxS GvghuZtOLVT+jDd5I1Bkx96q1mCW9niD/BChSngoxNG0kWyDf0TnHmdo/ipV8/2UrBDGfygXfeVK pjnvFbfpPIaPiTCRI6K80bk0LR6l0TL6fWLL3McHO2ANIJnlVLaGtA2PL9JcIiD4eaCkPCPSytzN zm7vmR+RAVmoH0dEKUka3EHNIPwJKLWcNrgRUGkeIlVYdypAO8U0wB6n7V8ckhtX2Om27HcIO0/y ZgfcFZ9WinG3UD9PuhjoEBoEmGBYZ3fH5JB9g4B+SZ7A7/az/fJdq8tHSf8AWTKDHMfi1kkEFxaT qe8krFnSPmVZddbtIl2o4OqqtUkYiOwAvswTmZVZJruqPNKB3UtFGNEVjqdO6pZTFBMQPa46fJFy urWMIDocRIbprqsUkHlNMkakppxgm2QZZAUmycl2RZ6jhBiICGE0aykDonVTGSSbK6ZOmRUpLukm SQ7lO3Hx3XuGp0bKztznuLnGXO1KsdQtDnilujWcjzVUcqCPWXdsS6AdGXZQyqmtxq3n6djjH9Uf 7VNoLtByTA+abqhHrem36NQDB8ufxTo/MAtPyktU/wA2PMqLDqpaljWt1MnRLY9mrhAUjHRPRmOU 6h6kJvU8EkJEx1CiHPJ0BKI3HyH/AJpHx0SJA6rhCR2BLBn0HR2KPistNgcYa0gmSQBAULKDRAdr v5+IRDSPRaPzx5pkiCPNfCMoyojUdG5uZW5wL2k8SDI+RCETRP05+EoYAHISDmPurpJ2h7gHu8AT qmCALYOUx6B6n6sVFtZe1gcy0zu7gDRYPXRH1gzP+Mn8Au7wK8aqmuqqsNYdKx4tA+kVwv1jgfWH L26jeIP9kKWMREaNXLIyNlpPI3FO2za2IB15UXfSSBhPY0zm5IG41lrfMED8URuPlyHW1mus6l0e PHK1HdRwn0y97dxH0CODx2CtO6j9WBWxjrci6GtBaGxBjUCYHKMasEiwgvO27q7NrXefZQu2C07C SPE8zGv4omS5rsgvrDhXrs3DWAVWJ1lKZBJIFDsoXWqO2dy6O10uDv3mtP3gLnLZ3St6t27Hod3N TZ+QhMLJFcqKkiYz62PJfAkaEiY+SC5CU3wU7iw2OLBDSdAhykhz8+6+ux9bLHtrsaN7A4hrviOC m6s7bm7GaegyusHza0T+Klm1Pty6q2CXvgNHzVK57n2Pc8y5ziSfOVMCRiI/eI/BjPz+T1nX8vf0 iu+ZfcxsH+u33flXHQr2b1J+TiY2MJDMdgaZ7u/uhUVEuK8JkkgihPRhZWQCaKnWAGCQNFZb0Lqj v8BH9ZwH8UXp1tw6blNpeWW1w8FpgwOVSdnZrvpZFh/tFNsrqFC+rfq+rmZE2Ftf4/kR3fVymJbl 6zruZGn+csgWXucDY57m+ZJCiQHOMcc6o8Mq3RcezrfsLEb9PPY37v8AySNiYXTaLS37c2w3MdSA YMeoNu4a8jssEtAPinLXNhwOo1EdoSAl3Vcez0tjfTea/wBz2/domlSvsFwqyRqLmNcSP3ohyFKC aS0BjnEPG7wBdtQrNoeQ3ifioymJKKlEouICbiQPot/KgT96lT1WvCc9haXOdCCtnQLTPdRLXDWD p3Kpu+sQnSoj5hAt69vEBkfNFFujPiqvVp+wF35u5rZ8+VT/AGw48V/DVSPVabmGq2ncCPaBr7vv Q2TodHN3iNFB/Zdn076vfVe7Ex7XdSx2X7Abq7fUEP5I+jGim76t9Ha5xGdiOaTo9heWgf5hhNOT +qV3teLxe151UXNiJK0M/Gpx8m+mixt1dbyG2Vnc0jxBVWlpdk1AFrSXtAc6NoJPeeyfejHWtIAT tcAdFFwHZd2eidVrr+1U42HkMq/SQx9bwQ3U+0OngqWV9XvrPeTfV0qtpsA1rG4RHI1MSmHJL90s wxQ/f/BwsD6sOsdXZm3CrHcA6G6uIPn2VbrfTr2ZzzQzdjn21PBEENHkt2zpf1vDm139NtbjhwLw 1jidg4aFi57upY2S6rNxGtc/3tZc1wO0nTuEyPucfFKQqtmSfs+3wwib7uQKLHcbfm4f3pzQa3De WkOB+i4O++Fp1ZhY4erjY1bP3gyTPzlEsxbOouZ6TsVhbMBrmVzPjwpOI2wGIA8XGDA4hsASYk9p 7rpcb6jX3U2W152Pb6bS5zaj6nbycs6/otuM4MybqatwJDvUa4aebCVcxep/ZQLKsxjzXE1gBoeB 2JAa5NyGVeg19LXYoxv1i2xkf4vc9lPr1ZdNrNodLiKxBEjV7oWBZ051Vjq3O3OZya/eD8HNkLdv +tmTk9NfhuqY1wJNR27wAeBFhdEcIX1ez+l1120dYoG76dWQGF5kfmuA7KMSyiNyPF4Bmljx6ARq /wBJx24m4hoBJA08fuVpnSa6m782/wCztOrWxLz8AOFd6l1OyxhrwmU0Y24+ldW3Zbt8HNnT7lkG oOMufLu7idU7il+9Xkj2h+7fmiytosPpl+wceoZPxQSSRyrRZBMuDv62qGS0HgA+LePxUgkPNhlj kDtSF5tcxoJJa3RvkOVYpJbW0eSW8AaO58UhMaog2tlHhGqQO+aU6eHwQ06K1JvsAgO+9MbHd2g/ DRRlMHIqZ72kGWlsqrxKsTKqkmSDykpUqTXhpBgGOx4KgSm1KSlzLjMaJ4hGLR9kZ4h5H4IPzSTK NV4i1JhqPNLVM3RxB7pIZJJd0klKTItND7jDBp3ceFoDBqFLqx9Jw1f38UyU4ggdSWXHy85wlPaM QZa9a7NQ6ncdSdSUgEgU7UxcC2MJrRcXn6NQLz8hp+KoZBL5cdSSSVeaTXhWO4Nzg0HyGpVRzCWO I/NElKO9/RE/lr6oaHit24ieyuNuqcOxVAt/Rh38oiE3ZSSiCjHmlAVVh0f0B/NH3KQ9Afmj7lQr F1jgxkklXm4JAG90+KjkANyWaOYnaAZetW3gAJhkEn2CfgmcMWow86jtyn+1VAexpPwam12BPmn3 z3EfJjZv3Vuu4mGjzU7xDdwEHyQrLzZoWkRJBPiAmN1jvpNgd5KdwmgxHJcibu+rJzoZuPZVWk7t /flEyHjaG+OpCH21T4bLcsrNPqGJbW+iq5h1exkf1SFw/wBZmx9YMmPFv/UhbP1Y6tXbhMxHu234 +kdyw8EfDhY/1pP/AGQXu/eDHD5tCk0Yi5r53FIa6H5roug9R+rOLhOHVMVuRlGxxDnMLoZA2+XK h9bzhuswbcLHrxa7ccvDaw0SC7Rzg3vHikhyMqh1O0FpaTPPOhSq6fnvrGQzHsdQNfVDTtgHmVUF tj+XOcfmV1XQ/rDZjdLfVjO25FFZIY8S1xEnQHRAmVaAfVcBH9In6OBdWRZYT7t0mstMiSRyhNos J1EBW7smzIudc9grdZ7i1rdjZ8gNEmkSmGZHRcIA9Wm7FsdzAWpjEfZaq597GkOHhqUGJCW06EJn uFeMY6NuNFEhRryABtsE/wAoLT6X0d/UKXZdj/s+FXJfaRLobzDB/FPBBQQQ5ZSgpZ4fXk2swgbM dglltoDHEHuWSVnfaMqz/Dhs6bRoQitSZ77Kbabq3bLGztd4FZ7a3vOmpKuhnqs2vebIn6Q4+arP x31mWmR2SGTTgvZccMq46R3VOq2tcQS7WAhkECTweFYNbnua57S4xqDoFFzYAGyY414RDGQhSRfd wGQl+lHAj5BKwrhJ6Nzolgbmek4+25pYfmqVjDVa+s8scWn5aItL7KrWWn8xwKP1usM6i97fo3Bt rf7QQBF6JIIGrXpBe4Ma7nsrNeNtmYPxVAS0yNCpb3nuSpBIrKDctob6bnAiRqJhVHOGu3QFMA89 ktjkrJVQdnAvB6SdC849kQ0Sdr/9qQynO+hj2ukwNO/gg9Bc8ZFuOCW/aKy1pH7zfc2PNSNtxPvN pM6y8hRyIidWWEJTHp6JbWdTYAThuYCYBdpr96AX9QFppNbGPbyHGPylGrutaNhse+p30qrCXNiZ iCSrT8nBbX+i6fi7+znb3H/NcIQ44d0+xl/dJctt+YXAbqxrxoi/s27IJtLQ4zqWnREfl5z2lgey qs8sqY1gj+yAi4ma2issI3EHWCmSyR6Flx4JD5otQ9Jub+Z+KG6m3Ce2w0seNQWvAc0z4rUf1OBO wQfErLzct1ri53H5rfBCMiSuywjGOu5az3V7jLQJ1DRwJ7BTrfQeYb4GO6rwXu8J7rT6d09l7Tv1 qb9LzPgE+RAFlrwsyoN/F651KuttdXpPa0BoHptdoPko3dS6ra9znsYWuEOq27G6dwGwrbKaqmbK mhjR2CW0O/vVf3T5tvgiRrofBq09QwBQ+vL6aX2OB9OytwEGNJ11Q7upB5Bx+mY1TB+9uLiR5l6u +lX2CZ1LSNdQne8ewWezHuWmeomwgW0MFUGWgwZI7EKzjdV6VXXsdRe3YSA5lrgdvbuouxKHHVgP yUD0/FOpZ+JSGX6J9uPa/Nsu+sGOzWizNYO03uH5CszM6j9pvNtr7bXRANzy8geALlZPTsX9z8Sh P6VSfokt/FI5AdyVwjw6iIDSN1fh96gbmkatafi0Kxb0y9v0IePLQqm9j6zte0tPmE6NHYolKXUf gpzmHhgGvYQn9QcgR9yhPkmBEJ1aMfEbZGx0ym9R/imKtswC2pl+QSyp/EDX/pEBKh2QZHu1CXcy mJPitev6vtyhOFl1vdE+lcDW7+LfxVXK6F1fE1vxn7ez2je372SlYRZ720ZKbRIg8HnwSRQVjCMO AgkIwT4sU21h2YDQ5uZS6zcdHsMEfimy6aGxbjFxosJ2b/pDbEz81WTtssZ9Bxb8DCXDRsE+Votc McWlwEtbG4/HhR7qT7rH6OPmYAE/GFFFCkOwA9kRQcCSSATHJhJSMNadUatodTYwciHj5coSJjlw ubt1JMR5HlFdj+YeOn2pxlW42J9nZtLchs2bmhxiZG0nUfJUo1RslzX3Et0a32geQQkk5PmIv5dP sWS2b9Bz2SRKDFrfPT70jssG4VRi33SGN1bzOisUdOfum7Ro5AOqv4dexhJ5cfyIkalVpZ5WQHVw 8jj4YyNknXwRNY1jdrAAOwCl2SidfDRP3hRWW0IiqrTZyyNVNo1UYVrCq9S5gPEyfgNVOS4wFrZr doqoH+DbLv6ztSmFQGFY4/nkNH5U19nq3Ps/eJIRMghuLWzuQXn56BDWh5rtLJ7BqUUVueGOjbO7 X4KOZQwXOLdW6aNTst2vafCPyFEdlMcYLZMzoFJrYPgx+mq21Xx9lFYhur9XHw8kX1WHWeUOd7YH 3JNaBEifimkWV4Oiz2VvOsH4qBxu7CW/AynukSOJ40U8Nl9QLmNDy7u7gfBK6COEFCabWaudLeNR rqFMUW7A7boBJPkrWV9s+zuc9rBXoSQdeVaDS/Dn96v+CByGhtqaSMYs76C3FcGi4FwnTRqtMrxX N37dAYLe/wAVSuJFmupCLRWXEua7bpx4qTQAErACSRFtNbjscHsaQ9uoIhK2xlrvUsbvdxuc6TCF 6Tnd3E+AUXY5a6HNO7+UlxxT7UutMy6mYa1snQCZ1T7q2cND39+A0f3qNNf6VoAA7/cp10VEDQ/B PEgI3XVjlA8VWibl5bbRstLNmjQwAQD8FYr6ha322jc8HS1pLXAD+r9L5qy3pWW8xXiWOe7URW6f yJz9U/rETubg2AHWXw3/AKohGGQWbO6JQPZJfm42UGV22epuB2uLtQfnwfwVf7Lksa5202Vs1dY0 aCf3h2VzI6Ba+sNe0U5LGgPZoJgc/wC0LPPq0N+zZrT6R0bb3BTZRtINMw8d0ja0IG5gI94+KTbg x4e3UtMjQpezHun3pdAmOQzwJHjCs4ufndNuNlBNZGj2GC1w8HNMgqn9qGm5m8gkmePHhR3OeYqY Xl3IaDpKIxxCDkmWzk1nKJyHMbLpIaAGxP8AVhVhjaRt4R253osFTqzvZo4O0gomPkOu3EDYAREH xVfIJ6mtL0bWGePQHqxqoLe34IWRh2vaQGkeBWniYPUc0u+yYt2QGGHFgkA/HhadH1Q+sFwBdjsp B722NBHybuKiE5BtmOMjfd4t+FktO3buPkpMxMnRu069uIXeU/UHqQDnWZVDHPPADj8pgKtl/Uvr dTyyl1N7gJDQ4scR/JD9D96f7520a/3fFd2fJ5RuBdo0DVI4Vg50WxZ0H6w1GbMWyuPzjoPvlRb0 Xqjz7oBPi6fySmHIepDPHFGtASHLGFP0j+CJ1SrdhYt30vT3UuPw1atdn1bymxZa/wBgIJG12o+J AClZhU1N+z5bxf8AaHh1YIIaCNI7wAn4slS1NsXMYrhYGzyoLR2TyOy7EdOwqRJbit29oEn+04/w UHZOJSPaaGkdmEH/AKkK194j0DR9iTybWXO+jW53waSjNwM6z6NFn+bH5V0f7XqLdr7GMA42Nc8n /qUB3VaNZFh+EN/vTfvB6BPseLl4uBn05NVorjY4HVzRoDr3U+obqsy1o0aXEtPkdVfZ1SkE+hit aXRudMkn5AItPV/TaKcjGFtOsAjUf50qHNkM60umzy0Y4yblwg9XCNzy3b+Kjuee63MrBwc1oswA KLSfdU87QR5S0Knd0PqlTd5pLmj92D+CiEo9dPNtGEjqDxDuHO1PcptSpuDmktcC0jkHQptE8MR3 DCw7Wl0qta4FwB+as3gbIPigPpdY9rWal0DTx4U2MaNXmPmAVjY773wOO57BdJjhlVTa2fRaFRxc cY1ZY8Q4GHTzIVtpAqB8df7kyfq8k4xw+ZSlxdoEoMJ6xpJ0CewhxDG/RCaIhfxFiCdIUjP3paA7 O/LvIJBzTLz8GhLhCuIq0CWicCTA1PKYtMwNfNNMFwmrRNCeJPkEp+5NMVwkxIULKq7W7XgOCIVE lCqTbk5PTbGO3U+5v7vdU31vrcWvbDvAroe6FZRVYSXtDviE8ZD1WGAOocBx0PwXRfWPHa7pHTsi vWraBp4loWTmYhrcXVNJZEkeC2MZ3236oW082YbiQPIHcPwKlibFhikKkLeaY66kh1Fjqz5FamF9 aeq4kCwm9g84P4BZZ4S1RvvqgxHTR6ln1l+r2eNvUsRodH0nNE/5zNVG7oHQs5nq9MzBQSJ9N0vb /nTIXLFoIUQ1zDurcWuHcaH70uEdCQi5ebpZXQs/GsLdrboP0qnB0/LlVn1vrdtsaWO8HAg/ih/a slxaHneR+cT7v85amBnV5M4maQS/+bdaZg/yX9kfUNvUFp4Zb+kuakr/AFbo+V0ywCwbqbNarBwR 4fFUE9YQpJMnSQpdJ0DD9HEdk2jS0tcG6CQNA0k8blzfZdF03r+BU2oXNh1bNmoMHSNYDp+5CS6I t1OodP6UXBn2VgtukguaWhp/lcGPMBVK+idObYC6mN/tb6TyTJOu7jaPNWL+uYV8e5tN4IHrAjcG TJaN20iUWjM6e6HW3b3VPLqCwgQ0/mOhxlFPDIG3Pyfqv0yt/pgu9V4c6sMdIMD6O6do+ap/82MY vDXWPpDmlzZAdoB7vou7eJW9l5eDa/7TW4G4DY2l4PpQT7nFobzCA/7M+i662xrXMY9rWDUWNLdH On84IrTE9niMptDL3Mx3mypujXuG2fOJKgyd7Y5kQmRsOv1Mmsdpk/JCRoEphHinGPcgO4wQwTz3 KY8qcCFByobl6KqiAOgYxCbWCfmpRIhLySRQcuJVzHHpY11vfbsafNyrMYSQArlzS3Fqq/fJsP5A rEu3dxIjq0g2XQOUXO0eWjhjQ37hqi4tM3tniZKaxhtc4/vEn70DIWPBPD6T4uU8GWjxVhrYhXmY AMOMEjjVHbiR4QnnMFgwyc4NdyFNnqAztlaX2aBzCQxx4ppzBcMJ7uYabrLN7/GY4Vuljm6KyKG+ ZRGsa3gJkslskcdNfJb6mJZWBLnCAAi49b24jGPGoZB+5GaBrCcx4qMy0rxteBrfhTzGU3bc4FXO m00uIde4tYGHgTJQOoti4H94fkR8QTjM+f5VakfQC1sYrIfB0A7p7BoXk+UD+CZ9+AR7WOLv3iZ/ ggbBoeyjAB1UDdCUXVw7a0CGnWPJBqsbu9w9p0+ClADHniYaPmZ/gq9ZBlqsQA4AO9lqZifcMu1B 7LE+uWZi4VWN6DLn1DaLXuOoHEhDv+t/VrmFvp0NB/kEn/qlj4GLdlVAt1IJEAEnTutPH+rnUr4N dT3Bx2ggaT4alAYcm4ig5odS0M7qXU8utu6xrXsMtLWwg5FlGQwOFgbftPrUuMEnklvbnhdJV9Su qWAS1rJO2HPaCCOZifBZN/R8Q2Oba0lzSWug9xop4Yskt60a88uMbE6vOgNaI0TGxg7roB0bprT/ ADW4+bif4ozMTFr+hU0eCl9iXgxe/HsXl90/RBPwEo+OMlhea6HvFjSxw2mCDyumAA+iAPkkSj7H it+8dg87+z+q5dzntxXvc4yQGn4Ba3Tvqr9YNrj9guG4iPaQNF2v1Fy2Mfl4m7Y+0Nexw59sg/lX V1vDXWvdaXh0OAIja0CPnxKiyYxrE2zY5mhIU+fdH+rn1swMluTjUenH02WPAa4eDhK2WfWjFG11 9N9JOji1ofXI51BXUOysVgl91bAf3ntH5SvMzlek6xkjZvdqdQdVVz4YxjYGtt7lJHJMwlL9GxXd 7DH6x03MgU31WOOoY7R3+a6Cp5WRiPYHXWsaGGWv3AR8yuWrONl1bNobu1cGu2zHmAUB/Saqy19O MLDqfc5z2g9vokKCodyGzLFMHbR6DI+s+Ey19NYdc9mjy0EsH9Z3Cycj6x57y5jMdtDWmS+lwc4D xUHYDsgTdVFbTuAAcwAnU+4aH5hJteK25gqqeTXDQ4mJA+XCPoA2tEYSJq2Ln22kussdc1+rXvJB +W6W/KVU6l05uVUG79r26tMcfFaVdmPW57WFwYSR2cCPgYUC6kOhg1J17R96ZxUbHRmGOxwmyC8l fj340+u3c1um4SkK8L1HMJdc/wDdYWx46cyurtrrsB3tkHQ/JZV3QYyG5OI4VvYQQDqNE8ZYy0Po P4MOTlZR1j6h2O7mippP6PEcR/KJMz8AFeqqa5rWjGoxyBq+yv1J/wCkFa/Z2fafdkASOGtkpf8A N47pdc866aJXAf5RYMOU/wCT+1liYrb3Gv1Q4tE7aq21fd7iqOdSym59VlxJYeCZhalP1fx2Eumx xdpO4j8iPV0THa7cKJPYmT+VC8d2OKS8cvl68MXmxbjDSX2TyBx+RafTL7y8VNre2g6kvn8JW4zp se1rGtB8SFI4MDc97WiNeShL1ChA/VkxYjGQJyfQOdl9OxMxm25kuPDxG4fArAzPqzk0h1mO4XtH 5vDgPyLsq8THIBc8weCO6O3FwyJgu+f9ybCOSO34s2QYpfNr5aPlllW4FrtCq299B2umQZa4Lpfr PgCnOfkUj9FYfcPBw8fisN7Wu0cJCswnTQzYbPi26bjcwOe7c52pdMzPdW2P3Qew4+Kw2h2NYLWH 2T7gfBbNTwQDOgEpx7jZgFiwd2wHGC384nT5qdcCyOzRJQWH3T3dwFIu26fMnzQSwdZ7jH50yl6m un3qs6z3nxUw4d9Skq27XaA2OB3KmbA4QPa3ue5VJpJPh+VEDgBrz4IKbBO+AwQwd00DtqByUP1A R7jDfAIjS6yABtaEiEgrKJ0Rixo7yhOElN4VwkxkKJKciFBzz2Q4V1sLIjzR+kXUY9eXikQMqs7T 23AHT5qq4jug2EnjROjoslru5fkmU7a9jyBweEP4qRYT3UUyRcPFRL2o0tJHdm3kKZAIjjzQ2PBd ACInxGjHI2Xqem5J6x0C3AvINmPoxx1Idyw69iuedduaarZa0GIaBoRotP6o3BnVHUuPtyKi2PEt MhUOrUHH6jkVHs8kfA6oDekdGs9rBBa7cD5QopJkULqOkgJzx5qLuR5wkpKBLiXOT6cD8igDEidF Ijdz+VOVbB8zM6eSgbLACN7oOkSVNwEc6oenfhJVnupwEAAQVd6XUd7rOwEBUSZMha+I0147B3Ik /NQ55VAju2+Qx8WXiP6GrYLjwmj7ynBEJp7qm7O6iYUN3uTuP3ptuicg6lBj17iAOSYCsZRBuLW6 isBg+SWC0NPqO4qaXn+CFJdLjyTJUst3HjsmoENe/wDdb+XRDa3UAfgiAluM7xe4D7tVGs+7+KZ1 XNmusBvGnZFI0A4UKzENU3EwRP8AemHdeFyCB+RQ1mIT7hHKHua3uUQFWygjRPBjXQqBfydY8Exs CPCtsJQRJE6hS0idFVNx1gBN9pI5PPkj7ZQZhy+qD3sPxH4omDrjt+aHmzY0nu0ypYLv0GnZxViv RXZgB/WX3bY1HgFExKk2NgUDEqBvDYeTKzbDQOPpT4k6fwVMSHEjsVcLHOayBzIHy/3oNBLXW7Rv aWuDo1EHSZ+KnG/hQamX5R3uVuz0HIdVU6xgBIcefMBblPXOoUV+nU5rGyXaNB1Pxlc70L3N2SQH WAGPNX5g8z8Sr+OjAWHOymQkQCQLdI9a6m5u05DgIjQAcfAKmbATLnAkmSSe6FoU8DwCeKGwAYTZ 3JLLe3xS9Rvnp5KPpWvjY0wCCQ0HUTqPmpXU3usca6hUyZa10uIHxcQgZHtaREVvTH1ROgJn4JvU njX5p3UWmC6yuuPAt/H6RTMoraCDc3Ukk6nU/AJCRvVJiK7pMfMyce0XUP8ASsHDm6nXTup25+bk P/TZLteXOOn4IRGOPz3O+DY/KU26jwe75gfwKWm6LI6o7Zid+4kCSJ0ntqAs9+eW3voskN3QHHgm PHstFzqiDDI+Lif7lj5TAb7WuAIJBj5BV+aoY9R1bnw8yGY0d4ux06yR6bTLyfaByVsVZfoEBh32 D/CeH9Xx+a5LDyH4FdmTJeNKqRy5pdJc75NH4rSwupMsaCXSD+cFRMARf4uzDNxHhl03BegObeRu +0eesSPvSFeTmk+59x4hoJH/AEQui+qXTcG/AORdTXkWOIhz2h0AcDVblmR03BH6W2jFA/ecyv8A uRjyxI1mdWHJz0ISIhiBrq8TX0TOfG3Gs08Gn+Ks1fVzqJGuO5vgHED+K2cv68fVTE0t6pS4+FRN h/8AAw5YTP8AGb9WcCp9bL8vqLi9zmn0g2AfzZeW6BH7pDrIrD8RynaEQ22/VnOPLAO+pHKMz6rX /nvY3yErCyP8b9RB+ydJteextsDR/wBFpWZkf41PrNZP2fCxscHguDnkfe4I+xhG/wCaDznNS2AH 0e4Z9V2j6V0nvAP94Rj9XqWtBdcWhvctA/KV5dkfXr665POeKAe1LGN/HaT+KzcjqvXcyftfU8m0 eBscB90wjw4B0W+5zUv0i+tXn6u4WuZ1Klg8HWsafuBJWff9cPqDizOULiP9G2ywn5gALyt9NdjK y8l7oMlxJ7lMKaWjRgR4oR0EUCOWYszL6Fkf4zfqyzTF6dkZEcEhrB+LnFZ2R/jPynH9W6PRW3gG 17nGPg3auQ0HAhM8+0+SHu9gE+x3kS9Hd/jG+tljNlX2XFYBAFdQJA/t7lQzvrV9ZsuG2Z72tcxp c1jWNkn+q0LLP0Z8knxvETAY3kz2S4yQTog4wJRAvXxYj1C91j7HWOfq4u7lOTqmGjiPKUnJh3ZR oGNgljx/JVzDsD8dkaACCPhoqdmjCfkrWFUaqgJkn3fCU4bMM/mDo1MceBqe/go5EM08EaqwNYXc EKpkOJBd3SQ1wATPElGYdvzQBo2fDlFYZ18ESgJtwB80tx/2KHPf5p58OPFBLNsDV3ZHqsJEnjsq rIdzx+JKM1wOkxHYJKbIsJO2sSe55/HhL1HmeIHdMwSA0e1vcDkozKDZowQBwEt1W1LCT5oThoZV 63Fc0EkIAxbbT7dGd3nhDhJ0CjIDUlpOCNVhOs1tPptH3q6zDqpO4+5w7ugfgncx1j2mv3acT+Kl jj7sM81/Ls59+BV6bnVyHsBdPOnmucdG4/EruPRbW0g+7fo4/wAFWyfq507Jb6jGnHe4Tur1bPm0 omonzWxJkKvZ5AlN3WzlfVbqNUmjbks59hh3+a7+CybqLqHbLmOrf+64Fp/FEEHZRBVT9M/BGQ6B qe+iNA+CKG10e59PVMWxmp37Y8d2iv8A1tpLOqB5EG2sE/ELO6cCOo4p/wCFZ+Va/wBc/wDlCr/i /wCKb1SNi88l/FJIjjXUGQihRHIKgDKm5xcSTqSh9yipnJDiEZgDhxqq5PuR6XQdUUM7KvAABVCN Sr1j/YVQ7koJZ1sLnBo76LZaBAHEaLIx7GVWtfYCWg6x281sMeyxocwhzT3Cr8zdjTR0/hojUtRx E7dVrH+nWf3uGjxJTl0ATyk8bo0BjiVHa6dVB0dA2CVwCVKBEJgHQnlJPRYHZgE/nXHb8hqUKmDM +Gie90tqqHFbdfidUNoM6dtSpd7Li7fRsXS2qtvxcfmo1fSnvonvdL4GoaA0fIJ6TCau6thhExxH Pkp6c95UWO1nuFL4c+CbS5i7nxUDHfupkgKBkn8iKCVnFCcYHkVMg+GqY1uPZPjSwtZ7nIbi4q0a HE9gm+z+alEohiMSWjaJg+OhUqqxXXodHaq59lYTrqo31MYGhvCBIXRBADBh9qYmCnAAaIUXQoTu W5H5R5MpJrc0GIILo8Doq7bHVOeGkgPG1wHdvMfgjt0cWj/CDT+Crv8A5wyp49PKmrk2N73f0Lp9 Efs3nna9ro+C1TdT+bTM/vOJ/JCxukmDaD5LSlXcWsA52bSZbAvAOlTB8QT+Upfabe21vwa0fwQN wHJUgHFnqBpLAdpd2k9lJox6pftF8fzjgPIx+RDc5x5JPxKNThZd1TrqqnOY0hpPGp8irDeh9RdX vc1tbnGGVvcA52kkj4IGUR2XRxZJfKCWhATLSPRXsFVd2RXXkZJIxq/c4P2jc73AaaKJ6ZRWamW3 OL8iS19bRsaGifducDr2QGSPRdLl8oriFW56Uq/djYGO9tFjnuJ3G18hrmED2s2QZ3IbrunMeypt O+kybXOJ9QP02hpEDb4o+4EDDLqWlKzcr+kv84/Iulz2twnsY2thqfW9za4DvfJaHlzpOkcLl7S9 1zy/6UifuVXmp3Ch3bfJY+HLd3o38fA+0dCyclg3WYl7HOH8h7SHH8FkhttX6TGdt3csP0T8kb1L 2tdWxxFdkeo2SJ26hD+i/b2dqP4qoJaCm/weo31Kavq3W8at/wBnz78dljt9tVby1s8diq1/rZlr 7Mm+20zHveXf9VKe/wDm3KWwix4POh+8J3HLgJtYcUfcAq7CEYmOOGz8VNldYmGjnwRITNHud8f4 KMyJ6sohEEUArtomKkZUHEykFxICjKYAqL76mnVwUW3tcYYHPPkP704RPZYZxG5SR7GeYP5SmhRL 7C1ga0u9ug8JJKdrMl35gHxKdKBJYYZYRjRPdeNU0B2g1nlDpryL7LGbmtNfOk9/NEbgXF0W3HZ2 26I+2epUeZj0BLED9Hr2BH3JWWVtcNxg7Gf9SFXvrDLHsku2GATqp3CLI8Gt/IncNArPcuUdNmRv rBDgCY5+CY3SdAh8mPFPHbw0TaC7jNs7v5qeJV/CO+truQWhZ94lgnjgD+Ku9PBrpaPGT96I2WzP q+jov2sYCTM8BVbvoHzVlzg0cAuPHiqt5Mnu4jQIIKH7NlNx2XGH12D6Xn4Jse9pBYTr2/iuxxMd g6e2upoZvr+iRIDiO65yv6ldS3bzbVW6ZkEkfdCWOzd/RfkhXDwg67omt0/gme6Bp3W5T9VrAIsy J8Nrf4ko7Pq3hhw3l9h8zA/BKlDHLyednY3Tnui41lJ01LxzpK6UdIwKfcamj+U8z+VVsjrPQ8KW utbI/MraSfwEJUU+3Wpk0K3VN1fIR25LGQGDQ8Ryql/1uwXEtx8V93hugD+KfpPWKMzKdT9m9C5w JAmQY+IEFOECx5JRiNDxOmKi8brgS3sz+9Scwj6LQAOBxCNBiNB/r8UG227dtYwOIMEz5qcRAacp GW6KyiZ3GfL4qAZsENAbCJ6d5tD3wGAHcDEk9uPBNdo0pFSImWwrGM79C2DMBUy8BhcToAgYX1j6 fcRS+anDQbtJ+BGiiyBkxuy3bMxHwQsrDxssbb6mXDsHD3D4FTY5ro2OnvB0KcmDLtOwUbIXDv8A qviy44tjqXHhj/c2fjysy/pGVjWNGSNlJMG5vuaB4wNV2HMz7gfFMWsOkxPbkJ3HJbQeTowbMbMx bt7LanXNDXsPgZ4KvfXH/lCrSf0f8Vqv6bimzeKm1vaQ7czQGD3bwsv62uZ9tqLmknYO8CJ+CMCS dTaqq3n4B4MJi0gTyPFOYJ0EBJPWsDwVA6ORHHRDdyihRIkIlZ1hDPZTZyipNcYYqwRr/oBBCCmT RJhXMR7cdr5B2kiI/uVSsayrT2FrdveEzJRAiepZsE5QkZx/RDcbdU8ja7j5ImhGizmPIIPMaEIr gYBaYnwTDyvaTah8VP6eP7C2pcNE+qrtscIDzHgeyJ6juNITDy076FnHxLAYk+oEC6Rbtzp8Ueiv cy3T807T5jVVq+y1fSDOnV2DuHuJ8ydqWzS3c4nRHqAgIBHAVmoCPAoFcN0gMCeUVp415+ag2ADG sKTXQNRJ+9MXWy7x+KgQOeyfdPbtqmMgR80lFi7me/ZKSUxmdPmn1mU4LSsW6AyokKROnKg53dOA Wkq8kLIOgT7z5Sh2kkCU8RW8THgBRPipDXVIwopblt4zcAtywGfomPv1Qcgg27h+cAT8e6M3UOA7 tn7kC0e/5KTGendhzDTyLb6VY1uRtc3c18AgGOT4rfORiNc2luPWamal53Gxz57ndG2FzWEYvB8x +ULZJ/SH+t/FWccvS0pj1O3mWMwcymitrDTZVuFQY0t9R3525wLtIhQd1a43V21j021tc30hox26 Pc5ojURoquRbXbZhhhJsqDmWTA/OcRqfJBafaJ5QxZJEere1TAGzbyeoZTsptpdFlG5lbh2DuUTq ZyW203PsJNdbbcYiJbv9jteeyp5Eeq74j8iu5RGSceptgkY8PHJb7i4Ap0iTSIykNiQhy8izIcby 11TdrXUtBO0SNrizyQOoXtuzXXM9s7fLUNHh5q7Y1tuJhth20UvbrEyHbjB8JKy7gG2QBA2t/IE0 LiSdySyy7LLsy2y1xdY4+5x5mFXZIDZ5EI2ZYXZD3EAEhug4+iE2UIyHieCPyBELS3OovY5tLWuB extgsHcHe4iVzpk2vJ1OhPzWvlSMq3+sVzeeXjJhpIbAkTomZI8Ua2ZcOTgnxVbcMDUwEG22sEHe JafHsUOjCrsZudydZJ0AVhuLRsc1rWyRoY7qEYgOrYlzJI0jX1at2ZSa3Na4uLtNArHU8preo3hj JBdI1gAQp3VUPwzftaH7PDvwqGYXG4u7vAJT4wjVUxSzT4gerL7Zcfotb+JRKG3WtD3W7Gv1Ia2T +VUJMwOFq4FrHU7QPc3mURCPYLTlmd5FqNY+zJfSbXlrQdeCjHCpawuIc4gE6k9grgYxpL2tAceS OU8GdE7QdFhkT1Jc/A6jTi17LMdtjpkP0mD4yFpV5X2ulzmsNTWxAjlMG1jiioOP52wSiVv2Wbnj c1w2vHiClQtBJaeOIPyH8VY9oCHU1s+3iAihqCUNNLKrLLGkk2cyrIUQ0hSkd9EiEguNlf0m0ngu IKllN23EDgBv5ArOVitc43MIiZcPNEupaMfLy2jVtldLJEgS3c46/CE07LgRYLncap5k6J3e8eox kM4PcA/3FRaQI/FCqXgg7eTOwFwYxupOg+Ks4biKhJ+iSJ+CA+WB1g8m/wCd3C3Pqn005QNljZqa +GtI+kf7kQPSO5SbM67N3pPS7sxjX2A1sPED3ELVub0To7Ztcxtg/NEOsKDndbFGazpmBWbrZ22b DBLv3ARO0D84qdf1fwjYb+ohuRc4z6LZbSzyDZl3xcUREbldxdIi/Fz7vrtgsJbjYtlp8XODR9wl V/8Anf1i0/q3Tgfg2x/5IXSNrxqBtx6a6h22MaPyBM+5/ijQ7Kuf734PN/tP655OldAoae/p7f8A qpUz0761Xj9Y6iKvEMJ/761q23Pd2KE5xKSqPWRLin6steZzM668+A0/6ouRquhdHoAij1D42Eu/ DhaDnaITnJWnhj2vzYBtVWlVbawOzQB+RZWTtP1gw3Aawd3mACtMnWSsqubuvPIEiiqB8T/vRG6z NQgdHfYK4mAe5UnWsAgEDyVNofB9o8OU7Q8eAPKfbTS7w9w1Pjqq+ZZqK2/FyTrTXLnGXcNHGqo3 5Nz7BRRBtdqSeGj94oJprdVzTWwUV6vsGsdm/wC1Zd76HVtYzHa0Dl8uLifOdB8lv2dNBxi1oDrm +4Wdy7+UFiPFu+YEHSYiPiE0g7skaqkeHk5dFrGY2Qag4gEWGax5kGdFujruXhWCnqdbdrxLLqzL XAdxP96p4/SW3td6jXVWzLZYdhB81DqPTG0saaf0jI/myfcHeAA7FMJie32sggR1/B6PEzMXLYH4 9gIPO0gx8R2VggjXkeIXChjqToDTY3iCWkLRw+v9SogPIyGD97R3+cP7kOA7jVbxDY6PVPIMkeAX P/W8/r1Y8GK9i9ew8sBh/R3kgem7QnXt4qp9Z2Ns6lWxxj9Hp8Uo6HVVXs88mTuBa4tdoQkpQbWM HdlBwU3KB1SUrTRTZyEPw8UWoazykhe92gCENSpXfTjwUWjXVFTYx2y9vhMn5Kzdq/4hLCrGr/gF PIaA4HyUEz6wOzPAegnu1yNJmIRGtO3czUd2qMcx3UqSWWbexVoNUrj9IInjkFPsEx2UntaTqIPi E2vGvxSUoD3uaOQ4j8Vr9QAq6fRSHS5jnMd+DuPmoYnT9/UxvIDBcND3G5buR9WqMquy31nMt9R4 a3TbM6ToqWpiCNQW6SAa2eQGrgrbAZA8ECyl1GS+mzV1Ti10eIVivX4oHZIZgmNB96cHWSkDrKYf vdk1cynT+KaAASnBkjTRM6efDskq2JcGmIklMSeOx5SkR/emdzCeAsJWkIbypn7lAtlSRDHMlCZk 6qL3wA3ndqfgFJ7gNG+537o/j4Ie0hpLtXHkp6wFesy0hO9zRBc4D4lRZAOii6im20727iGj+Kg4 bnTbGQwwg1bNl1En9IPok6eEKs66u0ywyBormNRVY1+IKBusc0C0D3Q4wGhWOu9Bb0d9QY4uZduD S4ifbHh8VKMYH0a880pdKBaOKf0oWzYSLXDwcVh0H9IPmtyyPUcfGD94ClhsxS3TP0vB/lt7Tyj2 sDLHNA0CqWkCwHTlpE666K5eCLJMSQJjjhEbladlr/p/IfkCdhtOXFMeo5jY3ccKFupH9ULSdiY9 PRsbqbATkuuNVziTsDIMe0IlAaFYsfY1gcWnY3Ua9jOiBkAl7YEksb+RTF2x9ds7WhgL3eA3OHdP W6k5FRuJFJYN+0kOjXiEFyDL/nT47W/9SE+Yf07j4hp/6LVK40DIBcC+pzAGxodRDSUPKINgPixn /UhIIKWysPvucSQGwTAJ5C5vPbOWAeIH5V0rbLWXvNZguYA4+RaNNVz97A7ODT+6T90pp6pHRJtg NYOAJI81NvtkodljGu1OpGgT0za+fzW6x59k1dbB8jGyGDUMLo+eqpZZl1cd2N+KvZLCK8kDQkNP yI/2KNZuaGGtsgMbOnkl5K82lTi5NphlRg9zoPxVxuFkY7mnv3AVoZNlYHrMI8xqn+1UviXA/GUw yn2ZIxh3Z1OreIIh/h/crONinItFbR/WPgFX+0YzazHuceI8V0/RsI1UMa7W6wguPgP9idCzutnU dl6+i9MdRFlf6QjsSHR5HiVndZ6EenV021l9rXg+ppJB7aN8l1GPURbEbi0z5SrNrGWlrCNzux7B TGOjCJavljcr7N+jeCXkA7Tp+CHbnPMCtvpjuZlei5PRsLNcPtNDLC3guaCZ+KHV9XukPEOxKjHY NE/cm8JXGT5wMu8/4Td5aErU6N0PO6teftfq04rQXF20jd4AfFd9TgYFWmOGVOHA2NZ+ICtVi4aS PgUCCExILyeT9Uem1YV9zK7Q+pjntc5ztS0SNFiWtb/zdvLpBfljaWjTdtH0vALuOrZOS7ByxRS1 1Ta3sse50agQdg8llfVPZd0e7FO0WXPfsZYPa+B2H53nCZS/R4ynp2ZbjevjD1WEQ4MPuEdi3lSb 09ppY9xey0iYLCWkg8Ej6JXcNx6ba34mRk1U10jaRjGZJ0299fILFxc7KLs8YlxBx2zQ3UAhunp6 +IEwmGZZYYxpZq+7zleO++z0K53Oc0QOOYP3Suyy8hnQ+hF1ENtIFNAPiRq75DVZvQzVnZIyTubk MBbe1w0JJ0c13h5FP1gftX6x43TG+6jGj1QOP37D90BSR2HgomgSD8zo/Vjpww8AZtonLyxuLnct YeB8+StRzpEp7HDgaAaAeSG4+CKYihSzihPOik4/7UFx0QXrOlQd5lPPmhucOySmLiENxUyRqq99 zK6y95ho1KSLXOg1Wd0Vpsty8r995aHHwap35oPTn5LZGhAnmfoo3S6HUYVVZEOI3OB8Xaohgzy0 A7twDaJc8eQQci8Vtge5zuG+aVrm1sNjjrwPM9gqINjyXnVx7pzBbN5eePda/QfFGFF2PXDGCwnV xMDcUGmzbbv5DdB8e6M63IJJaePzXDX5dinxiCNUWQyqizWpzmH9wzH3HhGbVitc02t2ucSXmO5V dl7S8bnN3TptnT+5T6o3fVRY2d3uBI+Sjz4+KFXTLgycMrItvN6kaXbWuJaNGmSNPJXqf2bnUywi m5usOMn8YXKCy6sw4Et7FvPzCI3JaWkAyCqH3c3pv3bvvhbqnSHG+yyp+95JLgTIJ8isO6q6p22x paVuNvuiAQQfHVDvYb2xcJA+RCs4zIaSa+QRlqN3K6aS7qOKDr+lb+Van1qeG9VaDxsE+PKr4uEa 8/He0y0WN55RPrZ7upiP3AFJoT9GMWLaVtbrGTzYNWu/eCqEnup05DqvY+TWe3h5hLIc17w5g0/K hEEGuijqLCJ3KjydRIUnHUqM6fFPWqAkq3XFbNwVZgHI5T226QEUMC4lxce6kx33ISJU1znAATqE DoEuxU0NraPJDvkQUcbWhByCHMBGvwVUHW/FtVUa8Gu6PwTkFwD2cjVOGyB5KFD9j4dwe6vBpFst Ie0FLv3hLa1plvBSkzMIodV1/pdT9ztrNwOvCsZnUXv6+z0MgnHFjIDXezWJWdltnqVYJ0cAdfJA qy6K8/1rSYa4uAAnUfRVLHImMR9W7kiBIlNmlr+qZT2Hc31HQRqnaGjz/gqlLnGSSZJJn46qy08E jlCSopSddJmEzZIMpCJgDlSB0l3wTVy26NByOQknhvM88puQkFFjBkpEGdfknPeE0CNDATwtLB0R 4oLK94DnuLp7ToEc+RQy0tduB9rvpDz8U4LCs5jQNAAPJBdwQrQ288hQtaIJAT2Pq1RykwfpSTwW /wAUifvThwa7cezTPgmf5QNg64D5trByW4/UKXu/m2mXDtu/MlXvrblU5WPi2Vukte4OHhICya65 rO/l+rvnwg5JeK2ssBJB0f2IUpa3gjpP6Rq25kNPctb+RYVZh7T5rYD/ANGw/wAkJ0Fsmy4NdYGk x7QdDHCt5DveO/tH4aLKued4/qDUeSvWvPs1n2/FEboOzOxwhn9VQyHl1OwkkGoxXMNcQ7g+Cha7 21ny/iULIf8AowOdzHN2kwDrMInZASl04vYEVGD+aIfy7yTttcHUubBdsgTMcnwVd7h6DBV7Sa4E iQHT+KlZY2anNBDdkOA07+5NXJL9z72NcW1uLdSdGg6oWQ8yz+o38ijeW7q/zm7dJ5gEwo3nVh8W NKI3QW1W5rsgbmGwFrfYBM+0LIsqc/Ic5hixmrT25OhV59hZY17XFjg1pBBg8KqLKxfY5xkEQPvT SkXohFcNEj3HlWsRh10hGZiXvhzagAdQXO/8jKPX0+0Amx4E8BohMsJM4jcho5BrsbbXUx1lzgan xq0NjeHCDO4H5Qg49bXVB4eW2hjdmunHBHmtSzp9DKLTBLi1zpk8xyhdFa04oMCYbr8kr0WnLGiR rSqGG9o/R7XR7g/2gHvyjs6O5/LWgdirRJ0cwQ5p7q2OotDNrm6+BTJTlegZcUoZBqaPZrY/1d9Q gNe0GY00P5F0dTceoBznek5zQNfECJKpdKfU64uJhzvot8PH5rXNbJl9W9/bT8YKmxA1ZWZqug1P thez0q4rbxuAIB8wSiY2SazDjoDr8ETIrtfG2ow3gGI+5V349ofvqrewt/NiR8ipWJ0Hmxh3Ayw6 8SgOAssmtrmmNdDz8k1OQ8N9O0Oqjh0aBSfVmEbqr948oS0Uo4rvzyJPeVNtDmnZu0Guh1VI231y X5GwD6U6Ku7qgBOxpsd2cTA/vTZGI3LJCM5fKCUvVW5VHTM2qtrXMc17m2uOga7UiOZ5Vf6sY9T/ AKv0VXM/Rl9hY7uDvMEHsVT6l1qKX1Zdza67BDqxq4g9vFY//OSqmkY+K2w1Nna0u2N18tSojMH5 QSzeyR88oxdfJw81ufkVsuZTLdXEAbu+4QIJd3VPHw8l+TTWaqhj1APfkEGvdb3NYZE6acLDyet9 QfJaW1g+ABP3lVH53UchoNt9ha0Q0FxgDyTOA61pa85IaWTIjs9pi4mN0v7S8SK6w64k8xG7/csv 6n1OtszOqW6vsdsa4+fuf/BDz7vsf1YFUnfk7WTOpH03rU6TScLolDHe12w2v+LvcfwT4ihSZHim NKAb5eCUnOXN9L6vk5nVaGV2forS71KYHtaAY9y6NxjRFQkCdEbnFBcVN5QneKC5YkIZ4nupEgBD cUlLOJWL9YLi2htY5cfyLXc5c51x77MmAJbWAJ8zqiFmQ1EqObRZi04bWud9ERxLidfxXSAbQOA0 DVcn0qv1Op47ezXbj/ZErp8l5j02zzLiE4NWZJIthawWO9WwwwfQafDxjzVLPy2Y1JDdLHCKx3+K t72gS7nuVj9cewuq2gg6kkonREdV8Tqp27MmIZo140PzWlTe/wBMAne3s9uunnC5clTryL6danlh 8iiJJMXrWbCPE8eeqlnZ+JhupxsgGHN3OcBIbJ0BXO4/Vc9zw0O3EfDhGy7LL9r3kut/Odx8kJkS Fd0wBBt2/RquZ6uK8WNPZVraG/ntLXePBWLTZl479+OXMI5I4PxatjH67jXNFecwsJ/wg1E/JVzC Q1GoZhMHfRA+qxkx7m9iOfmP7lBrrHaAyB5rVOGLW+rjPFje0GdFSvbsJNjCC3v/ALUgf5FRH8gw oJbk0gkbi8QFPq1tV+c8CLGiAe6p1w4OsJO+eUqx+kJY2ZJ0On3p9dVl2it6du1q0PgToqdmPZUf e0j8i2WY2Q7UEAeEowwxHvdu8tY/uQ46635LuC/DzeaceVGdVq9Xrxq6mNq2790kNI4+Syk+JsXV LJCiouPZMZSS7Jy1ZXMXIpprgML7SfDRVGgFwHaQtdrGN0DQ0DwTJmulr4CygN/ULdGMFY+Ckyl9 VTi925ziCT2VjcPFRudurI8BqoiSelMoAGt2wraCXA8xIQvScD5J9xcBtmSIKReDwS3xBVqGwast ykqc5mjuDwVIkyEzCe+o8U+9nEH4pyG91MlmXU/wYVlem82nQkDUmOFrdXGlTvMhNjS7FyvKk/g5 pVDB8rezj1Nage2R3KOzUxoUCsNgd/FWa0SgLiAYhSEEiB9/Kc/RkD5qIEDwKCVzOv8AdomgEfkS MjXjyCYn4nwRARajpGqi7XXw1T86xCYxx48JwC0lQJQzM6qURokR+CcFpKKHtO5nzb2KmHCxjmwW ujUHsmOg8VEkmIMPHHmnhYWsTqQUzA11w3HQTA7GEnu/SOkbT4FOx5aQQzc4klvlI7pv6bKNcRbI jxQc0foT5EIwcYE9uULLJdQ4RxB/FPYGi0+4fFarT+irP8mPuJWU3lXG5DtgaAPbI/FOiUFtWfmP 5hh0+BKu2EmupxJJc2ZP3rIffY5oaToJ481H1LHAAuJA4E6JA6qrR1rbGBjJcNJHPmgXXUkVjfxO 6NSFnqYCJkgRbX2qsBrSC4Cdw4nwQ35e5rWhsbZEk+JlAPKaNULSksyLnbQTG0QI8JlDfZY6JcTA gfBJ0JRKSltVJrZSGimwJktl8d2/07K9Miiwww/QJ4B8FqT2Kwg2QtHCydwFNn0x9E+ITAWPmMJH rj9WxeR6Fn9R35FQ6Kf1X5N/Ir9wPpP/AKrvyLP6Fri/5v5E6tGuNYS+joglIwRrqnjRIA+CDGAR qs0ua7cHGZnnVGx87NxjNdztuujju1P9aUIByRc1o9xAHmnAkLxOXcls2dc6u4+20NA7NAb+RJ3X +tGs1+qQD3bE/eqdV1VzyzHm537tbS4/9ELQo6J1zI1rwXMH71xFY+46/gnCU14M3PByXOdbba99 jjILnHQeAVvG6j1HHcPStJ/kn3D8VrVfUzqNg/WMqugHkVtL3D5uLQtLE+qPTMch1rrckjkWOG3/ ADWgJUd7pPBMm7cGzLtz7A++AW6Bo4B8Vh9e6lbjv+z0ewtAL7BG73cBv3crR+sX2fofVXGu2r7J kncxjHNmt3drmAyB4LN6zjtzqG5mPDraRDmjUvr5P3JhFy1b0ZH2qjoQ81c577XWbnEu5cdSVHaD zJ+JWpi9FOVjsyBk1VtfZ6ZY8lpbOoJcRtG4TEnVVHY1VeRbTbcGsY9zG2gbmu2mJ9vZP06MFnqj ND6b/s1g95LZE8SJj8UW+45OZ6bK21Vy1mxvHths/NRyd2PdDNlmx0tuZqHjsdE+DD8yt1h0Dt7v CZlJI/a7H1i2PycLEJ211M32f2j2HwajdT+suHb099NO71Xgsa0cAcTPwWZ9bD/lQ+HpsI+ELKrY Hua0nbPcifwQXGREjTv/AFMp3Zl+QeKq9oPm4/3BdK908FZ31e6dZ0/pznXjbZkHftPIaBAlXXH5 JMuMVFZzkEknlSssY0e5wA8yqVvVMKsndc2R2BlJeSO7ajSdB8UNxWVd9Y8Rs+m1zz9yruzuq5um PQa2n886fiUFhmPN1bsimoTY4N+JWJm5VWSXOxqpdWC6y49gPEozehW2fpMq4ud3a3+8qx1SujF6 Q5tALGuIbt+es/cnAAseScqHp0PVz/q+0nLstj6DIBPi4rcaYeRuIJ1k8FZfQAa8O67gvdDfg0f7 Vo0diJHi06hENcnVlYJ1Oo+Cz+sMa7CJ2+5rhC040IGvzVXLpffU6itsvsgMH8okIlUXCxOmZ+Yx 78ah1rWfScOAfCUj0zKa8V2tFTzqGvMH7uV6Zj0YfQeiNZaRsoZLz3fYdTHmSvN8p9ublWZE7nvc XE+HkPgmSNbM0I2E1WH6DNNXH6TvFSOnKliZO9oqt+lw0+P+1GfjxqJ+CaJd0mHZrlDfW10+Pj3R iwt0iQoGRyPn3TgspFTbl4bw/HeQO8cH5LS/btN9JbkVH1DoXt1/hCo9vyKLqvz2y13i3v8AHxSM QdwkSIbDsrCDve9zAPzdn+1Meq4Ff9Hpdc/xd/qVWyLC5wiA1wB0A+aVbq3MZDZfBBA7klLTsUa2 ys6v1BxiusVA8AATHxKrWuz8g/pbSB4TKs2tHqANcHbGwXDieTHwUADwiKGwVZ6m2k+r0jG4uJGs oZJRb3E2Hy0CETrwkhQ05TJzKYgoqXrneB5rSbeQIOqoUMc6wQJjUq5scf4Jpo7pBI2TBwfxopEi IP8ArKEK9usypgwoyOzLE90dcsc7YQe3knBnTQO8Co1vAcdJBJKk0jtBB1A8FPj0DDPUlKBI1GoT bRuAhOyQkSNwCesdHq8egw/uvH4psEziZg7mh0fgVPqgnEcfAg/iq+C79DkNHeh34loWfhPoLoZh 6voirGkcQjtB2/H+CFXBgnlqI0nUcnsnljDP4GPJIeQPmnkQGxqU5JiJ+KCWPkDCYETp+RI6DiQU hofbwiEFQPZOBJ05KaCI8QmM/wCxOWrOUTxopAueQGtJ7KYrq9QtssDS3Q7BvJ8hwPxRiQdlsgRu gnX3KAiYiJ8Vd9LprDq64nuYYP4lMW9PPFlo+LAfyOCesaNoDoMRpqhsHvB8NStE4+K5ji3Ikt/M cwtJ+4lRp6XkOG+sCwdgC2fuJlNIPECywkBCUT1a2v4KF0ml4jstB2DkVx6zBXoSNzmiY8NeVG04 jMd7awbrC07nvG0Nkfmt5J+KdbFTjekW1tfOj50+Ck3Rx81M2fq7ag4lrXFxaRoCQBoUJ3M90VFL 5pJ26iR3TwihiFIJBpUg1JTGEoKntCUIKphtUoTpJJWgKbYUVJibLZdHdKxEHMjlDapiZUZDMNQ6 Nd3rUvDtHhpkeOnKz+jZONj4Y9ewM3RAPJjyCIPcCDqO66r/ABd4GGzGyTkMrffVY0VvdyGkdgfN Pjro1Z4AOKtpOJRblZZjAwcnK82Vlrf858LRp+rX1qyAC3HpwgfpHIs3OH9muV33rN4bLo7NEqpl dXwcVpORfVRHayxoP+aJKk4QsGMPMVf4u77YPUeq2Ed68duxv3uJ/Itnp/1O6B09u4UesW6l+QQ/ XxMgBV8j669JY2aH25JOo9Gva0/2rYXK/WDqY61kNsLH10saGil1kgmfpHbCOg6LhEB7q/rv1f6c PTflUUkf4OognT+TVJWRd/jC6RLmYdN2U9viBU3/AMEO7/orjGMawbWAD4Jn0V3ACwAjx7g+IhK1 2j0WV9eOr2gtoqoxQfzvda8fP2D8FjZOZmZrt2bmZFw/d3kM/wAzRLLr6e2ir9nGxtsRcy47mn+q 7nlVPXDTtuaajxJ1ZPk7+9BVtfqb8THxS0Uhxt9rdwA/taKr0rqd9NzawAWEH2iRxqo9cdORW0HR rJ+bj/sU249dlVGG93ptshz387RySgkGjYdKvBxc0WPpyLKWXEB9bY2nWYI+OqK36q4wOuQ90cgA AfDusZl1vTMjaHepQXey6NCB4/BbuD1et7oJg8wfDyStliIS80N31YoAOy13zAKo2fV+5m7Zf9IR 7m+PzXW1uba0EaqL8edAlaeAdnhur3ZL7qqsnabaKwze2fcOxdPdWKOt24TK6aGssNbQGvc2XAnU x35QOqD1usW1s1mwVt+UNXUjp22CGjc0bZjwSWCJMjR2cb9s9evG5lJg94I/KVBzvrBd9IlgP8qP yFb32R/gpDDs8ErX8BO5Lzg6Nn3Gb7wB31LvyqxT0DGYZe51p89At9uEe5U24zB3QtIxeDmUdPx6 gBXS1pHfaJVxlBjVWYrYEJ97AUl4gAt6YHK5760Pa30qmnklzh8NAtPJ6mwO9Ov32Hhjefn4LnOs 2Xvva29oa5rdC0yCCZSiCsyyiIkDd2ulUhnTKQYDngu48T3Uscw7Z3bMFHoP6rSPBjQPuVZ4Nd24 cEyQpGm3Q4GJCr5Fjqw6xhh7Pc0+Y1CnW7c2UG8bmOHiCEDsobubldXz+owcu0v26NbJ2j5Ki0uY 8tbyfBTsqArY9rpDxqByCNIKLiUBzi4iGjk+PwUYHdsGWlBPi0OsMgQB9J38AruuukIdTgz2AQ3t 80XcNADEpsrTGgGBaCOJKA+mZVlwESfkoOb2iUgSFEAtRzSDpwmBjSdCrLqwTB+9DdXrA1I1TxJj MWu9je/HioNoaDMnae3ZHeHeEDwUPcT59kULFrRxwo8a/iiBs8lS9MRqErVTn5FZDy8cO1CD6Tom Pyrbwsdt+VXU4N2ucGDeQ1oLtBLnEAfNaXUPq31PHeaQ0VtkFm8j3Aay1wlrgD4JWUiLyG1xMRPk NVJtFjuGkgeAK2rqLcTJF7g31a3EOA1Ekc9kTEyX7yWkNumW+DvJG0EORRW+m0bvaHDkq5ErpqOh 9M6pQzIuz8bDynSLcW4uYQR/KiFhdRpxsTIsxvVa99Z2g1kPYSP5QQlGW9Gu66OzVgj+9P20S1Sk fNMXBqjSxw8yptjngprGxfM8j8iZpJKlhsxT3TtdIH8FI/SGmqE08Im86KRY62d7sW0eA/IqfS3b sg08etU5jZ/eI9v4hXr2zRY3xBWbhUXmwXtadlce4ePbVZuIijbo5gbFJa6rjXvI4kHjkdlJoLud PMqyaq3B9zrhS4mSxwO1xPO2O6ZteOJ3ZADT+6xx/LtT4yJvRYYgImiBJGvaFIHwHxRZwW9rbY5+ iwf9+T+tjTDMduvdznE/htTkIgQY7Rqkyp73RW1zj4AE/kUzYw8Ma3WIGqmczJAhthaODthv/UgJ sTaZCqW+xXjWzbSBx6hg/dz+CcjDr5Jvd5Sxv95/BBsc4mSSTySTJ+9L/Up6xDbe5/tYNjSfa0dl JrW7JI45JSNbYmfn5pnBxEE7gfknRFIlK1BwMbBM/JSiOf7goDc0ACR5aJydwG4J9Mdrj3OBHA5P 8EQR81BoHI4CkSe0fxSpVqsa3aZ1/KhPBJIP7kORJgbnc9ktvtPdx5SpVuKCVLn7kzgWvI8CpCJH w1RWs6HctPbhFBVeSxwcrNbH2kCpjnk8BoJP4JJUn7LQx/q91vIj08K2D3c3YP8ApwtKn6h9dsAN oqoaeS5xcfuYCgkB51KFp9b6Dk9GymUXuFgsYHseARI4Oh10KzxU4+P5EaRbBJE2MHJA+cpt1Q7z 8BCPCVWGIafBTaI7j8v5FH1mkw1u4/ejtxuoPbuZjuaz95zdo+90JGFoE6YADwJ/D8qnLuwA+JlO cO+Juvqrn83dvP3VhyJ9lw2tG/KssMfRYzaPvcf4IcEU+5Ipn4uPVW513UKg8CW1Vguk+G6ICj0n ruT0nJfZhtD7LmbSXNL4AMy1shatHSOn4/Sx1Ckb8u2ouqqtLbDzt3CvbrHwWE6vKqzqvtDXG30z uLm7dD32wITtAmcJRI4uovd0c36x9SzRGXk2va7/AAbG7Gx8GCVQkuaW01mtrubHDWDzAOqOmEef zQWrNArYGD6LRAPkExdAM9uVMtJGijtkkff4pKXDiRpqOyb3AeAT7XDwEKXpuPH4oKpiNf4lSADm kHWeQVJtXH8E4qA45StVPOdUrrryyysQNo07SVayacj2WNrJLWwdp3Dj71DPqrt6nYyy1tZAbG7g kDiey3WVtDQW6iOUiVU42Lii0OZc5tdb49RpPvdGoHkoZOFkYUPqPqY4O4ERuatl9dDvpsa8+JGq g7FxyI2ad2yY+6UEq6N1yovFNzts6Bx0Hz8F07HV7ZJ0GpPkFwWb0l9RN+IC5v51fMfBWsLrdoxb anXursax21rxuB04DuQfikzRyiql9rV6UPtv1gqMaPvdYfgCXrvSxo1XnvQ82nAz25N87WtcAWiT J0XTH609PI0L58NqRViI18S7LtoQ3WtHJhc7k/WhoBNdbiBrqQFDBzurdV3fY8Z7g07SWNLo/IEO i85Ih3n5VbZVPI6rj0iX2Nb8Sif80Ov5NXqWZTcRvLvULQY/syuXd0nObkO9QC5gMepY7QieYKUT a2WatnQyPrFWTtpa6x33BVHXdXzCQGilh8dD+OqPSMHHt9INYH/mvHuB8pKuxrPj4JLDOR600+nt FbAA3a7UP7y4HXVZ3Wz+tjyYPyladYAtuaNdrjx56rJ6v/SR/VH8VJ0YOr0dD5or8Qxv5EHJBJD2 8tGo8lOrd6NZg/RGugHCawwN3hzPBCK1ap8tlpjxSJHbVDa5rHgDRj+PI+CK+OPxSU5LcQh79xhs kgK5WBtDQI8AmiHEROvPknaYOmgTCyWyc0bSZ906N7/FJpAgEfFM8nkpcnwlArrSm47C0AR4BCLn OHl5cp9ug8ITBoA8vBNpNqBjTudfgpASZ7+Cj9LXglONCgVwY+lPxUPQbJP3o517xGqiSODGqAJT QQ+kRx802x066Si+JGp8EiJmdfBG0UjbImAHbhBaeCELJybixlTDYK652sc6Q2f3SjFpBkJnAHlO jKkVoxPUc27AZg2WzRW82CvaAdx7udyfJBFZ78I3pt+CW3T4ImaOFduVkNZsJbYz914n8VUtb61j XlrWAa7WT/GVYInTSFHY0ad0uM1SuFjqSmUjKY+KalDe3RrgJ2lDaRKLa8fR7lVwfEKXHox5N0zS idkFrg2FPcI/gnsbvO1BCzsXMtZU+oEisO1jx4WgVj4zdttw1nedFnYwDYLpZSRVNwOdYfeTA/NO sKYa06k+38EJpEjsOyJJJAHB1IUtMNswCHOE8KUSJHbSZ1lNyNRoOfikH6A8CdEksg0TAA8UzgD3 keCYk/3qJBA0PwCICCVF3ZLcDPkk3UkFMAR2+5OAWEqB8R8EiYSie2o8eUtoAlELSsBA5+aXI148 UtOfxV/H6bTbhHKflMrI3fozq72/3p61o7j2GneE4JMealRS+8Wek0u9Nu9/kPmoudtZpzwPikpQ lz9p4afjJRIE8f3qFYDW7e45Up00OnmkhzM6oMuJHDhIQPBaPUWbqg/u3v5FZ3YJKXOq9Q+pmLiX /VzEyX0g3Nc5hewBrjtdtG7iV5f+Vdb0z9oU/VtmQzPyK8Vpcfs1O1mpdB9+p806guhGUrEfN9Bd lU0FguApYSBNrhP4Sq1/1o6JhPsblZlQ2/QbWHPcR5wIXm9uXQ8SanXP7vyLH2f9GQEP9oOqhjLK 6N3DamAE/NrZ/FH0rST3dn60dSt+seVTb03FsbVQwsNtkN3SZnU6QsJ3TbmD9YyKqj+7Je77mAj8 VO99jnD1LjcCAdSTE9tUqca+8gU1l8+ASWsBi4Lfp3W2u8GNDB97iT+CmG4LRDMXcf3rXud+DdgR nYFlRi+yunxDnSfuYHITaOlVEh1lt4frY0DQx2aXFpAS1U2aRkPDfs7a663O27q2NEH+tG5FtwnE kZWXoCPpOJ7TxqqwzcasbMfG21Ay2tz3bQfGG7fyqH2+8Ga211ebGCfvdJSoqtu04WC5wFYsvj9x sD73lBysjAa/ZXR7RyCfcSP5TeFTsysizSy17p5BcU+Pg5eRIpqLgOToB+MJUp6fptuLjdPo6y/H D7cOp7GNc4xsJMh3ZYfUuqHq3U/tZY2sGlrGtYZEN0GqvPqyB0EUuvextDLTbjM2llkn853kub6I d77Gnhkho8BKUhW7YzyEuCv3RbpHwGhUgyTJ7ImyO2nJTtaEy2IBGGE6D7gpCvwHzRA33R9ylpEz oOUCUiKKBp4p9gJAdqTOqLsPbhKGgQBoPFC00s1gEEiB2US2BA5lF7T8lFpkQOe5HihaXleqNNvU 7WNGpcGtHyARsHq1uI77NlSWNMT3aVG0F/XT/wAeB9xC1ep9JZltL2jbd+a7x+KcTVLerZbtewPb q12rTCfaSI/181z2Ln5PTbTj3DdW0w5h5HwXQ49jMikW1GWHknRLxUFwzkLI6t02ttbsqr2kavb2 PwWrbkY9Umx4HkBKzOpdWw7KLKaw5xe2A46JKcrErZbaK3CdxAaPMkfwW87p/T6zLmAfMlYWCcgX n7OzfYWnTTQeOq0R07qd2ttraweRMn8EpaoBbGXX037M+pu2onQu2y4R4Kvi9Vp6cx1eG+4lx3Eh xYCfg2EDqHTWY+N6he57y4DXQaq90fGqZhtea2+q4uJcRJiY7pbDRN2UtvUvrBlUCwvIqcJBLidP MKoMPqGQA67J2tPZsn+5bVdr6jLD8QdQQPJKzGotO/E/Q5B1fQfoOjuw9vgozMxPqGncMggJDQ6j o89k9KurAfRY6wjkO0PyQsbqt1Z2W+4DQgrYvzK6We9p38BnckdllZF/T8vWxjqLf9INfvhSAgsZ iRu3KbQ+11lZ0eAT8fNZfVDORP8AJCE2y3Ff7H7gOCOD96bKu9d4siDABTlla29RUYoYG6jaNJ8l G4EsJP0e4T1Ct1bTqfaPwCdwJY5vYhFYgsq4HIcJ89E5t2tAsPu7HxUa3OkVuMubqD5IpaJJjU90 lNch0yCIhOAe3GqIWmYPySAJ1B0TCdWWIsMIPPbzT7e7VIiAJhNuHM/6hC11LGAInUpiwAc8pGOw JJ7pA6gEf6hJS2saaRwlPHn3SIEkj4JAcaR/tQUoExrxPKfTTxPzhNprrqkJ547QguC0g+3uU5HH 5AkRoCSSmMkwfuSUtJjRR7/3qRP4JiCTICCmMR8R4paeGqlETOoUdJED5oqY7fPnskWkHTspGf8A XzSmBI1nhC0oiPLhV2ZAfuPZphWbT7XFvMGFnsaQ10dzIThstOiaBa8x4SUJzdrw2ZH5pSFhB00J 5Tktd5AqWGzFLdW1484TbjCcFzeDLfNNOqeteidwPNZAEZdzePdK1Cfasx5AzHn94ArPxfMfJ0Mv ytkS2O589URsOP8AEcIcNbr37QFNsEAuPOoUrCzA1brqEt4LoGg5mNFFwAA2xHgptJEGJJ1gpUq1 TM7dY7qJ+Hf5qQPMaBNzOg8CigrbuBM+CYwCPHmUjA/u5TQ4hOWlbed21ok9ypQSPceOwUK9rW7X ad57IhLI0IKKCsAI04U2tI5TuaGNaSASdYBn71FxLh4flRtC7ngaGfdoQO4TV1s2lzz7h9BvKYAD kEn8U/HGh401StTPn4pfEfJIN1EHgfck72NJiT2ARQs9gfW5ruCFjOEGPAwtr3DnuFmZ9YbcSOHa pIQBdT0uq1/1fbY++37K0XNdjMALN24O9QrlQup6LZmu+r7sfHqZZU+y0XvdO9o2AtDANNSnBkw1 x69i5drsUu0r3tHE/wCsfgiNy8doAGI0Fo53GD8QwMRK+jZzmh1objDt67th+46p3YODS2bcwWkA nbjt36DmHOLUdmHVF+0LgZrbXVH7jGz97pKHbl5Nv87a93xcUW52BWCKKXvIAPqXvhpBH7rAEIdR LCPTbW2CIFdYOn9Z2spcQTRWrpvs/mq3PJ/dBKMen2Vici2rH0mLHQY/qhD9XqOXLYtuBEGSY17w 1O/pFlh9S66uiABDj7tB2CFk7BVDuxdZ06s7Ra+90gfo2ho1/lOJ/Iib8dhkVgToC8l35IQxh9Nq PuttucOzQGt+/wD2Iv2qhn83Tr+89xcfubtCOvVFhm/1GVMc1wYbATtaA06GIkItdD30FpZYbHOB BJOwDWZcYH4Kq7OyPzCKvD02hv4jX8VEVZmRqRbcD+c6SPvKVFVuw26yzpppquLcfGrs9WraIe49 w/yXO9GsrryMiSI3Hb9/ZdDTi5FfTxvtiptNrTQ2C0l2u53mFjYGPRXkHa0Abd086z5o5BoPJMd2 yepVgxXTbZ/Vao/tDIP0cOyO3AKvN8J47JgOdNVDov1aR6la0+7CvEeAlN+2o0bi3/Dar43QTwmk 6QYSS1W5udkCKcU1nibTAH3KX2XqbtX5TWfyWMn8XK20iJd96beIPee/gkr6tX7N1JugzA7ydWP4 KW3qrDzTb5Q5hP3Sj+oTGsDuQk1wLodzxqkq3mWWvHVvUcwl4tc41t1MidAt5vUceWh7jUX8CzRY fT4d1nceN7z+VdFZ6VgLHtDmRrIkQiVoLW6h06nPrkkCxo9lo/j4rnhZkYb3Y7yQw6ED8CFvHFtp k4VhrB/wLpdXr4DkfJVMoV3VmvNodU8fRuaNzfv8EgolFidMx8msWuvdYdZYIEfHlGzOn4tGHa6u sAhv0jqfvKyab34WQfTeHNB1jghauTk25WFYatrawyXnlx8gEVNXoU/bHR+4dPmFvc8iJ7hYP1fM Zrjz7D+ULoDMNaOxlAqDCytp0c2Y8fLwUWgNgST5I7mmB3dwoESTJ8fh96FppQdJ0G0Dx80g0zM8 agjtqpNa0HTUf7EpEaeWiBSHI67VbY9tx1gQXDxHcrJLfzXCCe66p+x4giZGs8QVl5XTgyXUiR3Z zHwRAFVsok3bkWiQIAIKE6NABGgHzV4U8kKpkN22kRHBhOC06vR0hza2A+AhFDnbSTPwKqUdSqdW A4bXAcE/klH9alzd7njyG4fkTgxUXM6t6lTqrGOLXQRuGh5Q6+oZDsZ9bnGTG2yfcI8EXJuqz724 7Zhknf5+AQ2dPe0xIjxMoFeNl+l33G17XuLw4TqZIgrTcImTGkIGJi11P3E7nRERorYLYniY+SYS yRDAgnylRLZgnUn+KNsM6nnv8EzgPzedR5ptppCQRCW066KZAB15/vUZl0jgnv56I2qmBDRIHPkn DZb5KW0g+IH5QpcHy/1KVqpHHKWmh7KQLiYPHiokidEEqJPkD2THTzn8qTjOvBUfKfh/BJShyI1S BIOnHdMTHwB1TaFwkxz/ALUqUs4uJACfjQ8qR8v9YTQSYmfP8iCWLpnwTCRP8VODJnRIgHUaHukp hA+Px81UvxXMO+nUESWFXS3g/eFFxEeaQNKIcpw3c+1w7FO1zm6HUK3ZU18g/f4Knq0lrvgpYnsx SizlrtQm26x28FAu26/gh+u6YhP4lnC9Hu9ioWaZYJMS3lXfzVUt/plf9Uqjj+Zv5flTzoduqlrA JBjmeVGr6JRH/wA3X8QpWBTdQCNSfn+KeXFsDUfLROz+cf8ABQZ/NO+CSksGII0A5hRIcYg6HsNF Nv0W/BRfyPgipbbtMkz5pAt1115kpDgph9FEINLhvPaeUojjjum7hFRWo4DgNdExAHcAhOfzlE/S +9OQomNe58E4kJhypBJCmuM+IUmz9I/IJdj8k47IqUTMzqewVPqDJqDiPomPkVe8VUz/AOjj4pIL mAarf6HluZgWYopfZ61pHrB0Nr9nLh5rB7ra6T/yPl/8dX/1Lk+G6Eb8bJLyYbtJltlhEHzl5S2Y zIF2YO8tqG7nt7dFRv8A5w/JPXyfim6WnVutdhVEhlTng6e93Px2j+KduY9h/RV11ebWgkfN25Vy knCluqc5GVd7d73z+aCT+AUhg5U+5npDxsIZ/wBUQtnH/oQ+CxX/AE3IoSDFxWz6uTJH5tbSf+kd Eh9kbO2kvP71jj+Rm1CTo6ITDJc3StrKx/IaAf8AOMlDsyHO/nbC7+sf70Kz6KpH6SSRTvUZ+Ice muzLdWxrbGPoDZad+m86chUcCyuzJe6trms2lrQ7V0TzoAs9Wum/0n+yUMl0LXR3dbQaDQptWkfv H/WUncj4p3KJkXLjoSdO6YDWDyPypO+kfil+efgUkL9pB9vI+CRPtOkpvzWoh4+SSkYcSNNPNRcd DGp4kpP4HxRKvou+BRQbaeF03GosfY0fpSPa53YnmFZho5Onc8qI+n8/4KA+gPgkpLuB4BMGCSf7 ktxgtGnn4/NDr/nD/WKI/wCikpr5ODTk1Flvjo8cgnwKwcjHyMBz6nSa7AQHdnDxXSN4+aq9e/5P /tBJWjmfV0TmvnQemfyhdDBLfMLnvq7/AEyz/iz+ULfdx9yEt0x2ZBxJ08/wS02+7toQhj6JUD9J DS0snERLfbMzH8U0kTBntpomH0/kU7ePmiKWm1txPPBCR9pJHmonv8Qkzl3xKKkNlAeS7aA7w7H4 rBz2huUWtaWjT2nsukd9L5hYHVf+UXf2UldG67FbY3dUdw8O4VV2Jex0huqvUfz7vh/BWB/AIoc7 CwnMebHyImAFfawaz/rKccf5yQ4HyQVou2APaSf9im2Po8nX8FCrkp6+D8SgV0UgLi7Uz4qPcyYP JSH0vkE7+D8ExeiO4AkET4p+8nTxPxT/AOEb/r2St+gPiEVLSfGR8FERxJkfwUuw+agP4/wQUokS B58/FLkT2Hj9xTP5PwCl/g/kUVMIGoPY6fLwSgGROqc/SHyUX/m/FBS5EkwngxqP96d30h8Ch/mD 4hJQZRzB76JxExwkeR8FE8H5oLlO8fFNxqOU1v0R8R+RRb9FJCjZyNJQ3Ez7hypO7Jj3R0RqxMf6 8IVjGPEOHHBU3fQ/18VEclELS1X42sNKH9mMwrn5zvkoHkfBPWv/2QoNCmVuZHN0cmVhbQ1lbmRv YmoNMzQgMCBvYmoNPDwvQ3JvcEJveFswIDAgNTk1LjIyIDg0Ml0vUGFyZW50IDEwMCAwIFIvQ29u dGVudHMgMzYgMCBSL1JvdGF0ZSA5MC9NZWRpYUJveFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2Vz IDM1IDAgUi9UeXBlL1BhZ2U+Pg1lbmRvYmoNMzUgMCBvYmoNPDwvQ29sb3JTcGFjZTw8L0NzNiAx MDkgMCBSPj4vRm9udDw8L1RUNCA4NSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dF0vRXh0R1N0YXRl PDwvR1MxIDExMCAwIFI+Pj4+DWVuZG9iag0zNiAwIG9iag08PC9MZW5ndGggNDk3L0ZpbHRlci9G bGF0ZURlY29kZT4+c3RyZWFtDQpo3nSSy27bMBBF9/yKWVIpxHAo6uVdIxt9LIo2JhqgTReqw9gM LCk15Tr5kPZ7O5Js13IQCBBfw3NnLucXQ3DA4iQVOoMEhUSEMNYSUiVhY5k6PajYzQXUTEKmUeQZ xHksFIT7FUXf0Oll4RNYeMD+8wvaeTdHWPox60Tjnn05xlwZdmmMppvmnoS0FJIUhkFCEokoAYxS EacyBlNRyJKFQko6NothFoHZMV5sNxtbtzB/+/VDWHyew9Q+rpvnqttzNQTmgcUCtcwhRIF5rsFM +/vYgeTAmF1/mhnVxUqI+iLDYZCAiRKoIMuomiGVThsPWdAREb7zP0GIGEuR8nkQiowfsvE71y5W 1lMuvi3X67J1TR38MB9JSWV90cNASxkJMkTpkVJyrBcHpb9BmGslFH8fUEE8KuCWfk11G0wAKUy+ ORWFNIdt7X7bjXets34vTV7oKD9YQeaM0dc9eusenJ1A/oKZ42tMTS9O0I4ZH/09giM+DZC7pSMn oFi5upxQ1ed0lbykmwu2f/K9GckIHPNvZtazxih8HfW/j9QIlfArKl5x1+7KZyjrOyiolexi0vGM d/VytS2htb79ae/2lZ+1DDVbNzlpmfDckKFdkBwxNKOhOTQIVM3Gdlq1fWrBt/ZxSHtm2D8BBgAv svF5Cg0KZW5kc3RyZWFtDWVuZG9iag0zNyAwIG9iag08PC9Dcm9wQm94WzAgMCA1OTUuMjIgODQy XS9QYXJlbnQgMTAxIDAgUi9Db250ZW50cyAzOSAwIFIvUm90YXRlIDkwL01lZGlhQm94WzAgMCA1 OTUuMjIgODQyXS9SZXNvdXJjZXMgMzggMCBSL1R5cGUvUGFnZT4+DWVuZG9iag0zOCAwIG9iag08 PC9Db2xvclNwYWNlPDwvQ3M2IDEwOSAwIFI+Pi9Gb250PDwvVFQ0IDg1IDAgUj4+L1Byb2NTZXRb L1BERi9UZXh0XS9FeHRHU3RhdGU8PC9HUzEgMTEwIDAgUj4+Pj4NZW5kb2JqDTM5IDAgb2JqDTw8 L0xlbmd0aCAxNjcvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmjeVI3NC4JAEMXv81e8YwWu s1+6Xvugc7TgOUTFQCVX6N9vrQhjDsNv3pv3HiTRgWyWC+OQScFSIrGGkSvGVJNaCz2VOwzEcEaK wsEWVigkX4ruMqrpIWSoAuR7QhUv56tEG/6zVh0NXX6evafUexM/fROLjF6Sk89iqFwLZ6CcEVqz he+jpyXBvEAVwT9pc6z7cQjzdJu7cdj6O508vQQYADxRM0kKDQplbmRzdHJlYW0NZW5kb2JqDTQw IDAgb2JqDTw8L0Nyb3BCb3hbMCAwIDU5NS4yMiA4NDJdL1BhcmVudCAxMDEgMCBSL0NvbnRlbnRz IDQyIDAgUi9Sb3RhdGUgOTAvTWVkaWFCb3hbMCAwIDU5NS4yMiA4NDJdL1Jlc291cmNlcyA0MSAw IFIvVHlwZS9QYWdlPj4NZW5kb2JqDTQxIDAgb2JqDTw8L0NvbG9yU3BhY2U8PC9DczYgMTA5IDAg Uj4+L0ZvbnQ8PC9UVDQgODUgMCBSPj4vUHJvY1NldFsvUERGL1RleHRdL0V4dEdTdGF0ZTw8L0dT MSAxMTAgMCBSPj4+Pg1lbmRvYmoNNDIgMCBvYmoNPDwvTGVuZ3RoIDgwNi9GaWx0ZXIvRmxhdGVE ZWNvZGU+PnN0cmVhbQ0KaN6Mlc9ymzAQxu88xR5FpiiSLAnIqY6dadrpTNOYSQ5NDxRkm9ZGLhA7 eZD2ebsC45hMmsl4MH/3t99+WpbfHocCPKVDKiPQnDLOIVCSQSgYVMYTxzfW3u0JlB6DSHIaR6Bi RQUE+zN8+hbvnk5qDVkNvP3VGV75MOOwqIesoxxz7+vhmfPEO00SiZHJHBNJRhlm6HYuL4018JGm I84UJGt8ZIFbknkBZcxd2nnkpsiNBVuCediYqlibsqlRiCnTqrC1n/zECCEhwI0BV4qOJMQxlZxp h2xJ4sDkjvmN/PGDMFSUk8Snmlio062BZmlgU5kaM6RNgRkbzAZpA7PxzUe4/QBrY5qiXLyDnQH/ e/LJ45QLBYErI5l6h0ysFb50zMpktspNDtu2jLmtsODn8nnsHA+6HVbDRpQ7Y5SrQh2q4I6NB1x1 Rfz1AxUyLOLKp4JUZovCUW6TZr8gXaRFWTcwHU+xJpuZ/L4yrWaGiahgXDjJT+44Lh9whePyt3Bh Xtk13Je52azsox9IGhLjU0lyPxBhRGOSurPKpLSVkJx4g3pGT3k1euDyyj7v9RjqjbVz9H2v4Rih 9ggWDxDKIaIeMb2cXEFtqq2pkOVLLKoD9qShC/o1F/IcG6TGXlym93Xzsqh4TxIDTZyc++h8RIoy d3FFCbPP4/EE0jJvJXYdhepU7N6OfUPpHtaaRGBig4uHokt9UW6LypbulXCNFPTBzxe4d4nHg9IU ucT1cW7ggmbLtFyYGja2al70hT3vjsuunOfBYFufd0WTLU39psVKHGlE7Mau7OIRJo6G9d2R9sh0 TSSIo9/5x8SoJ+oBUbTEV3khtlmncUj8r8aZs0qQNgSuzQ9rm+M4fZgw4SBQkqmTgl5JMnFHV3gd Ld/6ODWIhi/l6nGwjk9M/sKq6djxcGTdb1ZFljY4WLomGneN+fSGa6YPQ0n2pIE03fkucfzldleu bJqfdWOtH/oMEDPChtrv3PjHqc+l7Pqzr7efePNmc3Z6Wphmfub+3guG3cUFlbgkUrsWvUg8hRNT RCOqFAcatw0mlKaq+3b8E2AAzlS+6goNCmVuZHN0cmVhbQ1lbmRvYmoNNDMgMCBvYmoNPDwvQ3Jv cEJveFswIDAgNTk1LjIyIDg0Ml0vUGFyZW50IDEwMSAwIFIvQ29udGVudHMgNDUgMCBSL1JvdGF0 ZSA5MC9NZWRpYUJveFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDQ0IDAgUi9UeXBlL1BhZ2U+ Pg1lbmRvYmoNNDQgMCBvYmoNPDwvQ29sb3JTcGFjZTw8L0NzNiAxMDkgMCBSPj4vRm9udDw8L1RU NCA4NSAwIFI+Pi9Qcm9jU2V0Wy9QREYvVGV4dF0vRXh0R1N0YXRlPDwvR1MxIDExMCAwIFI+Pj4+ DWVuZG9iag00NSAwIG9iag08PC9MZW5ndGggNTI3L0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFt DQpo3nSS326bMBTG73mKcwmT7NrYJrC7LOnaTJPaKWi5aHdBwEnYgp1h2u5FtufdMeQPlVoh2dg+ /n2fzzm/Aw41BCqZUJlCwinjHIiSDCYxg1YH8figCVYfwAQMUslploLKFI2BHFcYvcLTq5lLoHTA +8+VuHOz5LB1r1kjjU3w7RzzKQ+u8lzizXyDQlJ4MhkmBpwzKhOIU04VZwryBmO2AWXML0r/wwXk L0F4Z8iy7jTMdWOj/CeGxSllaHaYEJX0zCyjkrNkICGBeNbEIx7CvxFJuKAqXEUERw3rtjZbEOBe 6q7caQdFB4vr/PNERT/yL15DooD0dOSKGLhQHt8b9WDhJdhA/xcRkfJwiew41B08HWBdm8orrAun K7AGZtZ0rd3DfVH+wpClsfbgA2oDvSLNxEQB4ZRnOOfzSyb6d6R9KpZfp9MZFKaC+e3sHkpL9J/a dZ6jzXPdWtNo01GfJXIGSnEByhOQq5F1RrPwNiIxlSGy9xoGnWlVtdo5tL7f1662hh5zg9BEDtBx kt9m7azr8CCWVIRlhNu7wmw1HGzbgX3W7agEp3e9TkgszvaTc9LD8mLqzddeWiAZFwlN3EU4GOJ8 T1XYU7BA6bb1rrBST52rKw3dDrMw/b6A1c079SHHLkAvjdZ9DVprG99I/rLGx9iNv346fQw5/yhY 0TxG3vJ1HvwXYAAocO65Cg0KZW5kc3RyZWFtDWVuZG9iag00NiAwIG9iag08PC9Dcm9wQm94WzAg MCA1OTUuMjIgODQyXS9QYXJlbnQgMTAxIDAgUi9Db250ZW50cyA0OCAwIFIvUm90YXRlIDkwL01l ZGlhQm94WzAgMCA1OTUuMjIgODQyXS9SZXNvdXJjZXMgNDcgMCBSL1R5cGUvUGFnZT4+DWVuZG9i ag00NyAwIG9iag08PC9YT2JqZWN0PDwvSW01IDk0IDAgUj4+L0NvbG9yU3BhY2U8PC9DczYgMTA5 IDAgUj4+L0ZvbnQ8PC9UVDQgODUgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VDXS9FeHRH U3RhdGU8PC9HUzEgMTEwIDAgUj4+Pj4NZW5kb2JqDTQ4IDAgb2JqDTw8L0xlbmd0aCAyMTAvRmls dGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmjeVE7LTsNADLz7K+YIlbKxk91NcqWtEEeEpZ6rQKIg kqVNK9S/xw0IFfkwfsx45kCCARRi5XyNKI5FkAXPqArG8Y2K28NIuxUmYtReXFMjNMEVyH4nY+/s mq/niHaGLDW3tnl8EfTz/183Hh09/3EelHJVb0rtzMiX18/ZDzBE2PkICQYVB+honJ4cM0douzS2 /aI7TZ/pI/UX7KdXrNPUDf35uD8NabrXd9oqHUwZy+CiR1Y2xRXZQpWuNnOOS8Z2pPxpDNgkS/gt wACUbUKsCg0KZW5kc3RyZWFtDWVuZG9iag00OSAwIG9iag08PC9Dcm9wQm94WzAgMCA1OTUuMjIg ODQyXS9QYXJlbnQgMTAxIDAgUi9Db250ZW50cyA1MSAwIFIvUm90YXRlIDkwL01lZGlhQm94WzAg MCA1OTUuMjIgODQyXS9SZXNvdXJjZXMgNTAgMCBSL1R5cGUvUGFnZT4+DWVuZG9iag01MCAwIG9i ag08PC9YT2JqZWN0PDwvSW0xMCA1MiAwIFIvSW0xMSA1MyAwIFIvSW0xMyA1NCAwIFIvSW01IDk0 IDAgUi9JbTYgNTUgMCBSL0ltNyA1NiAwIFIvSW04IDU3IDAgUi9JbTkgNTggMCBSPj4vQ29sb3JT cGFjZTw8L0NzNiAxMDkgMCBSPj4vRm9udDw8L1RUNCA4NSAwIFIvVFQxMCA5NSAwIFI+Pi9Qcm9j U2V0Wy9QREYvVGV4dC9JbWFnZUIvSW1hZ2VDXS9FeHRHU3RhdGU8PC9HUzEgMTEwIDAgUj4+Pj4N ZW5kb2JqDTUxIDAgb2JqDTw8L0xlbmd0aCAyOTI3L0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFt DQpo3sRZ244bxxF951d03rhGOOr7RW/xKohjIIaMZeAHww8StZLt7C6t3U0Mf0j+N+dUdQ+HXDGW ADuRBM1UT1d1XU9XN9+vnPnBrFIuU6wmu8k6ZzYpWlO8NffXK7/8cLv65jNzt7KmRje1alJLkzeb TmH2N/j67PIhm92DcfL3YYeRv1w58+7hWNZijberr+c5n29Xz7bbCM7tWywU7WSxgj647tSyccFO pdlktreY8m61mazF5+0O1Pbn1frq8fon456bq+tH8/efzOc/3L354e6def3q4fqN2d+Zi+2PKzcV T1Pd5FqLZvtCpThK4UsQSZf7u8f7/Y15+Wr3Dwi7utvvf4IoCrDGNVq90QfIkqcEn1g3RafKQZBL FPTt+t8XG2f5ae0uprSenPn8+u3+/tpcfLf9cuEzi7/0WZ58DDS5a+YO5n3hjCoAy+NUm2s0w1vn ZzPEGcIWhWW3v7u73j3C/Me9MH9oQRo9r0cHzP50Yz0sgz+LWWUsZJtM/aN5+H7/sy6x3TqrcRyr WTPF0CBgKsnD61x3UyAz+aUJFFcpeP3Vi5fmdQ/f46vXN9dd8Jwf71Z1CsktFc8HxV/dvfkkVbqs E1XSyImmoXzxxQX87taXLy82yP/1v/Kxjj2kR1puP3uiXE/Ep5FwU2g2nobiTBSsfJv4aRNQHJHa x+jiMTdToRxnYmYmhjUK+FKz41wqFtRr1dUoJi8z8aBSSinPk6A+1TqbbKg6/FmYmLqJ05zZbco1 FrEm1Djk+mGMPzbG0Zi6noK5Yv69evPm/vrh4fpBbXKMa3xSJbkLE1nrd/tH8/qXMwr7qbXyqz7w pYWnYUlT9iWfWjKHxR1ZQjvaeopqx8ikj8neNNVlnLQ0+wsX+OrFBTNkfagokY5UjsnG06Rf4M2Z wvNIsxJPC+9Taw47R0zt4NkmQl58cfkSZSXuiyiHcKqfG7jjs+h4UoBPlE0ojUW+efdxdVjLr9Vh +kAdYkPwsS0D/lGFmMxLmnC//+fj9f1I4XNFeSal08EuD/L5c8RgqAvMymkJ3oqxb+/3t2ezHom7 wFanZX2c8vlpyv95u3oPOrQ2BSR+SJFPa5LLExzSIrZvZ3a3q2d/vU3mxR77/3ttRGLKU6nG1TD5 wIYjlDRFLwMw2NwcBnIfmFmysNysvl8FzAYSugJAdyrFKxP6BydS+oxGsNUB0ZEDFTNCTRO2X5Kp KFk43U4Vi+4wPcObMuCCfm+U30QHkqSqyMJstAbwHY1IuhoG1AZXdPWkEyz38z5QswxEWR8zYU+b tclVzBvaYL0sA6qN2lKKSDvxxu6oS7NzsN+vqH0V2ltaF3KTdoseDyNekCAB+/oDIiSE73sCORMR 93YI5u5Wxm+xzzrqNyFvbwYRlELSSAQ3JdAhKH64lRxqEc2+GR8rdSQlsa1svjYFNZfxTsDAuzMF 4AuTN8WSN08oS7xCaJYJ8EsiI2bA1aC4zM0ggPpRVpCJG0+xN6suACRRXQUDWXPuSxKxRCIoNjaJ Y6ok3kWzhXE7aX/R9sJj7CYZgIAe2ZtWsKkeutzFNjlarA06zVwUBEKY61qrdLS9vVnN0kjrg321 p8LAH2QMkftWC1whbjsQXwo5AqOqR7M/JTkcaDZ5RxvQvYeIQNTx+ZbllxxHspeRWGS+S2N+qxTX v3J+hBYotvn0YZWhzgs0id04g3wyA/P99zjhLGsHqV685r0PBLmgdqc6tTJqp4zSeb8KQZLZW6yu EBWj+tUOjIhuDHSQ8JUg5C2yWGac00Wrl7RWdICJUM7hpOLSXMfhoMzv4Rx84b8sOkmOzAE7jdfb ASaXV/3UeHX5FZb5Ehb8CED42VTzN/Ptd9a8WaAL3YHapgeP0MV5gtYGiFkJFle/uYVM4LJMPuDH MvmWpt6uHp5WN0qlLKvb/fbV7WR3+pXqXuiUQqMZHwE5bN2f6CRt+fpPo+ueoSMBHVM8Cx3sB9oS ORIP0+eAgzGEsAVwJGxQ8Mc5HEh4i0vc+LT5/xfYoEuwBR3BRjtUaqyyJ3mLjaRwXZxXceghSGjj kJylXqz1KqgRsZU5lkns/dI5VUKakl+gRkS34cQ7dQaN/D/EjN4s/hfMWHQa1YqFtS2AIGCT4EpM mt8DB05lPcmmpf4fAoIU6mTrxyDBJxVdrNJY+DDqKqLfqH1AcwI1BNU4UKUdxrEMK2TjI4xAJxlR dAHZ4GkwDk6BbTE/JxHJjrOyyfERiJNGw2p1IPcBubPzrOLcDLJ18o4TsBL3pJwJ0zg/KXqvOABv cqALwIDljDDZ0geEkhY3J6kDku2I9NoRY6AInbXfB511Qi46P1UhSzsi68weuVqc/MwfhQ599aBk TEck/avsvspALYNdBlI/oyxYFjO8zHDlZEabWRiiIxldaI9Bln6bA9GNAXYMGOg9RebG0DBSpoZj d+ByEOaBwUwoIgTfm5qB2NGr2fa8YY8Cr2a5vpGOBF+4B0MTixOvR5lYPBC5xGCxN8YDdeJZmCuK ZtNDIBcTECwJCwfaGCjCOOgmFnBAOfAGxOTD6wycJvnmge05JhMI4tjpfEZxxWLYRhUqESWvaBXc FmWgW4EdO3EgSHJjgGlBc1AmqATEF50/njTchiS5Sx3gxNrjDQuF7odJ2iO0DTPN0GXxLEl6jaTr ZBVyZF+RasNASoO/KUNsytCUIYg4WqqkFmeuI1Na558HalCGnmvFHZGpDf6TbK2nuTiz+HY6o53O mFl6SY2Mn1fpcfjQjCJ0VhE4RNkYBSOCQ2gLO0A6GnHJiAs2R3GzFVDQczEHgDk9/3kkB127lkgU TPUCbNhFgMc+YMXI0xx2QMQdWRB9P8YLjlYZ6DjakTb6njnfS8IydkydRvDlYkWy06WR0QweDtUq hOVVhG6SxqgIoQprEWIIoiCtoKTIZT1EiTVJRzJIxZM5croXWSw4OXayvmovOB1A+ShEDBZWcFfH C5D3eiEZvBSHKuToElBDHyeoLRXiFCqUpLQTZ5y/eRAf69UDfO9lG+FmEfSoo81HHTdFaKHlhMX/ wFAV5OCjOrdMzp6/pVi2DXLtMHbKwwWF4zmeuw9O+178MfFeYhN5yYp2C1xoBzL3U8OAgGiB8zPP /Q17oMnadmxao5qFYQLl0KQUoBPqEYCCdQIgwAC5Mvd3V+S+xRNddtSiMtguDGb2Yvz5i0ndad46 BaKJUlUoNhhOWl1HJFNZjfXoAHrKKj0eyayTUb2gfF1SYWZNwloGq5LV6+Qkglo8UIm+6KxsilK/ ViFdSBY/i6of+Jzz8ec4TweUH7Gr9BQH3YRuQvIcXOVsVJWGMywv1SCPv/J4hKY2I/bQ7hCkMi1R iMoz+0C7nggOzREhjQVKMrOjJj5ha+JtL9pmFhkaSZsg3tOdLGXeTu6YR7rvVFY08wrLEf9qV6/T wQ0a853SOp/yDH/6VGsaNld0g4FnPMaQmy5yE/JSYGBQSIL5TB6xRvfe2LWHcdLAKYFFuIV4KSF4 xktfBFOT/KIEl/G6kmGSqOp9QtETttBR6OQHLfePdKRSQui751XknFqFzuX/PYKF8ZKfVfmMpGo+ opQvSyZk1sfNkhbTSZFYvtuZUVNmpNCg40xrgtZB9gysx5/n2SyFQ/4OaTMZ8/FnL9NdZ+dhzrHg qxwKbBbvwOuR4GC9uFEuGHeCJEpqfgBlIKZ1zQp/0K5ymVnMhl14DQbVjQQVBEPmIAriAfo6aE7P 161MNjbbnr6/ZTKKql4KTJMRfcKMiAIUQRp2UIFeD6I7KO6ZepaUpPcszgCw0G/wK8tM2RLfo1ZH 8GyZKkXdDBK53XTBoBt7Bz4K4vlFclsobvJ9/SA7ZpgVCLJhelVAMM1Lm3Bs8+IaVsTIzuL7sQBO bse3Inr24u81f+jnrv8IMABxN8ytCg0KZW5kc3RyZWFtDWVuZG9iag01MiAwIG9iag08PC9TdWJ0 eXBlL0ltYWdlL0xlbmd0aCAzMy9JbWFnZU1hc2sgdHJ1ZS9CaXRzUGVyQ29tcG9uZW50IDEvV2lk dGggMTYvSGVpZ2h0IDE2L1R5cGUvWE9iamVjdD4+c3RyZWFtDQrd3aqqd/eqqt3dqqp/f6qq3d2q qvf3qqrd3aqqf3+qqgoNCmVuZHN0cmVhbQ1lbmRvYmoNNTMgMCBvYmoNPDwvU3VidHlwZS9JbWFn ZS9MZW5ndGggOTAvRmlsdGVyL0ZsYXRlRGVjb2RlL0ltYWdlTWFzayB0cnVlL0JpdHNQZXJDb21w b25lbnQgMS9XaWR0aCAzNzMvSGVpZ2h0IDg1L1R5cGUvWE9iamVjdD4+c3RyZWFtDQpo3vr/n5bg 711SwP1Tq7pIgPu/kwT+k2g6bd3+v54kMKjc/v17OQlwcLl9aIf7aHofTe+j6X00vY+m99H0Ppre R9P7aHofDffR9E69cP8/mABAgAEAGkEOCwoNCmVuZHN0cmVhbQ1lbmRvYmoNNTQgMCBvYmoNPDwv U3VidHlwZS9JbWFnZS9MZW5ndGggNzkvRmlsdGVyL0ZsYXRlRGVjb2RlL0ltYWdlTWFzayB0cnVl L0JpdHNQZXJDb21wb25lbnQgMS9XaWR0aCA4NS9IZWlnaHQgMzczL1R5cGUvWE9iamVjdD4+c3Ry ZWFtDQpo3vr/nwD4Xh4OhfGnVnVB4f6/d2HgPpLo93IYqB9AtaPuHXXvqHtH3Tvq3lH3jrp31L2j 7h1176h7R9076t5R9466F3svHyDAAP5ysFAKDQplbmRzdHJlYW0NZW5kb2JqDTU1IDAgb2JqDTw8 L1N1YnR5cGUvSW1hZ2UvTGVuZ3RoIDk1L0ZpbHRlci9GbGF0ZURlY29kZS9JbWFnZU1hc2sgdHJ1 ZS9CaXRzUGVyQ29tcG9uZW50IDEvV2lkdGggMTQ5L0hlaWdodCAzNzMvVHlwZS9YT2JqZWN0Pj5z dHJlYW0NCmje7NmhDcBACEDRKTtPN+oCFZ3i1mCBCupJBTlJ3scSxLNkbvbetWcdtTPiKvO31b1V y4G3ePHixYsXL168ePHixYsXL168ePHixYsXL168eM3w6n3dPgEGAJi0o0oKDQplbmRzdHJlYW0N ZW5kb2JqDTU2IDAgb2JqDTw8L1N1YnR5cGUvSW1hZ2UvTGVuZ3RoIDEzNi9GaWx0ZXIvRmxhdGVE ZWNvZGUvSW1hZ2VNYXNrIHRydWUvQml0c1BlckNvbXBvbmVudCAxL1dpZHRoIDIyOS9IZWlnaHQg NTE3L1R5cGUvWE9iamVjdD4+c3RyZWFtDQpo3uzRsQ2AIBCG0TEtHcPSnlFcwt4djGNQkWOCs8BQ mLyjJn/yvYjRu46SvrPd+T2vP+uW327z4+aSvlVbntry5MnTJk+e2vLUlidPnjZ58tSWp7Y8efK0 yZOntjy15cmTp02ePLXlqS1Pnjxt8uSpLU9tefLkaZMnT23/7xlzrgswAO5VyJsKDQplbmRzdHJl YW0NZW5kb2JqDTU3IDAgb2JqDTw8L1N1YnR5cGUvSW1hZ2UvTGVuZ3RoIDE5OS9GaWx0ZXIvRmxh dGVEZWNvZGUvSW1hZ2VNYXNrIHRydWUvQml0c1BlckNvbXBvbmVudCAxL1dpZHRoIDEwMTMvSGVp Z2h0IDE4MS9UeXBlL1hPYmplY3Q+PnN0cmVhbQ0KaN7s1bENw0AMxdCxXd4+XiKTBOm9wFWG4i1Y +H1NIBAEZyzbdXb7zNzfbr/8+1nhsE+/3+F4z3vsK++P7GL2z/8l+4d+/H3q/VrYh9/vdLznPfaN 90dZfOx5j73eY8977PUee95jr/fY8x57vcee99jrPfa8x17vsec99nqPPe+x13ve817v9Z73vNd7 vec97/Ve73nPe73Xe97zXu/1nve813u95z3v9V7vec97vdd73mOv99jzHvs39H5evb8AAwAbIyEF Cg0KZW5kc3RyZWFtDWVuZG9iag01OCAwIG9iag08PC9TdWJ0eXBlL0ltYWdlL0xlbmd0aCAxMzcv RmlsdGVyL0ZsYXRlRGVjb2RlL0ltYWdlTWFzayB0cnVlL0JpdHNQZXJDb21wb25lbnQgMS9XaWR0 aCAyMjkvSGVpZ2h0IDUxNy9UeXBlL1hPYmplY3Q+PnN0cmVhbQ0KaN7s0bEJgDAQhtExLR3DMn1G cQn77BAcw0rOCS6CYiG8Sx0++F/E02trTd92LFP65uHPs+e33zTzK5ovmzx52pYnT56aPHny5Glb njx5avLkyZOnbXny5KnJkydPnrblyZOnJk+ePHnalidPnpo8efLkaVuePHlq8uTJ8wfN+OYuAQYA fjHImwoNCmVuZHN0cmVhbQ1lbmRvYmoNNTkgMCBvYmoNPDwvQ3JvcEJveFswIDAgNTk1LjIyIDg0 Ml0vUGFyZW50IDEwMSAwIFIvQ29udGVudHMgNjEgMCBSL1JvdGF0ZSA5MC9NZWRpYUJveFswIDAg NTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDYwIDAgUi9UeXBlL1BhZ2U+Pg1lbmRvYmoNNjAgMCBvYmoN PDwvWE9iamVjdDw8L0ltMTIgNjIgMCBSL0ltMTQgNjMgMCBSL0ltMTUgNjQgMCBSL0ltMTYgNjUg MCBSL0ltMTcgNjYgMCBSL0ltMTkgNjcgMCBSL0ltNSA5NCAwIFI+Pi9Db2xvclNwYWNlPDwvQ3M2 IDEwOSAwIFI+Pi9Gb250PDwvVFQ0IDg1IDAgUi9UVDEwIDk1IDAgUj4+L1Byb2NTZXRbL1BERi9U ZXh0L0ltYWdlQi9JbWFnZUNdL0V4dEdTdGF0ZTw8L0dTMSAxMTAgMCBSPj4+Pg1lbmRvYmoNNjEg MCBvYmoNPDwvTGVuZ3RoIDI1NTIvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmje1FnbbhzH EX3fr+i8UQKm3feL3mQpiCLEgg1u4AfDD/SKlGQsSUmkIORD8r85p6pn9kJSgQMpQSxrp6unu7pu p6p69GHlzTuzyqXa1Ezx1nlvppycqcGZj+ersP/icvXzY3O1cqYlb3szuWcbzDQorP4Zb797dlPM 5sZ4+XOzwcxfTr15c3PIa++Mi9VPy5rv16vv1uuEnesLHJScdThBHzzX9mJ8aDZXl836EkverCbr HF6vN6DWn1cnp7fn7014Yl5d35rT81vz9/fm+3dXr99dvTGf355fmUfr31fexhKambz1vSezfq5c PLnIKCmrvz19+sw8ff364/nNzfmNeXZ9dbF9t7klC2dCMhP+OuObAz+TfbAlqmDkkRdujdx+Ofnn o6nWZNNJeORtPbHe/HB29elsu/2HefTr+iWk8iGrUDVTqEUzK09ItIEE7958+nhuzlST9WNZFXf6 n6m48nbnDYc/9Ea0LYK5I3vHTSdPVZs3K9vTeDELjbfXFw8wgpReVy/nn7wIM68p29bvKuOV59WD PGNfeAYV4IWfeXqLqT3BLV9M0dYu56R412iuHli+iuXTCcL29O31Z7OY6l7rT4sTB0sY9+b27Pbc PKgArRvykQrqln+nR7GBCtynyCzIfZpEo6qICsCOdzN4fCcsJ304E0uyMZiSo3UjSGf5ncGZPQRj aw6AAzWxw1kq/KvnP4rGcGupuaqUbQFOKLLqtwGz27PftudqoT0wL3CJHSIUSNJsjYc49ns4/lKU tLozsrro5HTfviHkuxZutvS7Fj7C/GLhJhaOJzaZH6lUwIonT2Dew2AJ9yQPDZWLj9eX5oU3n264 XYU7gsNXQW0p8xvV88/r1YcVrdyZlKaYE58O6alYuKwjeLo3G7j/r5fZPL9G+kXaRbwUSbb6wPKI wMF/piK5jXQrLiozIroIjuxonn96j7RIZFAAW1OOYhsXFvP4tNN1SaiLuFqGcFJOKCs2SxmKtiB4 AkyWWCcof5/fXq7eYgISmhJkIlVZ7fO8GjUNzMZbWV66hY+XKud0Q1vYN5t2pe6Prmft+xZ11C0x 8GEFT9YgtA+RvqRJWHia7XV2qa/q059ms6YWkNkRvxl+5OnZR6QNHxxStDdb0I7SeZizVU4k1DMg MThETubEQwLFbLMK1DqTWqodRY02anmRpx/J8y2shDf8v4hcI9DnTuPIb9JucNuz09GknD57hWNe QovfTTSfTTM/mF9+dea1yvth4BAx1pwYpQl+ZPJyFQEPisVo265ORc+vqeIxrzthuK/s5ermQTgj XI/g7Oes+5Uhrdm80ExAa8xlqRN+HORHf8XKNTdnozFrzuc7J+0lyjWLy5I4EkPw4ZwRmz/MGZE9 5EM5I8VwlDNSTF/KAbHFw5zxx9b/T3IGTXInZ+QdRiOscpAuYm0H6QKF6DBdxJT/s3QRU7qbLspO lG+eKWiLL2eKHfih5X8f/IzIL4D/UP6HwZ9ctNlUgOoI+d8AkAQYgiHOmEsV1SbJRIlSXYCvXqrM tB5NysAbVA645kX0/ykFi4YywBCBYbFKeOGFThKA6DzZP3KiaL2KgD28w41glHBB9Fnp0gLoyHtj YLR1YYgJdKKcGBxDoGE50fI8gVDlRGeiAKmviRlS1Ahh76LyCyIgEKMaIv/QBphImethRKFKV6rq bsJnI6sLVxfr67w9F5lI/ohfWybmLXdW7HgcLXC6I6jKHskP+T4A7hm8EpqC4IVEq4mI6XoCsK82 c9VWoYcXkR9KkQmVKbKxLOQAt8K9zHUZW0NmwUHeqUE2MIY9OcZSxC2YqMKSNxTE4eEEZEBSn+mx Y5kAz6origqBQ5HPZSZhCa8amXojxhpDAUBo5ABzDbWysvSzaZ0GFyayWhK3eoSkzLiG8PRjAZpV JCv6PgTR2uURXGqmEVmRAOZEyvNETothSQ4zMnZIVjV78Motqd+qhN5WJmgkTFTZL7c6ksUPsgkZ 67w/6XIf5/0juNoyoQzSQs87+uGCWB9c0HWFG8HW+F1lhCOsjiw2yIg7T4pFGSi4NgLoqAAdgAbi D/AJ28dIuzKXgCFSSBKrs7UFXaOsDxKcmyUJJa3kWxZ+hIqckWUNUnfxVgMjLLEkbsatVGMJTCUc u5gOMUyQ4zUrAKmsq70YmhMNls9VHE2SGSUXm4WMIhBIHzX4VUJEkfp1mYiyQY/vu1DYrmaWw/Ny oCJ6FigtSWSj29uSg0g6JcntyBqbB0u2R80qTSaQMSPUBRXgwL7cIVH6pWLLpVM6DP6g6ODe4dQE ZddppLm833PaXqMdpaMYRWQpt5MHKpvhu+1qYs5DV8qAnxBhkR8wWuhmSpJpJM3iRp7ETlJVsYnm guIW0AWVWWMQmbZW7IOktcE4MCFYFsfMkKgwuCBaMEiDS5EKkPmjFIlkOEJUYFh0jLLOiY2saaSa iF4ihp0bRFE4rckYNpYbHTfwklaoiKxnbPL+qwQ/n+D1drdscJXdY0PbzbPnhW5CAMewKZIYBJvQ E1QSERV3QmMXMW6icK3Ma33YGhc7rOh6ZndSX3FtjHIrcESn0K2Q9lLA4StG1sR2BSnM87MMd7OT rO0unWYalYmfeXc02JH0Qjl2JDiM6MBhHV0BjMcrbYEL0RA5fiKm9lSi6RdjlbsWIgqUE7NUZodO QbL4G5FR2V1Ztjd0WOX1JQ3vdzGGmpC1tdF/SiAAxWocQ/FGJ8sYwyrbEUoYJ/WGqNvYAHNcuMHL EGdVRqfugAaVNVi3wK2VmX4wCKD6TOnKtmMuXO55h2GWsEdgINARLOjsWAvRPWVLCLBONYnljWAF pSIPrCTJeDMC0HLllol12IrdkmHFZc/puUzCmh1ilOwrTswMWkwTx1rnvJTv4ePML5aD8hIR0oKA cgLgLkAnBTsipkrR6HLMMl4uLULBrqCcUJ6dcBEAIszoW/WBEHJVG8e5Ir7aKkPAWv1DwtPwY5yD QnIc3NOAMVnwe4yt5kDVjVwi7m3JFRWsLqkffgTVpvyEXx3/NPrqu18E9y4mCGutAyXv50pJKk4c EpiT1CIc66/oIGTVfMX14kmnj82qSJssrvHDrqnM48FEKWEvyzWfb1hyGbTcAmkkXxKnhHKz459N +NzwE35Lg5qq5Aq5UI7xLKxSjmUMstagCFSxBQw8c2I6FGFggSDfpKx+1E+GbYyTX5RHAJKjSnYC LBnNhykRNOlWSS/iUkiIsMnMLReP4VmbUUkzrpPonRIeOXX5nOTNSxPMZ/P/4KbTnYiLw/YqLq2O MjJJyaSjJlnGkTgl6CRR04yafCZEVMqvpJh5Gh6UbDhJfsWvZOt9USaB2eSlTVmkEWEm6Z8pzaTd RtQBvRZ0qAeKLDockighcFYxGhEtQoxMzxv0vwQYANUg488KDQplbmRzdHJlYW0NZW5kb2JqDTYy IDAgb2JqDTw8L1N1YnR5cGUvSW1hZ2UvTGVuZ3RoIDEyNC9GaWx0ZXIvRmxhdGVEZWNvZGUvSW1h Z2VNYXNrIHRydWUvQml0c1BlckNvbXBvbmVudCAxL1dpZHRoIDUzMy9IZWlnaHQgMTAxL1R5cGUv WE9iamVjdD4+c3RyZWFtDQpo3uyUsQnAMBADx07pPqNkifTZIXgMV0H+8nuZYJ6TFhDiOKlKmhnp uU6rt/S9XvqSFWMcVit9AReZCy+Cixx3Rexwv4g3FqxwfRHGKPMFXGQubGPABb7AF/gCX+ALfAEX +AIu8AVc4Au4wBdwgS/+4mKLTAEGAKhbo6AKDQplbmRzdHJlYW0NZW5kb2JqDTYzIDAgb2JqDTw8 L1N1YnR5cGUvSW1hZ2UvTGVuZ3RoIDMzL0ltYWdlTWFzayB0cnVlL0JpdHNQZXJDb21wb25lbnQg MS9XaWR0aCAxNi9IZWlnaHQgMTYvVHlwZS9YT2JqZWN0Pj5zdHJlYW0NCru7VVX+7lVVu7tVVe/v VVW7u1VV/v5VVbu7VVXv71VVCg0KZW5kc3RyZWFtDWVuZG9iag02NCAwIG9iag08PC9TdWJ0eXBl L0ltYWdlL0xlbmd0aCAxMzYvRmlsdGVyL0ZsYXRlRGVjb2RlL0ltYWdlTWFzayB0cnVlL0JpdHNQ ZXJDb21wb25lbnQgMS9XaWR0aCAyMjkvSGVpZ2h0IDUxNy9UeXBlL1hPYmplY3Q+PnN0cmVhbQ0K aN7s0bENwCAMBMApM082ygIUTJE1sgCFGQCZIhFKwT219eIv4m1ayVPvI8/5TBLTyy+dV/rqss4/ /rlLJ0+etuXJk6dOnjx58rQtT548dfLkyZOnbXny5KmTJ0+ePG3LkydPnTx58uRpW548eerkyZMn T9vy5MlTJ0+ePMfLWJMuwACEYapuCg0KZW5kc3RyZWFtDWVuZG9iag02NSAwIG9iag08PC9TdWJ0 eXBlL0ltYWdlL0xlbmd0aCAxMDQvRmlsdGVyL0ZsYXRlRGVjb2RlL0ltYWdlTWFzayB0cnVlL0Jp dHNQZXJDb21wb25lbnQgMS9XaWR0aCAxNDkvSGVpZ2h0IDM3My9UeXBlL1hPYmplY3Q+PnN0cmVh bQ0KaN7s2bENgDAMBMAxKRmDMvtkCSZB6bNAqij0FkUEEkpx79ay7Gs9xsvUHHP2K6Y8dLUjJn2Y tYXaF9lr1Vm8ePHixYsXL168ePHixYsXL168ePHixYsXL168frpx7ut2CzAAvJnjIAoNCmVuZHN0 cmVhbQ1lbmRvYmoNNjYgMCBvYmoNPDwvU3VidHlwZS9JbWFnZS9MZW5ndGggMTQwL0ZpbHRlci9G bGF0ZURlY29kZS9JbWFnZU1hc2sgdHJ1ZS9CaXRzUGVyQ29tcG9uZW50IDEvV2lkdGggMjI5L0hl aWdodCA1MTcvVHlwZS9YT2JqZWN0Pj5zdHJlYW0NCmje7NGhDYAwEIbRMZGMUYlnFJbAswPpGFXk mOAQDQ2Cd9XkC/+L6L1W8luObU3ffp351ccvW5nSNw9rfvGff2ny5Glbnjx5avLkyZOnbXny5KnJ kydPnrblyZOnJk+ePHnalidPnpo8efLkaVuePHlq8uTJk6dtefLkqcmTJ883mzHmbgEGAEpLyJsK DQplbmRzdHJlYW0NZW5kb2JqDTY3IDAgb2JqDTw8L1N1YnR5cGUvSW1hZ2UvTGVuZ3RoIDEwMi9G aWx0ZXIvRmxhdGVEZWNvZGUvSW1hZ2VNYXNrIHRydWUvQml0c1BlckNvbXBvbmVudCAxL1dpZHRo IDE0OS9IZWlnaHQgMzczL1R5cGUvWE9iamVjdD4+c3RyZWFtDQpo3uzZoRHAIBAEwCpTDx2lAQRV pI00gAD/IJgEgdjD/tzwa7+1j3mumPQOmU3VHFOmXXd45UfXzn+d2sWLFy9evHjx4sWLFy9evHjx 4sWLFy9evHjx4sXrqB3Xrm5dgAEApiqjSgoNCmVuZHN0cmVhbQ1lbmRvYmoNNjggMCBvYmoNPDwv Q3JvcEJveFswIDAgNTk1LjIyIDg0Ml0vUGFyZW50IDEwMSAwIFIvQ29udGVudHMgNzAgMCBSL1Jv dGF0ZSA5MC9NZWRpYUJveFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDY5IDAgUi9UeXBlL1Bh Z2U+Pg1lbmRvYmoNNjkgMCBvYmoNPDwvWE9iamVjdDw8L0ltMTggNzEgMCBSL0ltNSA5NCAwIFIv SW0yMCA3MiAwIFIvSW0yMSA3MyAwIFIvSW0yMyA3NCAwIFIvSW0yNCA3NSAwIFIvSW0yNSA3NiAw IFIvSW0yNyA3NyAwIFIvSW0yOSA3OCAwIFI+Pi9Db2xvclNwYWNlPDwvQ3M2IDEwOSAwIFI+Pi9G b250PDwvVFQ0IDg1IDAgUi9UVDEwIDk1IDAgUj4+L1Byb2NTZXRbL1BERi9UZXh0L0ltYWdlQi9J bWFnZUNdL0V4dEdTdGF0ZTw8L0dTMSAxMTAgMCBSPj4+Pg1lbmRvYmoNNzAgMCBvYmoNPDwvTGVu Z3RoIDE5NzcvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmje1FjLbls3EN3fr+CqkAOIITl8 dpfaQdMAbVNIQBdBF44s2wr0aCynQT+k/9szw/uSZKdJ0bRoHMSX5HA4M5xzZph3jVUr1YSYtM8q Wm2sVdPgjUrOqLtl48YLm+bnJ2rbGJW91SWrUIJ2atqOIP0zVp+e76Na7JWVn/0CM9/OrLrZH+oa nXHd/NTLfDNvns7nHjvn1zjIG21wQv3F5+oSlTVB22SCmm8gctNMtTEGGxYNfzg1/9BMZvfLXxV9 rc5vL7c3S/Vqd3evfvxteadmH1b3i9vlXp3N3zakS0pBTa22pXg1v6i6HOuSryzKvlIXL85fqfPd er3ar3ZbJZuNsoX9ntZfGKaoA6Jioi6lmsc6fGuZZV2vJ3+cTS1mdZnQmZ1oqy5W+8Vuu10u7tXZ L/OXowAa/HAAs3bBEQatgVZUGrHtha22IAw41pjC3jhjXS8cWHhyfbfbiNmn6p12iUbqDcmOWa8Z CvFndH4UAS36pl5nHzkM2ns7BFEupHMXa3BXhwny5Xy3vV7dvL9bqvvbZXXZagqWxpa3hnPALl6c 4Yw0OX91Ng06T9Tl1dXdcr9XNztELE7e/P5Y3OZPmt7a42hZHUKOI6erT7jch4MEE3PyVX4IwQv3 kL5B3eZy+/5yvf5dS6RgfQhyQZ6yPww360zjDLE6cshooolD9rH8SEBUPjLtIX/DyD5Jocn97hF3 p6ne+ehKjOx4fn/b++w0UaTPimEx/jTR3EOJVo+rgYuaWHgUuB6m7LA7jJvluOWJ9mp2u/vQpQtD /uFcG0zXHX1wanFePYKXUtJfhtulQqeeBB1disee9BlwwBHiR5noUP2olz+fW1PZsTPMKOgqCJtO wYHF2ERk2jglTOrYsU2xHy7OpiC/ySv1ZrW9Wm1vqnbgzAcTjoBYoVw9vL98s15KWEYszZngffIn mXC5vVKt8KdYjTLigY8+skWUMPf+FjuuoUL+mCg6unZRbOxcElvVqbEBRcQOtrqRe58E/0dTN5ym 7vN58w5jKkUTrp2C599GBRtBm6qA2IpVi03z9LtNUBc7LoWnh3ONftdOWBTFCBp1FvCTvTK94eCA fgl0sW74kIxo4rNOW8+lac1FK+nMX6RTVpZ4cQ0GATd0K9bq1G9ILNCqkoV6gGwwnRqvI8teP+nM P58pHSi5oHT0BA06Bl/U7PwHOPMSG98qpz6orL5Xr38x6ur/4N0ezqE9wRlMi3zV6GG4H3HofxId 9iMdN/mWm55dXaln+/3qZru8QjdxhsYJBa1jJC+MMJTsvpmp/ceztuDtrlVlGMmqkIwOXjmH9oC4 ayPEGj5LJ8b5Vfq1TXOLmcIzZGXGpyrsRBjtH2tq10Q6Fm1YeYFrrNxU+VCVZz2sfbY4d4lfouM0 PWAQHADL1Yyigi0cD2SNg/YUOsChpxLE/YQNoC/eQdGgt+SDA2dPVq7AeJi9xgScwhjAtTz2yUlK hozSyhOP2eJJV1MiMtsj9ChRyHC4kkprCQ7qLfkSocEK/421OFTukQsBxA7uinvx2rkzVg2wSsDp GJ6wPrPXIDQa4ZOyZDGMSwym2T/uSqvrsRQbXJIcewCsyAN/CFb774HVw1UH6wkVVjymBNpRxPmY OHkoS1YQeyDZ5CMxCzmKQoRroIyyYdoi26GalaDU4iIkjtBSDKc5OaCf6gSbyuOIMY8iD4PcPA+p Dnn7QqThBjkvB7A2JCw5kpSnLBHkVRNEPBU2kZ2g0Dnhszhh6vEZTjixOPcTYFmQcWEDMEL/xEMn BzixB0NT5ADoAzERk5msG52quA91OArH4lEAwm6Xa/7i4YUdKXR8l/vqizZAICjlWlKc/8ETFIwQ 4FLWlHpZ08H1geMGqAAjfrjzoZSxm1kV4qtCCYMbCAJynhg5eI05JYnPV86LSSFM2clO4lVQkGxE ASgYOQ5xHYKPiiiYgpBBZ3zBWQaoU4X5ayFyTiEmUDkFmsHbfLHynWUBuIIYYp9Eey20uOvM/Uqs ZyW+CbzHfTfEJr5snIakRCbDyfqNk/GNErpolWCEFrNeHrbg/LGXC+Ggil1+VfLFeSP1mh/+JQyF lkEXhuatdsncJgJKtjaJeNcevOo7eC73AzRJsgGXFexxGeUELN3SRiDoMRGdTBwUUU+O1bRLLOtx 8XCuZ78xYXHm+4H/Pkv4v6ifHAhkK2pdGVCQxuXTcddmKjVsGu89m2EZNgJ8jyMjujBQA7X8Vjg3 He7UpI+VT76eagpsiMr7GhomHdubUv7F+smxyP19nJTPEQHARbxJOCphXCunzPoMvsAh+RLFkpNx rOswm8bmj0vlADfiMjCGmx3D7W8gTZ5IeHEWiOE3mZh6cd+937wdcPxN9y7FZtjL6ruq2++psJ93 T1JBs0OtsLnWrHQMZxsFo90i487GUKeiTB1A2tUWsFtjcWflNcAlk9JxZG0UDHeLny//qWi0UsSp 7cAEAGEAALeoKCWUqFXrWNRJuU/SSjiUcC7vsE2g50qSPiJFwdTjWKy0z2PH3RbqGDY5QXRrhz+u jAfQ4QvwQziOsDMgh5tj7q3RlOc0Rg58Qnqh4rel09X/Hy5cUQ60zXpdU9wm46xK9apO095yb4Iw EV6K4bBD/Cdz9E8BBgAFOvBYCg0KZW5kc3RyZWFtDWVuZG9iag03MSAwIG9iag08PC9TdWJ0eXBl L0ltYWdlL0xlbmd0aCA5NS9GaWx0ZXIvRmxhdGVEZWNvZGUvSW1hZ2VNYXNrIHRydWUvQml0c1Bl ckNvbXBvbmVudCAxL1dpZHRoIDE4MS9IZWlnaHQgMjc3L1R5cGUvWE9iamVjdD4+c3RyZWFtDQpo 3uzZMQ3AMAwAQZTBU0YhkMEoSqMEMrgE3KFSh1q69xpZ1q3J/KC9quIcVcdVlg+v/7R7FhMN7ubN mzdv3rx58+bNmzdv3rx58+bNmzdv3rw7eL/7nbgFGABrp+iYCg0KZW5kc3RyZWFtDWVuZG9iag03 MiAwIG9iag08PC9TdWJ0eXBlL0ltYWdlL0xlbmd0aCAzMy9JbWFnZU1hc2sgdHJ1ZS9CaXRzUGVy Q29tcG9uZW50IDEvV2lkdGggMTYvSGVpZ2h0IDE2L1R5cGUvWE9iamVjdD4+c3RyZWFtDQrd3aqq 93eqqt3dqqp/f6qq3d2qqvf3qqrd3aqqf3+qqgoNCmVuZHN0cmVhbQ1lbmRvYmoNNzMgMCBvYmoN PDwvU3VidHlwZS9JbWFnZS9MZW5ndGggMTg1L0ZpbHRlci9GbGF0ZURlY29kZS9JbWFnZU1hc2sg dHJ1ZS9CaXRzUGVyQ29tcG9uZW50IDEvV2lkdGggMzczL0hlaWdodCA0MjEvVHlwZS9YT2JqZWN0 Pj5zdHJlYW0NCmje7NLBCYAwEEXBsj2mH5uwEvFuAznJmhKyoLDi/NzD8piIQjvX+W0R1z6/I/17 tMSK3d77Mv2q3f7t7vNLeh//Z24f1yd/T3VvrdTtGe9DvO6PdU+J15133nXnnXfdeeddd9555513 3nnnnXfedeedd91551133nnnnXfeeeedd95155133XnnXXfeededd95555133nnnnXfdeeddd955 15133nnnnXfeeef9n97f3S3AAKUXA/4KDQplbmRzdHJlYW0NZW5kb2JqDTc0IDAgb2JqDTw8L1N1 YnR5cGUvSW1hZ2UvTGVuZ3RoIDE0Ni9GaWx0ZXIvRmxhdGVEZWNvZGUvSW1hZ2VNYXNrIHRydWUv Qml0c1BlckNvbXBvbmVudCAxL1dpZHRoIDIyOS9IZWlnaHQgNTgxL1R5cGUvWE9iamVjdD4+c3Ry ZWFtDQpo3uzRsQmAMBCG0TEtHcMyfUZxCfvsEBzDSs4JLoUgSHiXWn78XsTba3tN33Ft+ZXhl3fP 7/zh5pK+dar/5MmTp7Y8efK0yZOntjy15cmTp02ePLXlqS1Pnjxt8uSpLU9tefLkaZMnT215asuT J0+bPHlqy1Nbnjx52uTJU1ue2vLkydPmlJ7xzT0CDAB/xW+mCg0KZW5kc3RyZWFtDWVuZG9iag03 NSAwIG9iag08PC9TdWJ0eXBlL0ltYWdlL0xlbmd0aCA3OC9GaWx0ZXIvRmxhdGVEZWNvZGUvSW1h Z2VNYXNrIHRydWUvQml0c1BlckNvbXBvbmVudCAxL1dpZHRoIDMyNS9IZWlnaHQgMTAxL1R5cGUv WE9iamVjdD4+c3RyZWFtDQpo3vr/f8DAq1XEgf13iQTEm/i9nDhQP+rGIe/G6+XhRMHRcBx142h6 HI3r0fQ4mh5H3TiaHkfjetSNo+lx1I1DNj1Sv8cOEGAAa3ATeQoNCmVuZHN0cmVhbQ1lbmRvYmoN NzYgMCBvYmoNPDwvU3VidHlwZS9JbWFnZS9MZW5ndGggMTQxL0ZpbHRlci9GbGF0ZURlY29kZS9J bWFnZU1hc2sgdHJ1ZS9CaXRzUGVyQ29tcG9uZW50IDEvV2lkdGggMjI5L0hlaWdodCA1ODEvVHlw ZS9YT2JqZWN0Pj5zdHJlYW0NCmje7NGxCcAgEIbRMTOKZfZxCcewygIuYHn2whkIpHtnLT98L+KX ew4Xo+bXZsnvPv60+bbZy5U+bXlqy5MnT5s8eWrLU1uePHna5MlTW57a8uTJ0yZPntry1JYnT542 efLUlqe2PHnytMmTp7Y8teXJk6dNnjy15cmTp02eNnny3H/G51sCDABGmGfECg0KZW5kc3RyZWFt DWVuZG9iag03NyAwIG9iag08PC9TdWJ0eXBlL0ltYWdlL0xlbmd0aCAxNDAvRmlsdGVyL0ZsYXRl RGVjb2RlL0ltYWdlTWFzayB0cnVlL0JpdHNQZXJDb21wb25lbnQgMS9XaWR0aCAyMjkvSGVpZ2h0 IDU4MS9UeXBlL1hPYmplY3Q+PnN0cmVhbQ0KaN7s0TERwCAQRUGZkUIZP5hARqoYwADloeAoMlBl j5r5M28jvt4o+d295tfexcXy5182n3KlT1ue2vLkydMmT57a8tSWJ0+eNnny1Jantjx58rTJk6e2 PLXlyZOnTZ48teWpLU+ePG3y5KktT2158uRpkydPbXny5GmTp02ePPdtxpmbAgwAC3hnxAoNCmVu ZHN0cmVhbQ1lbmRvYmoNNzggMCBvYmoNPDwvU3VidHlwZS9JbWFnZS9MZW5ndGggOTIvRmlsdGVy L0ZsYXRlRGVjb2RlL0ltYWdlTWFzayB0cnVlL0JpdHNQZXJDb21wb25lbnQgMS9XaWR0aCAxNDkv SGVpZ2h0IDM0MS9UeXBlL1hPYmplY3Q+PnN0cmVhbQ0KaN7s0LERgCAMQNExGYWSfVyCMahYwAUs sQ8WHp3yftpc7vLGWOw8YvXKsfKw1ae+dKvlFOZ/P/LixYsXL168ePHixYsXL168ePHixYsXL17b eL3rFmAAVlNG8QoNCmVuZHN0cmVhbQ1lbmRvYmoNNzkgMCBvYmoNPDwvQ3JvcEJveFswIDAgNTk1 LjIyIDg0Ml0vUGFyZW50IDEwMSAwIFIvQ29udGVudHMgODEgMCBSL1JvdGF0ZSA5MC9NZWRpYUJv eFswIDAgNTk1LjIyIDg0Ml0vUmVzb3VyY2VzIDgwIDAgUi9UeXBlL1BhZ2U+Pg1lbmRvYmoNODAg MCBvYmoNPDwvQ29sb3JTcGFjZTw8L0NzNiAxMDkgMCBSPj4vRm9udDw8L1RUNCA4NSAwIFI+Pi9Q cm9jU2V0Wy9QREYvVGV4dF0vRXh0R1N0YXRlPDwvR1MxIDExMCAwIFI+Pj4+DWVuZG9iag04MSAw IG9iag08PC9MZW5ndGggNTc4L0ZpbHRlci9GbGF0ZURlY29kZT4+c3RyZWFtDQpo3oxSy27bMBC8 6yv2KBcRQ1KULB1bJw1SoEAKC/Wh6IG2aEOJRKqkFMO/UaD93q7ot5sahQ7kkquZneH8CBhUECTp mIgMUkYoYxAlgsKYU7Aq4KcXTTB7BzqgkAlG8gySPCEcol2F3TO8vZ24FBYOmP/cAk8epgxW7hzr hGMZfDn0fCiC26IQ+GexRCJBCUWG7YK8YxKnECNQmtAEigZbVkFEKMXrYoFVsQ7CidGLuneV0W5U PONh7OeLtgsFFqckziDLcJAtikeIB4RhwwaUb+GvUcRYwggLp7gjPHz/9TGaPE1vQBt40WatoZHP xkLlXK/c6HvxCbmwM2ZjhLg7oF4Hk7VVstxA1bS1apTuVAnzDTR93VV4Ah6XkYTSfACn4yw7gOdH 0a9Kl8Z6wdGx+3KU/xQ4lw6nMBoWvbU4EnTKdTdQdT8duE7Oa7VTyzP/PtsFy5yTLAXGxcHagS8Z iP0IYsv8exTlgpM4nFV1DaWBxljlSaDSGAmJh6qtzWbwY++AyLOdAzkfNBEvZK9f6dfKGj388Oaj x6kgyV9vzveWiDNLtoawoyHrYc65glralao3u+lU+bYNgnLCxb9tYBcuMEphIpu2d6BVtzb2xd1A ZzpZIxWDz0iOYYbeKbuP2YU6IWKSilN59OA5P5VGSRY+jSKSh9a0xqHpBmRp2g6mO7Egnd/D7OFq 9sTR+zsrl9215CV7m5Pz5GEARhF6FZ7GwD//YAJIXWLVGutj8XhffBynfqT7IvgjwABV7Ss4Cg0K ZW5kc3RyZWFtDWVuZG9iag04MiAwIG9iag08PC9Dcm9wQm94WzAgMCA1OTUuMjIgODQyXS9QYXJl bnQgMTAxIDAgUi9Db250ZW50cyA4NCAwIFIvUm90YXRlIDkwL01lZGlhQm94WzAgMCA1OTUuMjIg ODQyXS9SZXNvdXJjZXMgODMgMCBSL1R5cGUvUGFnZT4+DWVuZG9iag04MyAwIG9iag08PC9Db2xv clNwYWNlPDwvQ3M2IDEwOSAwIFI+Pi9Gb250PDwvVFQ0IDg1IDAgUj4+L1Byb2NTZXRbL1BERi9U ZXh0XS9FeHRHU3RhdGU8PC9HUzEgMTEwIDAgUj4+Pj4NZW5kb2JqDTg0IDAgb2JqDTw8L0xlbmd0 aCAxOTYvRmlsdGVyL0ZsYXRlRGVjb2RlPj5zdHJlYW0NCmjeVI9BawJBDIXv+RXPi1Rhx2R2Znfm qG3pWRpYeixLd1vLWnQp/fvNqoiSQ/KS7yXkQIIvUKxqFxIqcSyCIgZG7RnHD/K3g4GaJfbESEFc Tog5Oo/iooxubLp6HCu0I+QUY2udl1dBP97vurnR0fbKbJRWqsGc2tmhUE6bi3Ni+JRchVJMCkfo YEhPjplraEvFVHnoHz3o5/v+G28/v7OF7kic99EeEyc5G/B0RmUyWSH55NlijvWEPyv9CzAAYyM7 eQoNCmVuZHN0cmVhbQ1lbmRvYmoNODUgMCBvYmoNPDwvU3VidHlwZS9UcnVlVHlwZS9Gb250RGVz Y3JpcHRvciA4NiAwIFIvTGFzdENoYXIgMTUwL1dpZHRoc1syNzggMjc4IDAgNTU2IDAgMCA2Njcg MCAzMzMgMzMzIDAgNTg0IDI3OCAzMzMgMjc4IDI3OCA1NTYgNTU2IDU1NiA1NTYgNTU2IDU1NiA1 NTYgNTU2IDU1NiA1NTYgMjc4IDAgMCAwIDAgMCAxMDE1IDY2NyA2NjcgNzIyIDcyMiA2NjcgNjEx IDc3OCA3MjIgMjc4IDUwMCAwIDU1NiA4MzMgNzIyIDc3OCA2NjcgNzc4IDcyMiA2NjcgNjExIDcy MiA2NjcgOTQ0IDY2NyA2NjcgNjExIDAgMCAwIDAgMCAwIDU1NiA1NTYgNTAwIDU1NiA1NTYgMjc4 IDU1NiA1NTYgMjIyIDIyMiA1MDAgMjIyIDgzMyA1NTYgNTU2IDU1NiAwIDMzMyA1MDAgMjc4IDU1 NiA1MDAgNzIyIDUwMCA1MDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgMjIyIDAgMCAzNTAgNTU2XS9CYXNlRm9udC9BcmlhbE1UL0ZpcnN0Q2hhciAzMi9F bmNvZGluZy9XaW5BbnNpRW5jb2RpbmcvVHlwZS9Gb250Pj4NZW5kb2JqDTg2IDAgb2JqDTw8L1N0 ZW1WIDg4L0ZvbnROYW1lL0FyaWFsTVQvRm9udFN0cmV0Y2gvTm9ybWFsL0ZvbnRXZWlnaHQgNDAw L0ZsYWdzIDMyL0Rlc2NlbnQgLTIxMS9Gb250QkJveFstNjY1IC0zMjUgMjAwMCAxMDA2XS9Bc2Nl bnQgOTA1L0ZvbnRGYW1pbHkoQXJpYWwpL0NhcEhlaWdodCA3MTgvWEhlaWdodCA1MTUvVHlwZS9G b250RGVzY3JpcHRvci9JdGFsaWNBbmdsZSAwPj4NZW5kb2JqDTg3IDAgb2JqDTw8L1N1YnR5cGUv Q0lERm9udFR5cGUyL0ZvbnREZXNjcmlwdG9yIDkxIDAgUi9CYXNlRm9udC9JR0tCREErU2ltU3Vu L1dbMTkgMjMgNTAwIDI1WzUwMF0yN1s1MDBdNjkgNzAgNTAwIDcyWzUwMF03NSA3NiA1MDAgODEg ODMgNTAwIDg1IDg4IDUwMCA5MFs1MDBdXS9DSURUb0dJRE1hcC9JZGVudGl0eS9DSURTeXN0ZW1J bmZvPDwvU3VwcGxlbWVudCAwL09yZGVyaW5nKElkZW50aXR5KS9SZWdpc3RyeShBZG9iZSk+Pi9E VyAxMDAwL1R5cGUvRm9udD4+DWVuZG9iag04OCAwIG9iag08PC9MZW5ndGggMzExL0ZpbHRlci9G bGF0ZURlY29kZT4+c3RyZWFtDQpo3lSRvW6EMBCEe55iy0QpbAyGi4RoLjnpivwod0lvzHJBCsYy UPD2sb2IKAWgb8x4RrvseH46m34G9u5GfcEZut60DqdxcRqhwVtvIBXQ9nreKL71oCwwb76s04zD 2XQjVFXCPvzhNLsV7q5X+cDvgb25Fl1vbl7JxeeXVy6LtT84oJmBQ11Di13Cji/KvqoBgUXjn3hd LYKInG7ZY4uTVRqdMjeEivM0q/1HaFkDmvb/eVKQq+n0t3JJ+Psx/M2zoo7UEB0i5YdIhYwkVaSy DJTqkJJ5RyDRdJ5OJ57Vic/cbt+zKHqvxtOSUjilyEh5QWGCRCqSaxKpj0wjSbqleCaR7JK6ltEu dL7PINQ6bLWoSJhK2Ng+Zb045xcQ1xrHHAbcG9w3b0cbZhme5FeAAQCNgJvrCg0KZW5kc3RyZWFt DWVuZG9iag04OSAwIG9iag08PC9TdWJ0eXBlL1RydWVUeXBlL0ZvbnREZXNjcmlwdG9yIDIwIDAg Ui9MYXN0Q2hhciAxMjAvV2lkdGhzWzI3OCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAzMzMgMCAy NzggNTU2IDU1NiA1NTYgMCA1NTYgMCA1NTYgMCAwIDAgMCAwIDAgMCAwIDAgMCA3MjIgNzIyIDcy MiAwIDY2NyAwIDAgMCAyNzggMCA3MjIgNjExIDAgMCAwIDY2NyAwIDAgNjY3IDAgMCA2NjcgOTQ0 IDAgMCAwIDAgMCAwIDAgMCAwIDU1NiA2MTEgNTU2IDYxMSA1NTYgMCAwIDYxMSAyNzggMCA1NTYg MCA4ODkgNjExIDYxMSA2MTEgMCAzODkgNTU2IDMzMyA2MTEgNTU2IDc3OCA1NTZdL0Jhc2VGb250 L0FyaWFsLUJvbGRNVC9GaXJzdENoYXIgMzIvRW5jb2RpbmcvV2luQW5zaUVuY29kaW5nL1R5cGUv Rm9udD4+DWVuZG9iag05MCAwIG9iag08PC9TdWJ0eXBlL1R5cGUwL0Rlc2NlbmRhbnRGb250c1sy MyAwIFJdL0Jhc2VGb250L0lHTEFITytTeW1ib2xNVC9Ub1VuaWNvZGUgMjQgMCBSL0VuY29kaW5n L0lkZW50aXR5LUgvVHlwZS9Gb250Pj4NZW5kb2JqDTkxIDAgb2JqDTw8L1N0ZW1WIDAvRm9udE5h bWUvSUdLQkRBK1NpbVN1bi9Gb250U3RyZXRjaC9Ob3JtYWwvRm9udEZpbGUyIDkyIDAgUi9Gb250 V2VpZ2h0IDQwMC9GbGFncyA0L0Rlc2NlbnQgLTE0MC9Gb250QkJveFstOCAtMTQ1IDEwMDAgODU5 XS9Bc2NlbnQgODU5L0ZvbnRGYW1pbHkoU2ltU3VuKS9DYXBIZWlnaHQgMC9UeXBlL0ZvbnREZXNj cmlwdG9yL0l0YWxpY0FuZ2xlIDAvTGFuZy96aC1DTj4+DWVuZG9iag05MiAwIG9iag08PC9MZW5n dGggMjUwNjkvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aDEgMjI0MTYwPj5zdHJlYW0NCmje7HtL zC3ZddZZ7r7/qapdr/P8H/fZfW+/0u1uu213247t+JF2nDhOHCfGBAKJ4yS2FD86weQ1QC0kQAIi SKZISBkAAxAgxAhFSBmAhMQAJAYgGSEhIaGIAQOGKE1Ve+38X331rTr/TTJAgtvafeqvx36svdba 6/Gtla1Wq7R6a/XE6j0/+uOvvPr5f/83/91w53eH9jNf+ZVvP1i/8MT/XK3szmr1rn/5C29+9Rs/ 9Du//d9Xqye+Mzxvvvr1X/+F/7D/r/9qZb/1v1ar/b/+2s9/+ef+4//+C3999cQvfm14/trXhhvv Wn3panj/fwx/P/raN779a9/4F6/+/mr1ZL+y33z569/6ypfL4z//tZX9/d9d2e99/Rtf/rU3f/n4 fV8avv/M8P6Db375Gz//zW9+9ZOrJ772/NDHvTd/+effvPWdH/23w3gfH57/s2HOb9nfXt1aFcP8 3xru9P771qpefWKYsZ2tnrDx33Dvief/1mr8dzb+78/85BufWn189eDt/7b6ztvfWT1aje3Jlb3z xrdX/2QcfWVv//9//0//W/3D1btWbw7tybf/4O3/Mvx9NnBaNfBWO3DadrVfHVcXq6vVndW98U74 fHjjBmPdG/77NwPf3Rn+e9fbv7/64up9qw+ufm/o7+Or11cfXb26+sjAq/959aXV5wZ5vf9O++3h yW8MM/z66lsDvz4YRjq+M4exdavVP33+pc9+4U+/8f23n3rqJ989cvbI3+/wu63e/oN3/vwux//h vz/10T+88dYftvcObTu0cmibdzTFd1s7tNeHlvxZ8nuFv1e+I4dvre4OrRla5/c6v9/7N2N7z9De 5/fy9+M31dDeNbQn/f6toa2Hdua/4/0L7/fM33mXN7xX+Dj5myf9ndzX+O6rQ9v52Pd87Qf/7szn 3fkcW2/j97eHtvcxLp02ha9x7esovK8exjOg2zjma0P7iM+hGvbhYmg/OrQvDO2poT0/tJ8d2stA tx7a1ts4Xj2898jplVuidwuYZ36+hb9vie/Lod8f8zm9NLSPDO3jQxv55gN+/fLQPjy0Pze0V/36 kV9/0v8e1/LBob3mf4/9vDC07xnas37vU0P7vqF9emifH9qfHdqPDO0zQ/vi0H5xaD80tB8Y2g8O 7bP+/PP+zvjtG0P7Cb/3Mb//iaG97uO/1+9/2Of+iq/jtvc5zudFf39c7zP+94d8vq/5OB/y9b3o 91/0Vnsb793x98Y5nPv4eW6f9b0e1/LjPoef8LV/2u+/4XT+mK9zvP/D/v6P+LPXfR3f798863P+ mPf5Od+71/ydcS+LoX1laP9oaA+H9itDe3poV0Pb+n6OdHkwtLtD2/jejn2M/LAf2nNDS97Gezun 13FoIy8fhvYz/vvTQ3uP0+M5p/Md7/uB33vo1x/y9jmnz8vevu6/+bu7cH3Hv8e/HznNS1/vqVb9 Cbefcbr/hPPsj/n157x90Wl+kzbqhZW3ca/evMHfvwLX+Bzfe5zn3Fb/l7dH3nbO07e9PYDWenuv 78kKeOkLrjf+nt/7G74Pf9f7/Tv++5f8/VEm/oHL/a/7Nx913v6Yy+SoB77X/37Zn4/f3vP2Qf/+ s379yOXpA66XXvff73X9dX9ovY/Vu+yf+1j3vK+7Lnvj76U/u+/fv+JjPOu02YNs7Z1uD7zPS3/v rn9/6e2237/y9mF/56GfYR/0OZ+7XH+P67HXfR2f8etL34fXfO7PeHvZx/iE65dXXCbe8Hdf93He 6++96GM/67R/n8/3OddFH/A1j+N1fv8l4JWHvu7XQZf2/rz1cyvT8znnia8O7ad8Xpl+j/zMy3x3 z9f7cV/zu32cjc/r6O05aM84L7zidHjo878Dv2/481ddz9yGc+ETfv8+0PcV4M0PO488cLo98mdH p8n43fth/z/puvu+80d+9lHve+trftnXe+Hru/S+3+/Xmd4XPt743decbvduqmOzjejz4fa0/z4A +brnvPK07+NP+7o/6fR+2uf2W077D/j3d+C7z7ku/6Jf/5DTOev1HwC75AGcoVkeHvqZ+YLvUebh 18HmeMFtn/c7r30QeOp1sGVed13yun+T5f0l569x/r/pcvfQ5zzquH/s83vD1/JpP2u/5OsZ6fFz TqNxv7/sNPi4P/9Bf/+noGW+fsntjGzD/TXXh+/xfX7Fr1fOC3/ebdxv+Fye8jV91XXFDmThkf9+ wmXzV72vbK+82/v91tB+w3+/RefC496/Sft1ujZoxR+jHfz3Pzkv3/E1YnuP7/PI23/ZdfC33dZ4 1en0ktuko6w2rsfOnQ/HPVm7jmv8Xu/vP/C/C7e//qJfr2ieSzZW/v5Fv852cj47Mt2u/N54/cu+ 1tHO+ObQfsl57JdcT3zF+fNnXU7edH78jPPwF/w3//2C8+LnnWbf799/CPT1+3w+Wb8cnQ/vOW+8 BHZd7/LzO677Hvk+vOEys3IfOPu2a/cXh/uD33/t11bgcz/hfuK97/qGg7f+1urc/cQnoZ+1X/fu T0Yt+8LYzqlV/m4RtCeo3fL7pX+LzcDX37vvW/p8E7Q1rP1J/83PKqDNCuaQYwyN0+OBjzPeX4Ed 1zkv5r8b36uN713t/N7B+/l57b/J3+Xf3HdynZT76qGvLFvZL2r92191v61yXfURP0t6kMON676D n4u18+5D8GMamGfm00/72Dv/Td5H4/cSzO0p8E8zfY6wjgrWjO9Urn8+5e/X/n7n7baPeel2wc51 R6Zz72OX/u1toH3t3yBdO19j67TIa6hhrbXPrYM92IG++WEfcwN7XvtaWphbApq2sO7K+8eGNKlh Prgv+R7SdA88hPq1hH4qGiNBq31NmefyHK6APzM9Sv+7AH5OcL+C77O+b2AuJfF9Kfiiol+cf5aR 54BP8Psk+qpg7BLmW8J+Juofv0uwd9x4/YnWWfn5V8D+VOJbnhP+XdB7bKvWRM+SaFEJfuDx8X5J 95BP8O+C+IjXXkLDPW+BniX0yfPGtSh6MV/VwKe4/yXxRxmsqaK1l4KnsL8m4P+O1lTSOivSAwnW Uwkeq8S+oV3E866ErCXSu7VYu9pj5hEcm/tVYyUxD5brku6XC7qgWpi74vskZKSi52Vwv6Jx04K/ 2NHaue9a8HEd2AMlnSf8nVov6y6keRPIQVrQmSl4tzpBK2wlXSdB9yT6Uvo3EQ2j9VSCN3lONemu gnRWCuZdirkkwa+oG9V8mLYRH/CaakFb1rGneDWaQ7JpnDoFshPxThO8WwU6oKZzL52gQSLaVgtz q8SZUy3s6xJ/pwUdVog9SLQfvFeV0AnVid9IbsuFvUyCN6K1FcH5XYENvgP78Qhn3wXZztnfQb8n xyF3YJ9mu31LNinbv3xOI01Hf+B5/xt9pS28v4P3d+RLJVhf/i7BXHKfmb5P23Vcf/T5n4HrvIb7 sLcP/G+MLe089tB4/w34ZxuwCdC/zLTqyX+p4Jst7FdP/iLy2hboi78N0LeHb2u4bmhOdeCz1EDX Ct7twPZradwOdAj6wh3t0WaB35FnOvKRe3i2t+v40IX7cXd8v0q/l+Pq2ccY/c+/Cry+FWduLfy5 Enwr1g81rLXzcVGfdHC9AVpWQo8l8OFLouVG6Npa+BzKFh/7Oad38n7k+N2l378C3ZH3qvHnCdbR BOdbBTqiEb4InoNI+574oXea74EHUaehzimg70zvnnxLpFMPfFUK+4x9TbYhK+FvFeQ74/631OdG 2CrqjCvBrrmg+eP3Lc2rBxo28NuJM/Xc92sDe9YEvkH+9kDfb6nfTvCksv+Uz4Y0720ec9iSXYZj IU9sSV92tL4G+sN4kYq1FLA21HkfhnuX/s5d36tL/z06jY5w77bLWaZ9jmvz786/O7gc5Ia5wD3s wbmPf4R3tv7OhZAz5PsGeKmGdxPQsCXaIZ02xMdfh35Gvfx++PZ5P2+f9b8v/Iz9K/bduPv43UPQ MeP878G4d0En8lnVwhzuAB9hjBPPv4bsCD6PGnE21fRcxRlxnJ7OUpzrDp63JKs9zL+Dvnp4dkVr q6Df1qb5mgpohTEW9MfZpt6DPmtpzbjurH8uYd0l+Ra5j/eSjup9HTkHnbEFWUZq3/9L8qkznqAH eyDbZhf+7UOwZbMMHOFMvADe3TlfboH/sj45d/vv4G185yX//gps5T3YhZlWR5/Twd85kr16CbKc bYQ8/yvY+3N/J9P+ADZn1gOdXx+BVht/Nv6+aNfx+U7Ybz3oix5s06Nd5w0OoNvy9d5plu+d+29H PsU5fXtwfZhg7APs2R5stwPoQtR/F+CfZBssn5dHoHHWhTvggSugWwf0S7CHB6Bn3tujj4FzPYd7 ee5b6htp2MF6cU0V3O/h3bwnR9jP1q5zB1tY41P+Xg/22H3gsQPIxAHswx2NsYe9PMI8z2EO5/BN piuuJ88f96CHeXBeCH2TI5w9uD892KfoL2V52MK52JPcbX3MnU3zdHuhi1uwfQ+gry5g31GX7UBG e/CPD6CjDmDXdjDPDezZJfi9B9iHDexDB/TLdNrBvRb2dg9+/gFojXmoPawJz597QDukzQH2d0ff HsFHrGAvW+K7Lay5A3mqYS18hmI84yB0BsreDuZzBF7GfN4OZDc/L8VaDnAP5Q917pZ05hbkow34 H/PN6E9uiO8P0AfqKZTRFvrcg692RnJyDnqvhX1oQX5ZzlAHnwNf9zTPXuivDcznivRLDTyUeSrz PuoX3MeedCjyB/LzTujZHvRGB301tC+Yf+5sGhNryQ7bAL/3ZN8xjc5hXjXRuQOdfrBpvOWc1tOA bszPG3jWAh+i3OAztAHwnQsYj/e3tWmO/0A6LefkMUbUkY1yoDMbdQTaQqxTOtK5e9rHFuZT0f2O 9u0IMoO80xHPHEmfHEB+jnQu3iGdjLK0hfPgSH4c20RH0FEHsBExRrSnfvCcuIRr1tE78I/Rx0R/ I/v4G7BHNmLMjHvNWMqMq8w4yoyzvef3n3L5z5jLjFnM10/bNTY/49kyRjL3c9v7eeDXGZ+FWM77 PnauGbgL72acJo6R55v/5vqB237NLfvyt+lexlLfATq2No09tmATsq+EOT+MP+EzjPFifrAmv1Xl UJaeceylorm1JE+VTXMCKg+H82stzkGpGJjKo6CvzjmZpabipjinGux+fK8lmnY2z2eo/AbTEP1s jo1yjKE0ncsraa+TmAPKLuMFOCeIv53NY6EY11Q5OI6HRlgC/uZULj+JdXK88FQusAU64DmHsZ2t TePOnKfF+JDK/akYsZpfHfBihNUoQdcn4vvS4jww6wMVv1bPInlMtH7+Zimfo+Ls7QK9ONZcAO9h ro1xMojZUTlqxWOt0B096bOG7jGmKMoLt6axHGWwB4gLzN8XgheKQJaqQM5aeodjoUt4hI5koBQy Wga8XZGuHq/XCzq6g/3uwG9iPBb6MAmut8AjhU3jw/n7O+BXcD4AY+Bo70dYnR5sRdRP7PcexXfo 4yFmF/e+sSlWGHmzpvutadwI7ktr09xQCs7Djvothe2BPFGTXCjMWyV0B+ZrlM5RZ1UDfnES4yr5 qsn+aG0ZD6LwZGVwBqdgPM6z9UL+lW7i/FcR6BeVQ6xOyFWE9SqAJzhnV5AOZt5qyYYphG4uBa3Z PqwDGqcF/ZQE3aqAHoznYZ1cAJ0499qJeSp8UGPzfGYRnK0l2WaMk0xkryhbideydM5siRdK03ik MuBTlk/FL9HZr3yRCOsd4cY2Ns1hlWTflIF9VAZ0ugkesiLej2ycaoE/2wWerBZs6Tz/PenfUpz3 qt8dzT8FdgeeaRvTODPE129OyFkeax/wEa5JtSK4t7c5LkBh9ipbxvAVNsdnMJ9sqJ+C9HBB8+R9 qamf4ga+NtcwVGQb5P42pjG4yscoxHz7BT+SebcX90Y9MtZsPG/T+EQinkddVpiu3ShsmotuAzoU pEPYF2/gG5T9Xoy/g33ZCvuR6312ZFt1dObl+qmafAXMrWIsGPEpGBfFGHuOW1fQb44HI/YR80wb oNEG/KQcq8T8VqZNjqszviPHYzEXtLFpzh/zLZjryjQ52hxnijY25vcQF9HDvDE3cAdkIOdy8/pz DqIlfyOvj+tMWtLLBdlTuM8od4h/O8D+Is6/dvlohC5BOwF5k3kY8cidzWtPIjxyzv2quADqEbZV UafWJL/sH7RETxX/4Fgm1/KgjmiDsxBtrWftOsb/lO8D+kqZX/L6kXcwP/jA/37JpvnYjfNXfj/X VzbQX+67hz4RD/0snLnjd2Ms+RmaB85hJ/rO+Ypzm+cKdjR+ZdNYPt7rbJpHz/iMu6LfLegvXD/2 +z0w/wbuYz0m4iowLv2QdG8Hc9jYFK+wJZrnPMOO5lnBfPM7iHHA+WUM0fj3Ixp3Z9NcLY6b6cb7 lPFqe1hT433vQA43tM88r7x3nOtO8Czff0Bz3YE9j/njvU1zOph/3cOZsaG9aoB3dsAb+X6mce43 5zRaOmswT1fbdX68h3VhLqwl2djaFMezo/WhzObzGuWpBX45ChnYCb47h/7H5/dBvi+B5zMv74Wu QVnoSB/10Gc+XxHvx99vSZaeIvrsbYrF2sE+IJalheudTWvXW9IDO5vjYc5tio/duhxl2bgNfMX6 N2PXXgKfCeuus/39vE3xdU/789s0b4zJPXIZfN71K54byGel79d4/TLQ81k4k9HWQBxI1hmVTfHN e7IdMSd7AFpmfCvyewI+2MM5cW7X+eoN7Q/G3FvovxX2786mmAbEAKFd2EKfe5Kl1qa5dcTkNGCb 9CBTaE9taJ4buM5zyDx2zxvGontYw47u4XVJPkoP+rgE36QGOlbC7kabEOuZ0SZrhH/XmM5NNjbN JaqaQ4znNqZjtI3N8bK16RivqpPDNbZkb2HutqW+W/LhML/bBn5pS+va2RwbrebE47Y2jaE3Nq3R 4PxlZdPcOfpRGDfnPF9Fz2px3dB5hs/z+l8Cm6ol3XxFPh3iTVqygTfgdzbE+zvyUbc2xRYxzryC 58nm+Y0CxkB7/NJifDvG869Apq5siitHfBH6Dlubxifum45n1rZcZ865ywvTeQZV01uTv8715KoO ncesSfZTcK8UeqWwea0U6wyF/2jIZ2xo39jnwpqxhtbOPmgL/FTavP4v39vaPP5U2DyejTLM+gLz dgn8nFLQvbU51gD3Ym3TmkAVL8JcT+fPtuBXMw80tA7mFbRpOec0vn8LztBk83oS1MFoq3Rgr6M+ W9u8Vjb/3ds8LluT3itpDgprU5OuV+sqYC4Yo8EcLuLEKrIBK5ovtr33U4NdWoKeOrNpPBX3ryb/ lXN5Hf2NftoSjijHWzBnjPGY6EzHfA7STuUcOrI5e5vGOBPYcsina5vmbzfA85cwJucEMy0jjEcB /WTdnu+hzVCQbOPatzbPt3DMv4T9yn2vQT5Ln2cP689rWNs0N4CyVIB+RZzM2qY1oTgfrB9c2xTz uLZprnMPui/Tcu33zsgWKmxan6dyophPWJvO7eZnO9PYjkR8g3tzZlOczhrkrAD/t6BWw3i5BmRN tvYG6FPavN410xJlBuV/TWOWwAs7okkHzxKsgW1u5M9sL61tWhPbwHVJtleWlz2d53vwXfl8Kogu LdB7b9P4bU/rLIiuFdzrqH/Owa1Bxtc2rRM/E/zVif1aA5/iPDDHjbrmDL5ZE4/g+bkGHljTN2ui wxq+4f4LWGtFPucZyEEhZKkV42JLwPtroDmeAU/ZPK/Vk62SceiM0c31DGj7tvSdwnUoXFUBMsNY HN6zms7x3M+R/I2KbLsk7CDEgz1POnVj0/wV5rhqm+NfFe4Xz9K0YPuxXcz5TZYf1rEq350WziaF R+XcsrIfG0HbwjQuT+lyhaspTOfXOe+ssEEKf6dyXQpr0ZCOxb3syD5sTOdsVP4mwmmoHBNjYRhb 0Ih7So4UPRL5TygLyPuIWcG5sfwq3CrmApd4UeGWarG/Cg/Rm8bpVIEdVoozW+GlIkxVEvMogu8K i3FEEV5iCf/WiHsV6ZMysLcjfIOiPc+tsikeJol97IM+FJaC8Sh1sN7oN4qNLOm5aP0KGxrRRo2v 9GJa4L2l/TtV28CtDmieFsZa4sWlvYtwoGVAjxT0WQWyUy3seWMxNiyqkVEYpCWdcJN9r07QMcK9 JXEd4cYY51/YPL7B8cFT+10EMrd0XQkbIqrJSIFvmQK9lSzGWtYn9KqKOZQ30KFVwHOKv7n+R2EE q0CvleKcrwJdUROP9kIeFG1SIEeFsAUK8o0qW8YXsk1+Sm7LwAZbwoQmIZ+l8GciuUiBfZ399gr8 9n2giy7gTNvaPE/VBzqI621YVpCfG7KJx9jU3QW6LuFfK7Iha6HXcp6E4331gp1Y2jSnyTZgQ+up hX/COO/eptjoRthq3DhXpuRzH+gWjLfm/VT+I/NpZ8vY4X5B7iLsfhT3U75F4zyRcR6v+ZxGzNy7 /R2sfcb9vIB+Mm7jnl3n37fg92IcMefmMgbgoc8z17a/YNN69Mz3z/k3Iy7hRbuOX47ttr+X15Hj uXnde+CXHt7NOXmMEWbM0znMee/zyvdyXi/jKY92XUOOeKicO8w1RxmXgPXfGSuJdd+dTfOOCeaJ uK2n7bqmPM8LcTaIvcP8KeJ+cvwacVaIq+htigXIegoxEphzfAA0RwxSB+/l7/L+Ifaqh/3KY14B 7RDHgHV6W1gHzg1xaQcx747mk2COvXinhmvspyI6ZdnOZ8BtWueGxtg4T5Y2zUcgvmNHzzCP14t5 5bF2xHNcw4F4jsxPvU1z5YwNHLE/IxbxeZBTxKlk/EnGRo3Xr9h3c/UZz4mYAKy1Qx2uzqrCpvGa ks6J+6Cvt2QLJbIHe5vX3eIZ3JLebMWZj7pc2RsYv6htXtcd2YB14BPXgX+tfJBqwT5QMZOlOl0+ YxrTdRNsc9fC5q7Jjmgsrv1hPEQUn0piLKR3bfP4Icbk2L5uhI+j1tKIc7YWthPjr9WzBLZQJeiq 4kJt4LMrH6GxOK7RmK4lxjgr2liK9xSWI9HaotqyqPZzqU7rcb/l2NjmBv50JdbUmK5lSkI2VByW 62QVjoDt/jLYd2Ubcpy3EbZyJeRO1c+WJIPK31a2OONJFA4mqknF9XaBba54oTVdc9EQvWvyS5fy P5XQGWXgUyeLY5g8/1bQXsUmFEaGdTv78pXQd0n4VxWtj/VxI/RzbTqeFOG8EA+cTujJ6ExjHBnz CNcC96br/LgekOWhXtiTQpzrKn7E7zKvKz3D51ptGq/KuqIROgD3eit0blTP3Jiuz6po/HpBz7Y2 j5U3xHcp8KEjOtXibK9Nx8LWNo8fFKZxG6zjOiHTjekYrvL/a4vzOCzPKbDR2OZtF3RNFHfns4hl s7DlvEBty/G1KHa9lCdqgvdbW64/boK1V4EuVnFGNd810R6xRjeJLUZ5isKmsawyODsK03mztDAH vF/bHMNTmcb0cL2vymui78X9jHM6sylGrbE5bgnxIip/VAQ0a2yOLVvKKRbEP4ibUnXWa5vncBub 41Z4jlVAqyKgpZpzsbCG4gZ9Mk2imH4h6MZ7WARrVnvD355abxH0j/ci3N36BnuBuERc59ljzOFA crah8/TKpjVLiB8YvzkGNt4YZ7i007EKxJ2yX761aUxb5XQVxrEN9P862NO18Am5NgEx4o04L7sF HYx22CGwj6J4QbXghyhbWvlNyXQsI8r9lAtnSQrO2VKc0b3pGu8kzuK8b4irbIT/rXBNEU2ehX3b +9+5rkD5FMniHBn/Xdhy/p33aneCXgX5dlXAF6XN8ZTj9RiLH+sNH8JYSdgGHDuKMEBl4DOqPArL HPrR56ZrKTBGzLVCOe+6I7nCuoqOWk2y2kF/ONfOphhl5Xvh98iHOZ/A2KvO5rnIlsbrgvnnmGzG mza0Hp53xnU3Nq97SGLtDem0mn6R3xqQW/SDSkE7VdfTkQ/S2DSmi3ThHEjmCaxFYQxm7n9j8xoW XAPHg7nmpaG9rsQ8G8FXlU3rZSqb4ldL8rG4trGlcRh729kUt1rRvBPRuCGZSjQ+ygPOjeNG/F1J PM08XNs8544420b4mw3JCO9vLc6nmnxtFYfha84rNLSWZMu1bjXpX1w74umbgJ5J8JKKJ/PclR5j +nQ2xyOrOA2e77XYE9RtnU3jK2zHtDat62JatTavo+W6w4JowvzcCjp0Yv0NyQjureLzTug85PHW 5nUanZB3jpNhbTHua0fnbif2uyQ6dIG9WQo91dF7ylbkZxyfVvGRjZADjm8l4nW0e5GeOG4rdG5D ZwPzOsf310I3IW0Z5496iOfEsZIuaIy968QcKiHDKeDJZqF1pmtoVYxQ0Q7loRR81NoUF862OMoy 1tQVwndA3VqYzvtWZN8UgkZcC8LzTEKOWcaw1vbM5jW1yr7rxLnaBLTh2Ova5jmLFngU4z+J9GpB e4l8iOct2+q43jOSrQLWg37DWsjgWui1qG69FHJYCT8Z5eoW8cYZrPPM5nG5tX9zZnPM2xrGz3EQ 9knWFuO51wt/R/5XRWMq/wf39ibYbK7BPLM5xiBZXOuzhENUPmpD/Lbk1zeBnVDRma5si1tkm6m8 cGtx3IHPI6ZFLXSFwj0mm+d6GYfBZ1aEmeb4eGPTunI1RjKdL2yEr8w6iPMrTeCndORfpoA+inbq zGvEGViaxnyr3EsSfkMp7ITyBrRTuTX29aIcEfMD5wOx7hDteTUW88sSPlrZvmO7JLke790Wvl8i 3spr6IEnNjatI6tJl2D9ONaIcmz/jOQWsWQZ81bbtBadf7n29ZbQyS2cRz3JJOeTGhi3Jl13ZjrG e8um9bN5HRt/ludwtGk9Odacc2wZa3d7m+ZxWlh3SX0lmGsHZzDWOJ/BHmN8GeuWK5vXNhfU39qu Y8VIv96m9ewZQ3sknm3oLFjbFM/wwHS8Ocf5d2QXFMCDhaAnn5Oc61PnkcqZcb2syvvg2GdCjtF+ 29q0brwgG7uweR5wu3Beoi84vntOdjDn46K8fJTTKUm+MPeZ57UDnslyc27TPCTKUCHWUsBeon++ pj1ek31fwLdYk1GQ/6HqpQq7zi9xPkrlaRPZnnncHfFlonkVge26Bl+D9XBrOr9YCn3AeXGVdz4j HYo5DtZ7O5vm8W6JNW/g3hn1X9B5wHpL1dgWtMec21T3C5C3R6AnOOaR28ivT9l1/CjXBuRzcwNn 49Hm9eY1nZGqHl3h/JZq+XIus7c4v9HaHNsZYS4jfBT6jY3Nc/iVxVi7ndC7vc1xbfmbrcW5aPwW 7aetxRhqhZfJ/WxBX+TaLrb3VX3zqVrOFPg7ak+Pog/0zVj3Mm6BY3nJdF14tTDfqF5X4Z5uWnMd 4Yp2dhpvg/t2vIG/eyp/e6oWl+leCH2z5N9GWGzGmFUBbVB/sX2XbI5Twdqx0jQmRs2lspvVTC9h iDhmslSbjO1o03hmZ/PcbS/8aY5xY50g11youmXOL0W1uaWwiRS+lGPfO5vHijvTuFfOFSWhs1QN tMJ3NsI+5rOhs3lOSmEAopiCyrG3Ym9q4fNirBlzLxzL4HirwgTXAV+oWEUb+PYNzSstnIMqZpDX viXfHPvuTcehFOaZseBLcqRiMKXYS66djWJkiGtJNsV0VIEcrE3Xwqiaj07Ik8ITKVz30tmEsWKO EUU0Vfq5C2Q+8nH4XrnAY6quStX1nuI7ZZc1Czab8tW4/qS1eR10xrehT78N+LIlG2xPZ+bB5jXg rNc3QnZ70IuI7d/R+J1NsXtM+4yzyzXLSvYreCfb8OPfL8L8cj3wC35/bCMeaayFfGjXtbSdj5Nr U4/+TsZ+XNh1jeJ9f97YdYwj1yHnmsoD0PBg09jg2M8Du64THr+9a9e1uFd2jXfJNd7nwDcb+La3 eV4n97MDn2IDdMvf5frbc5hjruXO9cj5253zVJ5vD3NpgUcQB1PCXBrwSZXuKCzGFKr6x0iOkuhz CUumcgSNsMeW/Dg+W7jmVdlx3Ql7je3AtelagaXcjLL3ME6K8VrOo62FPc3Xa0FbxqSzDlmKLy3h kYvA1yiEnizEHJQPdgpjHb2rcO9LeGbexyrwGRSN68Bmj2QFx1sLuSqI11u47kEvv+K/911nZlsp 679RNzzr87twvXHhc7nwb67sug79HHRK9h8O8CzrmNt+P88j69fb3u+F/30J+i2fAT3ovYPwa1BG S/hG+YJsW6o8C+fc2XdXdjT7MphjYSw34iAQ49fR/vU2x3+Nz7/X9yCfZwlodel0v7DrOO05nAVX YBfc9b6v4LzYwbtHOIsreC+/ewXnaz5jL/z60r+58Hkf4Yy5suu407n3cQH8coQ+DsAf5/Asz2/n /R7hvT3Qgue7hz4qmPc59L8DfjwSDXOfl9RXti9wni3QNNcn1MDHB1hHlosjtXymX8C+7l1WN7Tm nV3jnPfwbAd0PAf61C5/Bdg6e6Av2gZ7os+OaJDf2dA892CrXFL/ecwS5nZOdDlSP3vgG1zXAeZ3 oL72MM8t2DKKVkfo4wBjbsEGPyd6bUHPIcZwB3NE+6incwHn0wnbvzKNidvadV6GfXCVW4jOZ3X+ JnG+Rv6QOsfUPWXTVGI+nAfkM7SzeZ1XZAMuxQOX6k6iugNVa8O1g4XFdRn1wnmv/NGNxTHizpZr JBg3yXHgKK7LcbWbxm05dhHte21xfIRreiM7uFiwEXlfVM2S4oP8nsL0L9lnZeBXMF5F0aRY8D0a Mdba5nE/rvsqhSxGsXSOXTKOl/F6lbB5FOZG1f9g7GVt8/gw06AV/MV6JS3IPO55a9O4KOJ1a5vn Tzj2qmrPozgsYzprwTtsA6qYcm3LtWKnaslKYRtzbVIlxk0L9yIdstRUPU8KzpuK7Os6WLeK+fF+ jbngMSb0tO/zI9O1DVvYo3y/tSlWuA70VZRzVPot2TxunujMSKSHsK/WlmPguW0W9objGo3FdYfR Xi3llG56/jbCZ2Kc4RKWM+L5Wugotqeyb3gW0KUKxlFx/Ir8wGrhjK0DHlZxZTWPWvicvN4WbNMd +OrZBs+xgD3Ztfm7bBNnnGGOE+Z3cy4/99OD/5Lfy7HQivrDPhFfdgDfJb+3teuYZR5vC35ytrez 7V3Ttxtab/67pr8T0GML3yCduC6Gz5Eu+JtrlDJOpQE/sF7YY6xNVfWJmB9SZzLWbSEuFHNQNexp smnciGuucI0Hm9Z5Ie/heyr3iPvAtUm1kBOMZ/F3WKPZ0nwasmEaeJfp3NAc99QPngdME1WXwnxQ 01mC3/WCp1RjjBLXqfLasW6HY0hRrVAl7tX0fQq+703nmzE/0piuneY6xLzHe0GHTcBbJc2Ba4tV 3WYt1t0SL0W1VDXtg6JhAr3JNOO6Zaz7VnNV64jqvZivW5vn+qOaUsbJt4KHWpvm1yvSb53N6yu5 plDdb+B85tpjjqNivhPrqlFXcv+tzbHkXIun5tXbvAYQ7ege5LiHM06tdUO0aaAPdX9pfo3wIRqh Jzjn1gTPVc5ts2B3KVtR+YqIcSwDXV8B7/N5w323wqZq6Kxbyt8v5QpvEp+pAn+gtNP5nP4Gc0mB 763ymms6S3LsY2vzGvGG/HCMFZ06E+vA3mb/cgnbiHYy+8AVzHljGlOadfw+8LPKwDdaig+wv8B8 xVj5ten4GMe+OBeYsazKj2osxrPWNs3zb20ej+T4F+IyojxqI3x6ZXNwjKwKfK2sT7kmlPHqjGvP bWPz+HFBtMC6EsSnr22OrYnyu2p/EMd+RtdXYs55fWd0n2ulxue5jukgxky0Bv72TPBeSevHmGBh GkfP36qcAL6bz5kol76xGF/NGI018R+uC9+pAr5Y0/0zwbf4ztbm2Idk0zw91q7kd85F/3kfOpvW ua3FvqwF/Usacy36XNu0DhRrYvLfG//tBU24LoTr6Na0rywXrc0xIingi73pGLbKJzAWD2s8zsHe QZ+7ATsq45A2oP9asrtb4VN19Bxtwp6es8+0IZ+zJbsi8tN68vEa8v8b8nV7sotqGpf9tiRsdny3 CmjRCN+qIZ87PyuEb5poXXju12I+NZ0FLe1lInu+DVpHdgLbL+gzt6Cr+Bzd2TwujOvCeuetzWMx iXiwp+f37LuYvzHG/IzN40MZD5N5ZAPvPAN0y/GL5+CcwFhMxh+ew1l5BLsoYyrOvY8x9n3bpjWc 2Q99aNe4C44fdDbFPeTvsA60JlqpOBjmahHTyjm+LdlaaHfshG+q8haNzWPHFewd2kCM79nYvG4w xxB3pjHTGFPO2IlE/mVDOh31bI4J5D1Hm7YBHduKeRV2jX9Ae3UDepjjzzXJBtpGqD+4ppx9X7bd OVaj8gtl4C8o+3kpzxP5pxwXQx7dCHkuxT2uUYns4MhG5joOjjtyDOu2zWPGSzG/JhiT9ax6jvo4 8+PO4hwD598fkm2Z6GzIDfXiu+Gbd8MYvc1r35hfqgU+UPEGxMZHuUiug30gfNP3Du1l0/ELxAIu 5fQ24n6U5836aEu2ch2Mz2eZqo1A22sb+LnoN7em63pUrWkb7FUp/HlV11ZYnLNkv7Kw01jytOD/ 16bzazfB/kTrx7HP7XRMoQx04U3iSqfiVVH8ogr0Zh2sF+O21QKNFT9tAv38OLWsivZ1IOeRzKUF vXCKplhDXgZnJ58zjD1QtWyqLrq0eZ1EC+f2XbvGT3Lc9f1gY4zfXdocI1zTGZZsjmt5luzuR/A8 25MbOCcw/7i2OcagtDmmg+vMeqLRxqb5G8bEqFwU80oDthDaWmWghxqb47sbW859lfRb2HJ+pbIY vxBhapQNe5P2nqG9D2xExlKgb1iBr8l5PLZtNqbz2C3tGft6jcV1pw3xZC++UTXAnDPGbziPVMPZ yzHsPKcL+La307WrRzpLlL2HvFKR34r0QD+bbc+N6ZoElUNX91JAq4roEOUTMeYS2ZuN8LE4v9uC /mrIJsdcLvMP8mNH+qKzOQ6Bfaza5tgOjpcgn3FOrTWd/1V5tMbmteW94HO+5phLSfoQ6Z/jAxvy c1uiW5QbxjFa03mcC6Ifr6sN9FwUf0J6cwynJR3Vkt/bLrQkxuLWBPRhH7AlWzYF/W1tHvNLYj3Z r2ttXm+1CcaohH7lnHISa6gFXTDHuaWzuiG7OtPwAr49J3nIMYmjzWOwaq+bE3RUzxiHq/hla3P8 VHNinCoYJ8JztKZrrGrqrzYdA26CdSTTseIUrJnxQyrmjJgQxiAgr1XBudeQfo5i2txKIQMpuG4X ZJ/rxk/F1llWmoA+lbBDanGuJBqzX9jLA9GtDWS0pXOWZXIb0K0FOettindsbF6jXAW8hDbnkjy1 4ky76f5H8lyLOeF+cy6I8WaM0dsunCktfdOdsB8a4ZPVQmZyPJ3zJR3JMc9/Q+Nt4ZzugjnhGB3R ReGvlvRaE+xds6DfGHPeCJqj/VUv2I041+3CM9V35Bs0wlaOsHFsX20sxub1pnFQS/NV18qnaMj/ j/JziHusbV5XwDZWfcOWhBwhH1QW4xTZTmjEfqcFWzaygyM/JS3MQeH5GzpbNhbjYFPgx2Xe2Aqf qF2YWxv4Pxj359grY2E4RsV1eBEuSWGnGIOH9EH8fW+6Vosx4ZVd13QjxpJjgBxXVDkctmtKmkNp 81wK045rIVne0LZVc1E1a6pWhOPvhc3ju5X4Bvva2jxWHsUE1zBvzqfUwf5H9SDZJi4F76jYI37f 0ro5ntYJHkF8Asc5a0FLzsV2Yo170DmKH6KcYRXQOgndq2Lhe5vnuQrqf0f7gHNMgn6VzWN8US3m UsweMZiK77luNYqvt8RDjLNdyiuxrVlbnLvAep0ljCTLUg86pxR6iueg8MeqJrkTsroVfF0Ifk2B 3tvaFAtbWFxvrvYI6Y4Yqq1NMVd7u1l+u1o4bxTNtzTHTvBHSes/CN480Fmh6tOwXQqdgs83tOc7 m2JZMad0R/BWritLQi81Ns/R7G2KG0YZb6FPtGvwDG5N5zGj+suoNjLCgqt67PH3gem6cqV/ysfg n1rwSzTPCE99k1xpZTfLcSpbReVtVf4/ibFQBosTcypN13mnBbrXYt1bMc+lWtradM10lM9Ve5YC HRlhJBRGW9lIp/hHjdssPI/qIuqA3kxfhfXCeEgRnLlLuWZV615Tv7vH4OnyBr+R/Ef5acWnN8Er lAvyrJ4xpqsTdpuq1yqFjVDaPA+JmMUqsLcL0qtJnGU4Zq5xWdOaetLL53AO5vERA55z2Vw/hvxW +hmI9Whcd5vtJ8YWlUKXJDoHK3He8FlenmiM16gDnYj4Bm4HsGX3wg48lYdmfbIzjd26H3xfBrqd /bwi8PWUjxudGYzjwry48ifRllE6OxEPVGRbJcHnyp+MMCfFgl/LNLnpPpU3eLcS87rJd80f8Rmu 5dQaFX6uFHxRBrTNdLgKeJHjDLVN4zFJ2AM8V3yfa3CiWiwV/0H/A2u6CuIN1XdJ99b0LImxC6Fb S0H/PtBPSeg+xiMXC2dYEmtTeOFT8oi4AcyxJyGbj9OqE7wayc7jjoNzZ13Q2Lw2rhW2ZSf4dtQ3 FwHPnlpHB/Yu+1FjH7eEvuJr7HNtc3xzF/iZXHeqMA6YC2zE2VCL9xiLx9juZPP4divmkkzjTdm3 acXZXpAdkmyeA0TsNvoZjbB/m+DcqYL9aAMfCuVuCSOseKiyeQ1QTTZTdcJ/bRbs+kqsS+GBa5tj h5W+W9u8NhR5nGvUGXOP2Locz9jDmAfTtcCo0ythzxWm8bm1TWsXOcYa1ckojHZpura7FN+d8nGi /AO3UQeN9Q9j3dQdu46H7W1ay3hh19jYbIPv7RobtYaz6MKm9TqlXWNdMs0vaR+uYK9yTQ3ywAHO 27yeA523yh5XdZcd2OA5roZ2wB2b1kchVngNe8s8hXXlWGebacN16wXol1yDybUIW6JtEfRVwd5c kU4v6Lxfw/UdoPvTwMM7OGMQl8MxgsKmONIaZAT1f6bbhU3jwS3sxYZ0x8GmuCO2odHW39q8JlrF ZTlnVwrbn32ChvTX2uYxxgLeWwuZTLTvUV14GejG6H4h9leNGdmhldDJxYItXAX3+W/G3qLuaoVd Uwe+n8Igq5qwKD7FuSHGZpUkc2wzqNgu4iQZt1kJ+7wwnc9XdUhIZzyfGQtc0txV/Usd2D8cQ8d+ qoCupcUxAs6RLfmcrcXxTq7Va2m+hbCp1sS7yDt703HdMyFDpcV5gDXRJpFtwDF8jodxjWplui6i DviP+bkXPnItfMNa8EJhcS3PgexI9otRX2xsHidW/n+kowrSg6U4y/Gbs0BGuwX5xbNxbTeL42Gu bh08OxUzeNy2foxnjzNmROMq4P+S3uN4Jfso1Q3XUC2sowzkp1iQzxL4oSD7bi18CX6GuqMB3qhs HncpTGMYVS6+Ev4Jnzv4fWFxLTb7fZjrT6bzIAV9s7c4Ro11Di35g2vQk0q34v719LwDmkW+Ij7v F/RnAt7hOFZluo5T5bqS8K+i2tWlmFgpfPsov4BzVdgTdY7wGVwENlaUU03iLI94RGEmlvROEegW 9unXJO/Kj470TxX0rfRZQbKu5rl2Hl4v+EuF6dgD2gkF6ZIz07GKNbUk9A/qobPAJ2D9h/HitZgL fvcCyPPowz10v7IiG6Ale7UmO7Ui/w6foSyN4961axzJBtbeks96adfxvux3dXSuME4TMbmoNy7h 3n3SszvwDQs4v3am61iviG962BvG3q7JdtoEspfgfFG4AsSo74jWFeiYndCZNcnImtaZ53cL5K21 ec0wxs+U/cXn9l2gxQHe3Qg53YkztBC6l+OgjMFGP2/87ij8La6p6IROa0zHOzvhT3UW55dr2lOF reYxGBPF50pjOsbLuHvGJ0ZnENb2cky5No13YZxksnkenTHjCmen7I3yxFka5d7V+7XYU8SW1cTz eJ6ubY6pYLsNfc5WyEMUe13ChJ7CX3Fbwkxx3KkKbJCIfuoMLk/4cdF9hdUrb9j3H+Xd+o/oX0WY OmVXFTbP80W2yKm1Nzf09dJj0kHRpbA4BoFrPluwxZf8sfIGfZekM7tgjXxf5cIT+Z+d3RxbFsUi ovmeon0hxk4LNDol+0yntc1xe+wTMp5GrUlh/JLFWEqV749wfBEtOK5zCOSlCnhfYUiKBT8gkb+k sHtL8SCOs0ZyubY5TgP3qgroUYo9iPCtSchgcYKvozOhCfi/CM6scmGO2F8KvksnzpjId6wWdJXy /1Q8UMUnT+HyykCf3zR2l4Rf/zh9VOK7auEcWqL1Uh5+yUcvA12r5Dud2MM/ztle/Amc6/+HfW8P kuQo76zs7qrKzHpXd/VrZnpmd3Zn9j2jfd6isWZWSAKBjTYQYCEzWIAkECBptRJCAkWIM0/r4g7d hTAQhE/cGRD4D1iEFq0lHvKF4BxYdxC+RWfM6pY4i5cdexAXirAjLjZ0mVmZWVk11b2LcTjuwt/W /qazMrOyMr/88ntlVvVcAa5Ze5PGjieskXH9HXdmC/+atg2dMMd1Oq9uT22SrXQhe9WrkenVmJ83 wZbCF/GeujPzk+wzOoG/x8kXegHenzT2X+Wc+aTvBCadiRs3xjrdPum7BR/Vn7vxauzzSd801n1L VKcXfFT/Hcoke+zX3ROp84fq9rzr7B98AX5xx9CLjpEb9CJ8qAt9J6TiE3Xf/Sn6zlWQ1eSZ2GT8 Kmw28jdX6pl1x7VxofddqM44kAuUz44ZWxWji8DsmPToH/C8iUX5u8nIm5f5nNYzNc+a94p+83Is 08aYZmQbvP7QeKY65jmj3Tmj/SmJWdm+WX+m8h7Vf0/eT8v7rnw3j6325e+0xLByPzDeOSPL+/J3 KPNGMi8znhlU+jpdqdOT9z1UnEnrGe2r+47xjp5R1jcwrPStWtaVz3aNOrOyb32jv11j7H3jfZnM V22osoHRZ5MuA6M8M+p3jefrfodGna7RXt+YKzOvZ/S9Z5T15NgGxtjNOiovq7y/Z/SzNybPpElX yrSuvK+LI5pnNk2fg9akq2dNqrHYcfrOjP/XnYVV5wqr+xoR2ni+TJ0n8VFx5lGNoYOK80Cxce+j 4qy7+sZLtau+hVLnDBXdIoNu6hyl+e228rEzgyaxbFPNpzqfwdtxjPbVGcoIFWc9Mvm8mj/faKtv jFPRTn3Ppfqm2urJdF+2p/ZUegZPqb2eVOapfQL1jo5RL0VFLEGdHVR7S5lB47axLtS5xeq5MRVX DlD9nmv1fKNXobuKPwUVm9tD479/MmHa42asw9wj9yf453W2muIHNY4YbTzHRy9gV/mo/jxaYLRZ d5YrvgifwuxvVLGD6nxXPMbGrDuXZZ7zq35zTiq+0bhvU/wamo+zuWNU/y0cNuil7LvU4Lu6b5rq 5jZFxdlXdS5jhDbGi0I0+ex9VOn/wFjT5p5GNVZY/ZbBM/qk9tv6Y/gwRPXfw9bFEL0xfNitmXu1 7up4y9w7N/lG2fW9irx3UPksmhkzcGvar/tWQfGxubbM/Xd17rs6TrVWRmjjdyV0jF9XdzZynF9s zl+C6r/DMNdcryav7lxm9Wxh3bmaun3DSecoJ9076OL3IFxUf855nC/mo/pzQCqdovKZzAv1fVz5 pL2catv/EJ/Y1MOdMTrhYvYAL9SHujYn+ej+P4K//w/dE5y011Y99/2rvGepRj6SCbpuEo0vtJc7 aY/3Qjp80rdApsyv7v9P2kO70N579XyIskPsCpTtact6Ks8x6qTGvfqlRj13TNqRc+5UEBn6wUbF mR230q+6dtVYqme1iFG3WXm2JWHX9M+pvMOdMC63Qhuncj+p3DHGVz2H5hhy3J3wvgv1rQpq2O+q Hp7wnNnX9hjakAq/mGVRTbvOmD7bY+bWq+Gb6nvaY8bgVPR9gMrfDZlnfar+QN13qOb3IWllzWVo Y8y9el627jvsSXrWQ8U5QNO+qpMz1XMQZt9MulTPKJrnMc02qvus5llHB9V/o+cYtK7Oc93ZdncM f5u/ieG3hqj8PSk1fMTQ8CuqiGp8QvMsn+nvKxs6Mvz/qNJWaJRHqHyOKTJkt8pLjL6afmsgy2JU PgcXGeOp3gdG/wKjzczwZSbFZFU8k8fMtho+zxAV8RLVR/Ue1cegxoat2o29X0Ff1+0B1enfFG3c aw8qPFV3RrdOx+OKj1j3fYbpK1S/S6meU6aVNabayyp876Dx36KQCf0Ytzdc9adMOeTUrOeq31P3 DSOt9LXumyBzrHXfteAx/e2h8jcKk74TMe3DOnmE0cZ4SVW24TH3Hpp8Pn0cbep4nlzkfFV5g1T4 5kLzPGnN4IsY96Tz/8TQ1Rht/F6o6k/jCh3SCTygxpyg8efkvQlzMukMwqQ6Lqo/J1T9lqiqg70x voPZRogmn4up20+u+r2uoROq8bQLnTmh6OLPSVb9ZFrDP+P27fEE35iOWT8Xc241mKALqn5L9fsH MsbuGXceOTL8gwUjj1bqmDwwg4o4ToLq9+tNXV61ERODX6rxGtMu7BjjVHaCY/BHB5XPbmO08Xx7 VrGHzHPU6uy0itNx+3qAin0CM27I01OoHPf2KnYMNfpmxm9DVI49mefw1Xir33tWvxHpoo1nWwdo Y4zKjBlHxrtNe5Aafkd1LZp0NGOqdd/hRsY70xrZ26mR62rOswqf1J3FMGOFbVTe7wgqvKf8n75h mxHDhqmzsVJjnEllrhNU/obPM+a2Lv6SoY3nV8zYZXWfhhr9divrzqShOZ+BwWuJMc5U0idE5e/y fFTsG5l+VWiMXa2nNtq4z0CNMnPvrYfK3ymY+0mOrEOMZ2iFfoExlqDCS+b67xu0MPduTB0ZVfRV VJGjUWVOejX98lE5nmDyW/UbcnMfLqz4mib/+8aaDo2+dyq6JKvxeykq9jeq55ScmjkmFblalb1R pW3f8GGqfoQp8/0x+pn3YZukhdrnTA2/sF2RWebeGp2wFqp74FVflRg+lkJc48tOOj9IKrKteuaw uh/v18jHuhhGWJGX485MRTW6Hxv2H6mZK8WvCSrHWUx6mTH06jiCGjvDq8hT04epxsNMGyau0VNe Zfz8ndPSnqjz2VWfVRy1V+H1oIYHqvogqMxjUNGZZhvbpa5MUbHfHsl0bMjT1JCnSh+0jXyTXr4h f015HKCN+7mR8Ywpy6t7lXU8bK5hv2I3VG3oOhu5DuaeaIo2nt0btz+Ea2zM6p4/rpHjdXt+pEaG kRp7Q8V9urKv2MijqPwNsG/oPGzYcnV7/YGhO0JUPm9C0MazOL7BE8oWVP3oo+L8mbkfuZdhiyxv y99dhszn/D9E5X0mjIpzacTQMfOy/cgYoypT3/9OoeJMirKpRjW2jMnD5v6vX9HT5vrfLNczH88i Kn+7bMagFY90K2ve9AO6xvzEsr98bofW+/LvnuW1mWHOGolrk7jbZMUMPWuvtcvKrHnLtyIrsKZY zsjC7HeT9Zj1OevT1hPsOmF92OpYXevt7P5z7O4x6xsi/8PWe6ybRX7PuPry4k9k7Bqx1vrWu62Q XayHrEbXesG613oHu7vZeqf1Ies260br9darrDdZ91u/Y91i3Wodt15nvcE6xvBa6x7rDpZ6M/v7 JtbLwKJWwlqKrRn2BmK1Wb95bpulPZby2W/I7mOGgOV4IoewNBHPYlYfi3x+x0tDcUdZORYteTKf WC67w6K2K54k4uI5VORSkXZZipf5IscVNVyR44lLpXmLVNej8o2ugKtbzy9ewzdKsKhNdI56Dut3 OboNrOvxX8doB1u2rFU8jeV93vOcKpmomY/Ut6blSHP6qVGlOh2IK5TUDsQIQ0ZlT1CvLWgaSgpk 8o2RuPNE+21JR/7eWOTl1PEEvVz5ZlfQzxHvIPLdOY3yGScGTYnI57SI5Vxh0RfeZoeleN8jmRuJ 3lPGlS4ry1hv2qy8y/6GAkS2vJldPltDWLYcaErkHMB7xUcVibdgxvFEzlnOW7wXieQUzNrvCt7l 7+PplL27zVrPRDoTdxx8rQSix5w2vugRr9ETa4uPIxb0S8T7U1ajI/Ij9tcTq4/PwAz79cVdqkv5 lbB0wsr5byxW5pxYDQNRL5F9yGtkohe8nzF7N3+iLcoDVjsRNOuI2m3ZFn8PEX9TkZeIt0aiV3mP 8+f74im+fjnt8txM1O/It/B0j5XFglI5tRLZbiJ6yvuaiHZ4CRU9SUXrVNLWYzKoehWSIZ8nX8wV kX89KTF8Obeenk+iuRPLVP5XcSbvjatrJFLO5NySSP4kgncVf1PxLixoH2q5EMi3OWJ9Kk7y5Eqi rGYiZjy/I+JZIiRgJHiFr0JfcmQor0j209cXFT3x5OipWMf5CF25oqio5+kUFaPwpSwjuhYVPB7o ZzxR7ooaoRgX1Subjrl8468nZ0aVqFRc81zR16iUX8xZTllP3hczSaTEIXJtFmVE6Bki5wNrKU+l 3OGz6Qs5qebTl+27kpJESC1P0MBhl8k/vtQERPaTSF4MxTqhQqZxzdYXYyKli1bu6q6wch8YFOIy IxayNhUrb1pIwZRZBSmzHFJxDeRvKupGcsVFgp+59k1EC4lO87JQtO0JqTsU8pOvek4DXjdkubGY qVBQzhH5mXiaiBpYtxEIOsfi8gWX5+/KyyPBA5F4UyCejkQ/IsF/gaDXSJS6QvvEkpaR6I8nuNET KyMUnB9IDb1LvLcvJAgW0iQffyTkCe/RlOh5LOVZIkfOaeOIurGQ6olY96koL65YIhF1Eyl1sWjR F7bMr3b5WkJc/FVYGZnU076gHJH8EUpp0pdSScm1UKxGJTmolHW+mFGe15W0dMWqoZLmsaA6Fe17 0rbytMTytTRQVgSVJVTMAxE8QplO8qTlRmUNT0rC4lIWEpXWTD7WXJI52i6iUroGpdUTSi0fypWW r8d8zbkb1ltYomeobSZlEahn2rJXREtxR9sNsSgLpIxXcscVOVTbLlRodFfLVK4fbEl1X9tuWM9U 3oZjSL78byBTqWjfEe9w5OVKucTtw1BwsKc1XiJ5Pu8hNsbjS6pTnSrmwdNlnpRynpzLqtwyNakv yz0pSUNtn3u6TiEpPUNPeJI2vqFZiJbzvm6hKCMV/UO07qIGV6oST0p2ZUGaeopseD73IXxjbFW5 XFABS27FOlXoIpNSbdkOFuPG2s9JJH34E23jaWVN521SSVEsrK+cO33Np1Tb9jn/+fItnrQbch7P bQnOSR2h+5V2CfR6Uf1dFLqrrXVhyiRJKm203JoMRZ4rLFMu9XIO6UgZk1utuWWcCVuKir/58+pv 7gN2hJ3cEU8EwmZsl2qaVyL+EiPHF+/qiL9U1ulIeYU1dxaSwxP2rLmivQ3WI9GcXtXTuKTDFb2C DbwRjLWMaGVdB5qrXeP91Jh3X/dcWY1YzGphqSr+IQa3F96KK0cb6Vqe9H48oWmVTexpr6bwzUJt uRItmXJv2tUcWlyepjoWVgIxVoQraYpLs+JKDg+1vI+1b45LVpErn+jIGiYlPbkW1Fh9abv5mo68 JJG2KNbeJZHedS5L8/e7cuX70kat8opvSEZXrmavRHElPX2dW1A9lVRyBR+2Rc9C2ZYj1qRb8lAU H7rSTgilp+GLnlNNI0/64Fhogfyvo1c+kZI41x2esKJyn9kTfyO5akNhI+UWlrK0IpkTi9+8ds45 kbbifDF/kZT4+XO+1Aa+4aUQeedJu1DluboG1naJyglLT/qCQ5QkV7lBKUfNXiBlPtXazpcSs+BV 35B5VEeMzFUUac3haz7zDJ3gy3kJDNum0F1lX6mQFUoqe9rH8gyNVdU2nqGd1DuItsA8uX5CubpC vR5DGdMq7Av1N5QxMiwsV2KUYslxkb7zZPTMtFYCuZYdqZOwlEpU82Ek28FaquCKveMZd/w5R69U Kt7oC7+fSsvO0zEcz1ghvtSZKiroaSs0RyTp42m7t7BuQr2WfS1jfL1ulZcealtI0d43oOYFV+yC sqR3tWdbROrMFDVyHEkPIte0t8G+oTKOWdgqOddGOgLqCZ+JGtpBzZDSg35F35MK7TxtWXjaFyfa AqVG28rKLo+YGL3L5Wyk6RXo8Zl0w1oLUR0FzOOeRPQglbESX8SCXOlb5G1F0vqlRsSQiNgn1/Ut KdVtuUKo1kOKMnlrjtQwVNjXruSuno6dYRHfCoRnHQu/MfcZifYMI+mNJ1KfqLFjHa1V2sS7gF0w Pqril6xb35AW3sQ2XMPKKWqp0WM9X1jWVhR15LO2pMlmEbPsM1rOs9+O8Bjz+J2KPTlS+vKnbXbl npurdaMvVyeRUaq4pFupiJT2RVw0jxL2ZOxvSkZUMxHV6Il0qK3HVEYKi9hvHntNRQupsEDzdrCw XjM2jx1Zloi+5nXz2Ggqn83THRlDiFlt3tOOtIVVfLItnmvL2qmwjDOZ0xbc0BGWayJjsImMGiSC rz0pIRwtq5V9pawQV8+aL/y7RM6HslsKWRKK3pFKNMo1omXU8CxISccQzf/YsJqVZCLaMwkMy5oI DVLY11Vdgg1rLtdIKj4byJUaVSJ4pk1eSCYz6hEYmlJZq15FwptykFSsY2JoXqIjroUkr0ZYJl9V X9jTFvW4aE/RflTaJzL1AxV80pHWmrKnqbR2QhG9izV/5rxGZEQ/k9H0nEMTYXP6kvNioUtjse6o 9nUCHQUwJUYsqdKV9WOxZ8HjIW3R80jKu0hH+PLIdKIjjqnoUyrjjqEuSaQ1GQor2JNxvVSXt8VT VNZNZFQxFfo5FE9QoQ9SwQuR6L+SJqG0Zz3xbCjXWCDpFsuRBSLWlUg57mnfOJBWSaFVM20B53Ew TzzlC02QSy7+/kRaQkTQKJb2SCA86LZc7SrOYurKyIh0E6npNmoEb0M8I9Y7X9SIGGDpz2Gt44nW kaS065kYcaBiLxVXPDoq7UCiS0z7LZbrqtiBVE939I5o/jcs1XJL71B+INX2X1tqGiJ6me95DqWn mN+5grNceVGdcnW5a5T70jYPtJ0eyJxQRxeV/xOIJxfEfOUcuiCkP+eOHdY2uZIiEVsOhXz3mU6g G/ZPfMO2r+6XFD4Ap3lPvp9qf8YzdjOotNBdaVcToW290htJad+mkC60ZINFhl/rGnYX1XI+t4Jm DAlcUNe0zwoJWlh5XmkPg1R2c5S9HtdYi6Sy20EMa6VsUZMSFePK28p7KIr6o1IsDVe4G5fKSIm3 I/FkJqVWpiPe+ezF2rJX7RAZe1BpV+pdqmOB5syQim5U+Z7cX7alp62kfSRkayJljS9KQyE58z3C UNpOvtyLiOR+eO635xozEnyce0SJkLGBqK92zn1RHgoJ64s5yteL6oMv4hee3JlM5Cry5D4PFi0n sn4g9yLyyGIi+5zfJ3JnIde6iXi6LcaSSKnsS42Ty/aufC6Q7arIJU915X69ilXkejEffSzu8r2u WO7chEInqF2orhhZvn+UilJfUzuSqUT00heWZiJaTAT98l2sQOqOUGqxRPeiraMs+X64J0eeivHm bVCRMvdUfSERaMnuwVIW5tydinlU+ydtPSNUxGB9Obu0tDOczyzRPBxWov3mlehaZZuK6t1zImx+ r2ZvMo9x10XLI107X/uJ/u2UZFlHruuq9ad2Pv2SL0QqEiQwZIJfs0vx612h3vehtbLXL/m/RNOa VPqa+5ldCar331VkwpHz7U+wMuuvjnjWk/plYww62LDXXvZEi/fEYm7USYrcBmhX/ApaiYz/6hQ1 9/BxKe4ZVGxqUqJGscvuGbSjJU8lt5mLndB8ZaTiqcSYDaWVwg1es1fiPrphHqjRv4Fh83t6BL6e SyrPMBF5ugfrKGS+CooTaIUWcOWOp6rrGqfMXOlPuzq+4Bqnw0jJvsKVPud7NrlWcg1LhehIAClx jKfXEzXsJSJ7T3Tcj+j4U7ELZu4OlqOYao6LecBaW47zsJTGdMauCCx3Sj1tF1d9STMKQzbQZ9LK L3b7incF2q/FlXN8VMc8XL23U7zVM04uUkP3E51ftia9C5y32WgFEb1XT+XeWyrscs+IjQeiZ4H0 2gby2bbmisLKJnLvxJM7NJ62qwpt4WsbpJzy9RkjFUNX68S7iLMRRPNesZuu4vkbbTpixEHK68C8 M61BX84dkWszNfbsTZ/JL+2C5as629BTWsor9IWnfSiq+aRozdNRGn6ebSiugcCA3U/Li6cHsiSv pU7oDkU8rC9yBiLdlb8cMyx3Sp8gnmV5syyPX6rNQc2puvKV9yB/77RosS/fMRD96Yk46UD87YjT gIX/0dYnEahx5jM29vdUXDOQflceFwilbUml15+nInHWyBP1YnlCsS1iHpH4JfL0Yixizm1pb7Wl heyzvgYyluEZ0X9v4trauNZMTvDG6Da6wf+jFU/EKZ0Bdg2vuXzlekFpg0isQV+WOEZE3jw1Q7S3 THT9fCcnP+/W0SuriNN52qdx5B6MI1pItIwLLXUqjupIINV7JVi+Ld83sLUXGWjZZ552LnQXqYy2 8KGw3pUtPHwsT2Wa56NNP2qjfFdpd0NEktTQmhjxT1xqwR3TT/XUUJ63KmKAEaOCOp1TvlS+Le8V rT1dap7sKWraG1pSO9hO5Zm8dl7fM0qKN+Y8k7+73Kv6q1xCdOuuWFGePpmldoBjrR0ifQJX7b4U O61e6YyGr70BT1uGXMbE0lOM5RlbU5YXZ+Q9uTPuGj410fEEtddR1tXFrlvxa9pbjiGzsT6jr7iX aP+faP50SpLA0XzlGDtBeZ5t2GyOweHY4G63ZAuqaIwr87AsURRIZNqRuzbm3mKxIhyxOvOTAqn8 SsDVJ52xOO2Jdf95P026FNZO/jbHWNehIdVcOUZipF3Z45b8jsGktC3KW6LFlkEJV8dk8ghI0Tau xBSJ3t8vbDW8wS9QJW7JuibGfknBL9UoY76mbGNt2aVxFKvZkaOlul9uSaKouHJ+ZqKwgT09iqTS B6zp6hqjc7VsIsZ+XmHXWkeGKEGxtdfahmIUWtvYbyR/fRRYV7HfQN6HiO+9ifyvXLXtKDqFXvzg v7ZmTux95auvO/G+mdefQs6Vb2N/5q84hVo81eIpW6SuvIGl+G1D3zb4bZPfNvhtk99autTit4jf WvwWzV+Bdub/LPNfg1GoYd1pfVnERt66tv+z9hfck+ikfcr9FvqW/R33Ox652ru6fXXvNe0PNT7U +gj+DML70X77UvdS70p0pX2161pHfNS3UoQsh/36iPEk4nuATRSeXI6ORo1oaf3cc+es1fOr5y9Z Ruvr64c2O1mnu2/vwQP7F9zNCwf2H9y3t5t1nLWw3Q6jJI67o5led2bmCzu3LOzYsbBl5yN7diwu 79m+fcmyELOQWtbN1qPMRvqNx+e7e7tXdptJ3gVWiji7sLSLWiyFUPA4Tpf9Y37DX1p/+unzT7Ne rKyeFv04xPpwKcrmD7CO/Abav7AT8dShqymhVxNKbDslftR69BMYOw7G97Zs9pe/P2DvP8Yots36 2Nq2nyVoZ7yl/Y7GfY0HGn/Y+Pf2J+MvNj6XfDl5vPOnyV8kP0qi/sLm1G8+kZNobdPsfDQ1O7U0 tTp1zdTvTt0+df/UR6cenvrS1Den/Ben0NT0ZjaBJ/sL2fycdQqFj2bz5BSK12g0Fc3H88vzzfml 9WdOn4/PnDudpIcPs+Gs33H4zOq5Z/gdH5W1fmj/wrwgMKPovEFdN0QuH+A+d/7AZejQZWg9jv3E tW3HHSX9nufPzDYvJX7DcdbtXjuJP5i2A+rglm27OOv2U7/vTc87YbgzINPtZMQoETHe4ZQ4aP2b tYX3o/d3fn/mY8t/PPPY8rPd/3bgrzt/s4vuae3ZPbf0zvY7R3c27hu5+wenUH+NzPVRv7+nuW32 m4wqe9icMYeApZrIPrm/37ec6ScZA11iZWz8lrP1SRRZOxlfxSdjZ9lpOIybTp/jBDjPxrzESHCO jf8MT6+fUyQoj1wz2/yB/KeWPCN0bHqQDnHLsVsRSdP2sNOOYjduteyWO0w6/SjuxnvbM53AIaRp u02HkSXtuu0kzFyMW02b8UnUHoRRZuMhX1v8fMS7GX24zW4dMrlt/sChfdm+bH7R3XfgDdgll3vY fenVdGoqOfySnuuwf+4m+647nRuuv760RndZf7R26Q/a6AvbT6HHGn/S/ZPtf4b+U+Pb3ne2k0fQ I43PBl/oPrLNPhYcSz4YfBz9QWAfbBzcdmXj2sZbGvYOK2W8NDzp+2l/tHiEMIr3Ge2bgjNtaxOK 1gLOk5wXvztlTzmn2Or5UnSWLeAdnBcfn8uWs6NZM1taP//0mfUfn1k/z9d0Tvpzkv3YP05+Re/N zqG9VULnaTkNl6HZLIrixPfas/1sps0WwEyY2I5tIwcnfSd7+WhTd9TpBr25zmhm++KeS2JGHNtu tBote3Z/EFhWk9GlYd0h6DNvLVk/WTv2+Nyfzf/3xk8brU/hTwafTD42+NjM5/HnZh6Z++oM+TD5 EH0geCD5wOADMx/c9SkX37Xtzl2NW/Gbd93VuK/1Hvrezrs237eAt06v4ks3v7J7bWMd39Rw/wqf 3tX4zO5T5LHd/4X8gDy7++fkJ7txRnZvakVTi99gNJyStIyQvTa16dO7T+x+avf3dv9ot73b3/Fd cpb8gjRJ5vS3PIl8a8REpf+on+7gN4w3kP/4UrqcHk2bKefu84q7D6+zP+uHBZmTtHd4nZH4DkHi 9YLIiyHqKaoe2oNMhl5UvN67DA2yuJ30+35w3XQvGyVxGA172ZCRPo7jpB33Mt/fHXc6UdCnuO+3 h8Mk6RM3C9gziZ9h2n9FmHU8L8NOynnbYXQ/bj3Oer/V+sja7qvRK7Zcj67fctPobXMfGn1k7uOt h+zPtr7aOo3+GoX3evdONTa1DrSOtY7hVr/NhWEHWV9h1ujmIx4aMLo1rWmWSRgfhkxyz6Jgjc46 6HYHOaE1eIJRqYOyr5wIUbi0/vz5lfjM+h2M+ThZGJFWz53Ol/06E2qaxxaZmNNCPTM40p23uzTL pjo0cQhb3A6xqR1FaRSEfuqse8HM9PSM6/h/2Go5rda/8+LBoD8IUy3v7rY2Wb+3tvmBzifSP07P 4mfpL/Dz1L3Sfa17W+f+zrfcZ/s/dX/Sx7MOH+YANR//XoTeF6HIf4KNtM24Y/Rd66z1C0a/P2/+ sPm3zWZzejZGZ2O0HJ+NGzFbo8FXoy6Ku6i7tH7HOTbU46efWn9unQu69TvYHyXmDx46KKeXD7EX osoqex1CiPpRlmZhm8mwbrs/Peonbdtu2a9vNpotb6bfnUr9RpSNpgebUsKWFZ/ZWKymu9kMD60P rs39S/w4/jZ+Fj+P7UvI5eRa8hZyJ3kk/mnrx1088JHDJTqdc5fdhusmPaHoeqj52HKAAvp1NuKE zylj8WAtmB2is0O0PERDxp18mHEHsf+dpfXj+ZweP/e0GOXquZiLc66mj/OhinHOoJqB3oCSMGpn SZC27GaW9mZmsvb05d1eP3OmepHX8MTYhnNs9rj1ew/j2GXrP6z5c93l7lr3aPfnW+3FU2jwaGJ1 vs6YMLYo67+HrMeWZqeb6El2M2J9bz2+NFodXTNqjr6GMmueseMMytb6s30U9Vf71/TP9lvX9G/v 399/uN/q28tPIh4z2cGWuE2ZmZet+bGN1mz0oH3CbthsUo+/sBKfX3k+fo4lnz//ApvalfO9FcbH q+nhc5cssxFXjJJ9meBsTgLTZOHcnFsxmM0qY2WvhVsN0vaimE3yDpbnEdwmLM1Z+aOCoV/rkSQ9 wpIsvZp41L+Spfm8TzH63MSkaNfabN32JBvhPJtItNZhJHmQfpqeoE/R79Ef0V9Sl7aOcDLZqMEP gLBUwtbsHErX0geHnx6eGD41/N7wR8NfDt1h7J1C/hrptpLl7rFugzH0GTbyZ04L1cEHzBiazfIh Y6DFCA+YuuNwy84oid2G3cpekdktbGM2ZoxvYqNutm7Jx/Owa4tsl9tpWMz3vWy+/2gt5Lrriu7R 7Afbf77VMWecDyRiM974p5jxF6oz/vS5X2vGG03s2oTNeEoTNeOUkjaWM/66ZtNpNHuUpulaTqGX +oHvqRnndsVdbKVz2//etX3v7dzZbdzduhvfS+8M3xvbP0Z/4z0f/M/kf7XP9Zx3NN7RuhHfSL+P /so7HfxF8j/az/VoJqwIwsgY5fYb44ZgLVyzvmc1lq2jTFg2LZ8v9GscNMdkOSPE+eeE6GaSm496 Ha2XjDXXkNN3jbpsOff609dlUdLOorC7Mti0ud/dsqU3HEz1h1NTfAzui2fZGO5hmn/Zum+t/YHt D+x8dvtPtrdu3fb2Xcf6x6Zbu9lkf6UzN9M7krB+BqyfbaZjGtYiS82wHiOrxVIN5LDpC04OMeps meNMG7bCGKM1jB7EJ3AD8zlkDsTKytPxc5J589nj08flcW/fBldCzqHUR2zaFkeoUEN73D2Onesf NoVuQjvDabZymfVnRzTsRMwGdafYnNl3szpiFqdmpkcuU1+tw5QOhv2+5ys+fxfj8+3Wm9e8b8Xf j38cN60BiY4EUrNuZ/zbt7awMfesodBJrbXgu/5Z/xd+03dGPastFulofrA8enDUGOWLdOWZ+MyZ dblMmYORCvvO1LCHTHbcMPZ9tOdTz2b/UMPGPSaEuq/o8PG2sdu2m6+NE6Zw2FibrU56MGfOa/la bvAxMe/RupVx5j7rybUjf4/+bqpBkDvVR9lUa5Wuei/Pruq/fO912ev61+39y91/ufSz3T9b8h9z npx72vnzudPOD+eed/52Dncu6e1pzTheyBc14aRgrsf7tj64tbF1ftsT+fQ/vueSnVavk+zkJPBp PETXDNHDTEMlPKOzxWIq4Zj1PutB64TlCL62lu5Yf/r8ac4O3PjIvbBzK8+sP7W6cu6Zp5iVZq1z 1maG2iHB00JnuXuQtMRGiP3PCcipt3hI8cTiHsT+D3oxiZvNVpOt37YfRC6zwQj2sk4QtJpuq+k0 O2kY4RbtE4J/m8n5RnMTCiJKMGmw8laAo8RuNraiOKbUJY0WM3F8RtFYUPRTTKe/cW300fTh9Evp N9PvpmfTX6TukneZ91ve9d47vft8Zxgxjf5orxt/HQkrjzERZY7ZNQM0cLMnEWZMxOzVL0fB0jPn V84/c0bYJavPrJxfEaOWdqnU0tzTYXerSHg7K5RSv2E3mMqORtiP2KLbtm1LSAO/ETJ/6yonivGi w+efW5f3WO+x9jDbsrdntDp7zezvzv7n3d/f/fxudzizM9zJDPQjHTGtC6ybbW5Qcr5mzw7EqiaI H0Ju5objWm+W2V/RanQN82Za10S3R/dHD0etaBc3LLdyw3IOzTHDUthazLx8gQ1p9fR5JqJX4tMr Ced8JqDZoA5s0FPcnDwgh1oqfImf8LXtOJQpAMbdNnUadieIY5XJBHGwyld2682M+5vNzPPSzorI uDbkM8bcCet+Jtt2oW+svX9u4QHSuMW7x70H303v9u7u37P4EfJh+gnyieHnyeeHT+KT9NQw3rT1 5YOXLVw3uNm1j6Kjjcaiu0C3bl1cOOgepIe2XuVeRV+75RbytsHbtr67H34s+3j34/PNf2HtT/fP XTH3mrkb5+6cO2W9aL04SyNr1jqUviz97fSt6dlZt/8Qm30mR79Ke/2H2OJgyTVKhpjQhYcWEVen X3W3Ljy0DW1jyceY87q4wD0bzIjrnyTDIR70+T3TM2xRfcD3vcPOFcNXO68e3ji8c/ivnN8ffsr5 kvOEc975P8OAOAPnXqc53Eq2OTaadfyu3+j5XuLO4WW8ho/iG/BH8cP4RYyZeMazsyhZRjeg+1ET 0WXvmPegd8Jrecl+skaOkhvISWL7vf6AtbawuM3xYq892rSrYcecx61Ztsgbj1HsNpmZYlurTCGv cLUsXC20dGb9uTPcAVs6c8f6c3yd38EL7lh37fh8fP5pN145J37OH8cMjRUX6yRb/Nx2zX01xg+M TyLEvP15tsI5k/CMWbTvUPnuIGOg9c2MGxp9J207PcQsmy2tVgMxFxw5rebmJk8jZm217LsYld/4 m7/5BhezhHNkhRDxe1WLrwFr+sW/s37HOsRsXusgkzBN5yVM7Ay8ZrQ5bdqR3+Gaf6dFrWeYWOP7 lxaTUPs4snmBxUMCB/Zx9NjfN3r2qu3bM7PuwqLjOasMWxfc7Tuaq+7qCbR9B9pOD9MltGcP2s0S Lz3M+vBvX/x764fWn7JZt7rOnsZlqBsyY+aHrc2z9mg7mp4atlq9hcsumbF7Oy7fyupvZX2+3Xqa 1z/oLFyG9jQOjpDzW4toZrY1NYO2bkFhz86WLtvetweXXF7EMOk/Ir7GiLfCzIqrLKt5M8MXc7T+ aw7n8v8/4B60LDwt8UIB2mF4fiN8JnT971hW8EyO8NOWFf1vpvvYb/KZHO0fAQAAAOD/VXRaAADg nw1urMFDDN8GAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP55wQqtL1rIyv8t MuTpphWwuzzdYun9Mu2w9BGZdq1d1qtYTatFWM7Qeo9MN1ibD8l0k+X/R5lusfTXZNph6WdZGrG0 xVr5pUy71nXoMp7GLZb/e+gPZJrlN/pfmHvp7cfuPX7LW99219z1L7/mVS97/dVzV77zprfcdfz2 2255CyvcM7d3efmSq1/2ysuvOLLz2ltuvfZdt42/ec3xN914061vOv6OudtvHtPcrrnLb7rl7bfc 9lbrautl1iuty60r2Oh3Wtdat1i3sr/vsm6z/q+CGFIZ0oGsHIZEhiI86siRWcmgwODMkM9QwFAJ NDsTaE8GQwlQLIrBg8EfGGruDJFA3QoMrkDbUxmSgXJFQNV5QJXJUJ16QNqIwQAIDRlCgLKJDClA lblgt2YD5fIZ0kg0TwfIcgLKZjJkAXEe0E3UdSUvA1d0uH9wakFyXqlhsLjfGj/dNGE/3Qz2UtPo AP+HCflJDen66ZzTAgJzgn8kX/CfbcBEM5+Bc0NBFGMO0F0M0Lyhz6AJZCTa7oaLsDIwvPJI+hPP b/OVgRuSNbbPcGoA0QedPgX+//f/NlD0DpDLA8wbYAUAAQYAjyKEIwoNCmVuZHN0cmVhbQ1lbmRv YmoNOTMgMCBvYmoNPDwvU3VidHlwZS9UeXBlMC9EZXNjZW5kYW50Rm9udHNbODcgMCBSXS9CYXNl Rm9udC9JR0tCREErU2ltU3VuL1RvVW5pY29kZSA4OCAwIFIvRW5jb2RpbmcvSWRlbnRpdHktSC9U eXBlL0ZvbnQ+Pg1lbmRvYmoNOTQgMCBvYmoNPDwvU3VidHlwZS9JbWFnZS9MZW5ndGggNzIzOTEv RmlsdGVyL0ZsYXRlRGVjb2RlL0JpdHNQZXJDb21wb25lbnQgOC9Db2xvclNwYWNlIDEwOSAwIFIv V2lkdGggOTk4L0hlaWdodCA3MjYvVHlwZS9YT2JqZWN0Pj5zdHJlYW0NCmje7JsNcJxV+ejXP8GG 0nwU6Af8/5AymqYOX2WKtkCUjhbaEbWNo7T3DiOVXKSgQIFwi3ClwLDFv3zUO12s4yhVoi0f0hKK RKA2UCsVCBQoBbdAy2dSRAgSseLHzn1mn5tnTs77se+mm2Rjf7/J7Oy+7znPOe/Zd7O/c/Y5uRwA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACUmGw229nZ2dXVVVa96szDuwMAAACwLyDiVx9L qZpoamqKKiCnpMDAFFTrejQ2NqbT6dDLTNg9UfTm5mY5nsqjMdva2qyAxA8dLonT0dGRvP9uHKkr E4SYwhJZuuH2qmAVAAAAABjpiK+a/g2esUt8Uc2oAnJKCgzM2LWu12e9IrdF7UOUsQcLaxAVdVeS W1patIyYdui46UHX7WOQSYG1Yi1GGbjEdKcPbhXW2wEAAAD+jYlR2dI2MajG7q2ot7a2qs3aynly Y+/q6tK6otNusUwmo8KsS+hq7N5FSV1pMf5iDYnj+bYKvNeud6XSDfegVknSHAAAAACMUBIauyVO Z7NZkVVR4tDUbrHQdB5Xv10llore2VyEsWuoghkmocaec9bJNUJyY1cHDs3hcU+FGnvOEX5NgA9O Q+ygur0MiJ2SKhIwKn0o9CcPbS54PHT0ent7pWl5lONi/lI3vofWROi7FoyW60v7l4N8sgAAAABK RUJjt0TrVB/y0lJEcs6ytiHyqQke1oRbwM7mAsbuhZLnrtZ6RBl7rv+SdXJjdz3fQ6RU1FS7HWXs FsEy592pjSvYrmln8xR8C0LzbaSrrkvHjJ712cvnieqhIG+x965ZW8FoIuoxbwcAAAAADAxT2c4w bLHUtE0EWHxMZVhXknNOgocIrdQSRVRz0+ViN1VeTklhL3XENXbL1tZFXd2YGZMZHqOIrlTbZaYD iJQGixUctyhj1+QZjaCj5OaxaFs601ExlrNu4n1MAryNue6rDU0iih89N/deF/Pje6jP9V2TaJZ1 r4YfjJbr2wiMsQMAAACUENPpUEy9VPxctXPTqsXlVD69sCqu1oS7cK0BdfnXNfZgtrZOB6JStWOM PbQPUQzM2L0pgP0GocYb7LmtaVtD7k7S4Ch5eCve+quHK/nxo2d9jhlb66EttrtTA42gVxeMBgAA AACDgalsYxjmfpabbRV1ATaoyqqjtjybi9h5qgU0ZcWM3bVEl9BUbSXG2G3lPzdoa+xBvGQhN+1E Rs9ryEuYT7KNVDNzdCnbGtVhLDh6rm8X7KFMpiwNxrCDUdEAAAAAoOQUlcfuHlFhM1XWTBgvWT3G 2N2sEjP2+JXw0DyQYrNiokZAi6myDniNPbgh19VaFXL9WcGu1LuomLlJEOmtpcpoNnv86HlvWXwP o6YkNj6h0QAAAACg5JTE2M3uNJ9Z3XXAxh66Ei5YUr1LjLFrjoq6aEl2noohayJKLnbnqUvUVtNc hJzbrlXvuDSn6evBJlSzNXE9fvRCHTuqh1pY380gOYwdAAAAYKgoibEHs9yDOeSe3Jpn5sKyYrzW dQoQ2rEoY9dsEHPv5MauHXOTVbw+F2Xsub6Jg+5I1fQVG9Lg1CBqjd38OXjK0pMKjl6UY4f20E2A MaQJqa59xtgBAAAAhoYSGru7Mqxy6+36NOs2ndbEeHfnqdqja7ZqkkXtPJWGNL4pbnJjV+/1+mDd MMdObuz2c4Pn52raroTHaHlUrySgGzl+9KIcO6qH7u5g923V+KHR5A2V8Qz9NQQAAAAABobpdH0E KtLxxq6iqGkbmr+hsucZu8qemKonn66xa+aJ5WNYnnZbW1to/7Wu12dL0fEuM4mx5/oMVsvrDlyL aX1Obuy5PvUNtq6d13HTMZQy7vZelyS9ih+9mFXx0B7aJEXiuD3UXP3QaDFJSgAAAAAwMHS5O4YY Y9eUaX0pOmfWJ9omtVQpNTtdD6ryaRlNL3fr2hJ9R0eHq6PyJColxup6SHU3Rce9zKgR8Fa2pQ92 RXZR7qxBLz90PTyIGK93yUpvb6/bijQRmj9vSAfckbGsda/nUaPnvWVJeijD6A2CvU2h0fRyMHYA AACA8qSrq0tz0WPKaNZE8mhRC85Dhs444i+qJK0UdaXaq5gqpR09fdcGexAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgKNJ5os5mMhk529vbu8+OQCitra1aq6Oj I3g2m83qWSkWPNvV1aWjKo/yPFhAYsYET0gmT7HBC/YtJuDALtZGUgat2JEc3r4BAAAADBn1eaLO NjY2plKpzs7OfXYEPMTipHDKoampyS3Q0tLinpUBdH3Pqy7PPZmUaDHBk3dSm/aOxwcv2DcPuSv0 9nAv1r1V4gPKsHjVZeiSj2Q8g903AAAAgKEEY09u7B0dHepv6XRaxkRe6vg0Nzdrgba2NtU/eSIF 5Lhrzl1dXWqJmUxGzkoQLWwLvOqo6pYWvFhXVF0PGnt88IJ9Cx03vfbOPMVerA2dnDV/lnFLMpJJ 3tPB6xsAAADAEIOxJzd2FT9XodX9rLoOl6t2KnuagqLO7Fb3Amooy0HyghdEymtAbdTz2/jgBfvm EbqMn/xide7jVvcCxo9kPIPdNwAAAIC9JJvNin7U99HU1ORJTiaTEfeQU/Ko64euE+rqqx5Mp9Ou sWtFOSgx5awtLEsQqyIHvVVZtzPeWY0f1U/3iqSY1JXyWlh77pYRERXdsrPBvHRxP+12sC13BLSt qFwUvRZv/qIqqAeDgu3KYXD648phUBStivZWx9+GPdhVLayD44UqGDy+b0GkM3qHBAPqwfiAOixe dXf04kcyl8/wcfNk3JeD3TcAAACAvUGMRQVSxdUydU1QbQ3WPWsq4iZUuFm+6jaWPODWCgZ0nVbV yD1rBhhaMTRRWaK5+cZW3pzKkhxCG8o5GdHudZnzuzKmbRW1rG3Vta6nuK4KhlqfHdTh9UTRtUct YPGDXZUh1YsK9qRg8Pi+JcRdx44PGPrbjR0sOJK5/hOl4MvB6xv/ZAAAAGAv0a2FmUzGjqgYq5Wp 87hGbdqsL9VqTGUlTtDYLftXoqnhuwG1irto7C4Ca/c0vpekofZoC8guZux2Vo5odV2x17B2VmKq X2nTdtU2bbGJSdDfpG46T8IBd/PYQxelXfmMF8XQpV3XtCW+PLE3N6arQeMtGHzvjd3y5GPqJrTi giOpnRfs/vFeDl7f+CcDAAAAe4lIiye97sJsfBp2TPava+zBNAwvQUUPZrNZC2gr5/JEQolWWbuW qCwH5VTMGrunWDYTCU32dg+G5mO7Bwec8ODtZ/TWwN3O637P0NV7TxRjpDo5QWOPD16wbwXx5m4F A4YuiZsVx49ksW9TafvGPxkAAAAoCboYq5m9boqIm7dseFkZoWbrGrtrfRbcxV2od1NoLGdD0YVx PSXPM5mMlwBvhKqaLeZHiZx5V6hrudOTgRm7/TxhkUOnPNa9qG2k3sxikIw9PnjBvum9ZLg/4uSc 3yzs/S0YMN6K40eyqKEoed/49wIAAAB7ie4kNRNWPGMPqkhMHrUejDf2+jC0mNiR7tZ0E9GtA7qT 1D3lLdcr8VnNUSJnFxt61QWTVeKx1XX3R4HBzmNPTsnz2N23yYtjuxvs5xKvbujBvc9jT8Jg9I1/ MgAAALCXqFmJT4pa6JK1m2AQmsTiGaOXVFNwjd2SyePRVAftgCddIr2ZTEaX3EPNOdTfrLcJ19i9 XxbcfPuijN0CutlBSujirfvLhXYpSvJ1NdgLG9r5JJ30xqRg8Pi+pftj/dF3TedNoeMfFVDvK2+t 3kav4EgmYZD6BgAAALA3xOR7q4qoprpO7qqRCEywejCP3TV2lSJv5VYX7SWaLqG75mM9FOXTZJhg W8FUdqvl7isMbmJ1Jw622zQXsafV7XlyGdPhitoha5fgCrY7Swqmprh9C2qqXG/yOVFwxFxjLxg8 vm+hhM6/vBsvKmBwBtHW1uZtDo0ZyYIMat8AAAAABowpt3mOOrbJhgmnWrS8VLExkdOXJmkqNjHG rmLsLki6EwTb8Wf90bPiQl5Pcn2ziZg1dquYc7IdvEa1IXnUC9H1WGvLem7VNZqrsjKGUje4fq7Y DwHpADqbsF80NLK7kp9z5hHWT0/INb43/vZSokkoexnT1dDfHeKDF+ybh71fMsihK/AFA4beiibk 8SOZ60utt/md+3Kw++a9EQAAAABFYY5tGeyuQuecRHcr4Plq8GyMsef6Fie9KpaHEOyPeZFtCXRP efnGiq2xR7WS67+PVZ+4QhV61daWOwKhv1MYXjq3i3XGJkGh/XSHy9sRmXMmF94GBMVNcIrvaqix xwcv2DcPvcxQ7A6JDyjj7/XHc+D4kfT2h7ovB7tv3hsBAAAAUCwiHrreKE6iS4juInCubzeoLhJK gUwmE9xtqou3EkoKWF19HsypliPSVmMeKeCtykoQbU7wcoPdivIkajnX/FPK26UFC1tDel3eWSmv 1xXsho6PPpcrdV+62KlQ3Iwd9y0I9lP6FtPPXN8SbuhwSUN2sGBXverxwRP2zRu0UNyK8QFlcPQG 0Jst/mb2RtIbdu+XjkHtm/6Ig7EDAAAAGFF7SwGGC025YRwAAAAAFIwdygr9naLY7cAAAAAA/8Zg 7AAAAAAAZY5IezabZRwAAAAAAAAAAAAAAAAAAAAAAAAAAABg36EzllI1EZOqLacG3JDWLarbvb29 pI4DAAAAwEhB3DUVTX19famaaGxsjCogp6TAwKRd64b2vKmpqaurK1hFjpfq0gAAAAAABhsz9sYw RG5L1cSgGrvot9dzORLaqDi8nhJaW1u5AQAAAACgzFGdHtQF5yEw9nQ6HWxUzdzTcikpB3WZPaZL AAAAAABlQkJjT+eRJ5lMRkS3ubk5uEDd0dHR0tKiS9xS2DJSzNilgFT0zubCjN1CyaM8j+lYlLFH nVKNN58nmx0AAAAAypyExq5+a/kkipszIypuCeRWuK2tzW0i9GwuYOxuKH0iR6I6FmPsWl2mGHZE 5N+W1mUuEB8ZAAAAAKAcMJ1Oh2Hr26bZra2tUkUebbFazspLNWFdsu7q6lLrVjd2U+V1aV1t2aYJ rrFr1oqc0qblMcbJra4E7HSQWra91F3M116pw2tCO/tPAQAAAKDMMZ0OxTxZ/dxWxXP9F7c1g8XN k3GX7u15MBNG5dk1dm3IzYSJV2utG4q7jG9X4cZRq2f/KQAAAACUM8nX2D3l1sVwb+lbl9/loIq0 a+zeNk/bAZpzjD2bzYZ2pqCxy1nNn7dEGplEeCX1hwBp0ZbitQ/sPwUAAACAciZ5HrtXxjP25uZm N8vdsmhyscauB83Y4xf83a2pRjBnxtLgvQX2mNV49p8CAAAAQNlSEmNXSZYCLS0tmUzG3LvYNXYr 2RlGaMdCs9ytP/ajgKXWeKv3mhjD/lMAAAAAKFtKYuzBLPeOjo5gHrtbXVU5NI/dS7/RwlFSHWrs vb292iWrpXtdg0HcfgIAAAAAlCGm050RaLGijF18O5jH7gqzppSbmbvGrsvjckSsWwvrEV2NDxJq 7IJ0RhvVVPzghlZDT+n+U5lBuNn7AAAAAADDTnzquLf07VZ0jV1XsN3tn8E8dstvt3xyleRcf2O3 5XEtac+jUs2jjD3Xt4wvBeIX0oMZ9aHRAAAAAACGBTHhxlhUlZvyuBUzmYyc1bSWXN576/vQtXR5 VFvWJuSllZGXbgqNljQnF2nXfayKtBuzM1TrWjdcdKlfkHb1MTSCFZMn2i7GDgAAAABQnugKvy3+ AwAAAABAWdHU1MQuVAAAAACAssV22gIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABA +dDW1tbY2FifJ5PJyHN5HFgorS40NTVJWO9sNpttbm7WAqFNWHUpJoWD/ZSwUcEL0tHRIXXl0V7G d8YdnAEPCAAAAADAXtLV1SWinkql1NjT6bQ8l8di43R2drpxUnlEia2AqK9XQEzYjSAv3bPy6Gp5 S0uLF1yOFNVD6YzU1eetra0aJKoz3uAMYEAAAAAAAEqCmLbrqx0dHWKnthCdHPVtU3SJoK5r1q0v RZVzeRPW8mbCOlOQg729vbn8YrvqtEXTl9JbN3hR/ZQqepnm4bpybp0JTgGamppU7DF2AAAAABgA oq/B1BH3rHckmydYLGqFOTkS1hVsRVfF1eF1TVsE2M6ahOtLVWi3e2rRavgSxAQ7GDwJaukq3hrN lXCdAniDYLMGjB0AAAAAkiPSKw4pvmrJIeKZto6tqSmam622qavQIpxW3sTVornHtaQW0IwRNzVF 093Vol16e3ulS54/27J5Lky5LX5XHn0erK4xgz6vEw2rohfiXZer2arfOouxdmPGWdrSkRxwmhAA AAAA7JuoiqsJi0aqCYtbqs2qx7oZ2rk+W1bPN9VXE9atl3pW91e6giqurqc0U8VV6CRoSolaurbi LfvbwdB1fvdg0Oe9g16Ojfcy1+fwbkWJrwcFuShP4HVuIqOKsQMAAABAUaiLunKrSqkJJ2bsugwu pu1lgOtBDeJKvgX0BFVtXx4tjtp7QTSOl/QSZeyaMxNl7KEr8Ln+xi7XIuWtb95LLewOUX1/9IhJ u6bc6FwDYwcAAACAonCzuw1zVy9XJNcnn96eSj2oFhpv7CK9JrTJd3qqgbvl443dzZ8xrGPBi/Ku uiAaQQ3cJjX2w4RNYVTpdW5iPyVg7HtPd3d3Rx/t7e1LHeSlnZJijBUAAAD8GxCaXmI+HEwvsaSX 4Kqyu+YcZey5vtyYoPZHYbruTivis2JUkvcmKyYezQXSJXQzdjc/35bxdYbi/pSAsRfFli1bVq5c uXjx4pkzZ1ZWVqYGilSXIBIq4SQRAAAAoHwYmLE3hqHLyAWNXfdsmuHHo6v3tuN1wN3O9Zl/lLFH pcpEDZpbMsr/9cLdXQBuzoybWQSGvNFLly5dsGDB1KlTQ917/PjxJ/UxZ86cxQFOchg1alRoEAku TUhDCDwAAACUP6q+nrd4WTGu+rrbP43e3l6Tz3hjNzHWdr04oX2TR802cXHzcILdzoVZtFslKPyh y/JR6K5b96Wl8XudkeZCf4/A2F16enrWrFkjCh1cRRfrlpngjTfeeM8997w6UHbs2HHHHXdcddVV X/3qV6dNm+Y1UVtbK01LB/bs2cN7AQAAAGWIuqtlWef6r0UHjT10U6er8fHGriXlpal70MbdklEK HRRsXbq3dftgfr6bOa/27l61bolNkqyiI+DOcWw7bfwohQ7Ivkx3d/fKlSvnzZvn+rMY9fnnn79i xYqNGze+OmiI/8tbIG+Z3hWKzBekM6tWrZIZBO8OAAAAlA9qtiqcumdTHUazskPTS2zpW6xVCqiv 2oJ2jLGrVHunQrVWhTw0/cbE2OYa0qIYsreVVbPl5aCcsk6az+t8QTtmO1XdNXkpqSvkwZeqeW5v ZdKh0ULH0ANjF8SKZ8yY4a2lL1u27Mknn3xtyNE8nKOOOsrtj6g7CTMAAABQJph+m6uo5erZUGMX QXXLa5WCWTGhi+oaJ6ivKtihWGSvG263Fd0fGqyomOQHLyHYMfelpvR4HRa786JFOfk+buzi6pMm TbKBmjNnzk033fTcc8+9VgY8+uijMmuQuYO7XxVvBwAAgGHHMrrFTEQjM5mMqLVbQE6FJq7oYrIQ VBq3iqa49+YJhtKDwXRuKdYZgRchqtuKHJRToZ1UxNvlrKf61gHpnvdSAsqIRaXfx3fGG5B97U5z XX38+PFLly7dvn3762XJU089dfHFF9fU1ODtAAAAUA4E92AClJagq7/00kvl6eouMqHA2wEAAKAc wNhh8Ojp6bGNpePGjfvCF77wyCOPvDGieP755y+55BLz9kWLFu3Zs4d3FgAAAIYS3VOJsUPJ2bJl y8SJE8VyRXfPPPPM+kMOOfeAAybX1Fz6zW/u3LnzzSHk6quvvmTv+OY3v3n++edXVlbK5UyZMuWF F17g/QUAAACAEc3SpUt1Ufr4449vPPbY06qrd6VSuVRqTyp11ahRR9TW/uAHPxgaXRe7Pvmoo6Qn C1OppQP9m5dKzT/99EceeeToo4+WUKLuK1eu5F0GAAAAgJFId3f3jBkzVNevuOKKeaeeetyoUd15 Xbc/eTl/zJgTPv7xhx56qGtIuPXWWyePG7dk9Oie/j1J+LcqlVrwhS9InF27dp1zzjl6dfPmzevp 6eEdBwAAAIARRHt7e21trdjs4Ycfvn79erXllStXHlFbe9WoUXv6a/CWVOrY6uqzvvzlp59+egik XWT7yksumTx27A8qKgZs7MovfvELzWyfOHHi1q1bed8BAAAAYEQguq6Z3vPmzctms90Or7zySsu3 vlVXVbUuIMPiz2LRV156qZTpHnyeeeYZmSPITKGjeGP34px00klysTJDQdoBAABGOh0dHel0OpPJ JCksxaRwb29v6Fk5njwUwFBiuj5//vwYW/78ySd/pqZma38f7kmllowefcx//ufq1au7h4QNGzac fNRR88eM6R6oses05LOf/SzSDgAA8G9AY2OjfKfX19d3dXUlLNzZ2Rl6Vo7LWSnDqEJZsWvXLk2G EV3fXYi1a9cec8QR5wZs+YVUanZ19eemTdu8efPuYnjiiSc+P3OmhN1dJN/4xjcmBHJ1Yow9GOHV V19VaZ80aRI57QAAACOUbDarui6P6XS6YHmMHUYce/bsmTJlityZ4q7Jbfl76fTkgw9eVlnpuXF7 KtVQVXXumWfKZ6dgEClzYXNzQ01N3Uc/unr16uStP/vss02zZk2vrt5SzBp7aCiR9hNOOEEuf86c OdwMAAAAI5Hm5mb5KtdH8faC5TF2GHEsWrRIb+8dO3a8VQxS/iLx7aqq9oAh31xRIT5/w7JlMdXl rDr/nlRqwgEHbNu2LUmjr7322v+59NK6qqo1YVq+NdrY/8cXvxgVUz6Y48ePl0FYvnw59wMAAMCI oz5PV1eXqnhHR4dXQI7IKS2WTqeDxt7S0qJnm5qaWltbzdiz2aw8kbmAFpCzcoQBhyFm61aR3FRl ZaXctG8NiM2bN39u2rTZ1dUv9Jfk7lTq3DFjjjniiHXr1nlV7r///hPq6y2vpieVqqmsTNLWT3/6 08njxy8ZPdrLhNmSSk2vrhYnl+YuGj26p0hjF9asWaPj0N3dzV0BAAAwglDBFpfO5beU2nOvgEq4 Zs4oZuyWA29Wb8au6+1Gwjx5gNIyY8YMuf0uvPDCP+4dt99+++SJE4O2LPOBU2pqvjxr1nPPPSfF 5PHLgWwWef7J+vr4+Bs3bmw8+ui51dW7AvOC+VVVUr29vV1LXrd0aV1Nzc0VFUFjj2/i85//vAzF ggULuCsAAABGEOLn8g0uWq4vbb3dCqiBWwG1ejP2dDqtft7b2ysv5VEF3jP25uZmed7W1saAwxCz bt06uQMnTJjwxhtvvF0Krrv66oaxY3/Q35blb00qVVdV9T+/9KXQbJaVqdTX58+PivnSSy99/Stf Oa66uqN/rT2p1NJRo+rGjv3Rj34UrLLoa19rqKrqcIxdWo/v/Pbt2ysrK2VAtm7dyr0BAAAwIhAz V0W3I5rNbvtP3RQXQx1ejV2fu4k0bhU19iS58QCDxLx58+QmvO66694uHeK9UYK9Kv8YTDJfPGpU VB9kClBXUxOcAqzLTwH+94UXxsw1Hn30UVuWT2Lsgqb0L168mHsDAABgRGAr5Ok+vP2nWqClpcWt pWXM2D0h11mAa+zsQoXhwjLY33zzzT+VmocfflhtuTtiK6j7d0pNTVtbmxfhjjvuiEmzOb2x8fnn n0/Sk9tuu23y+PEz9t9fjL1g4aeeekrHpKenhzsEAACg/HHz0j102VyN3ZbcFT0YZex6EGOHcmD5 8uVyB37961//0+Dw8ssvn3DccWdVVhY09ppRo6Swq82zTjhhdk1N6FbWY484Iqj38ciU5DuXXXbj d7+bpPCsWbNkWNatW8cdAgAAUOaIk+tyemd/WlpabP+pynlzc7NbMbjG7ua9s8YO5YOmxLS2tr4z CKSvuSa4/TP0Tzx8QlWV1tq5c+fic85pqKlpDxRbVlk5+ZBDbvrud98ZZPRzTWIMAABA+aPi7WW8 CNlsVk1e3NueuwXcPHZv42ouLI8dY4fhora2VndZltZ477zzztBslqg/kfNZJ5wgFcXGxcnFzPcE CjRUVYnJi8+/M/jce++9MixTp07lDgEAAChzVLzFyYOnxLEtGUaf2zK7er4Ze1tbmyq9ZtHIo4bF 2GHY6ekRoU5NmDDh3dLx2GOPzfrkJ4PZLPF/y1Op884+Wyazlfvt521WlTgSTWJK5HeHEBkZmc5w kwAAAJQz7kp41FldWhelVwnXBBh9YsaecxzePYuxw7Cza9cuuf2OPfbYkiiuRLv4G99oqKpys1lk StDh/F2fSi3t+zvrwANPqanRv7oDDvjxj38sQe666y5bnJe/JaNHy0s5+O6Qo59ZbhIAAIBypq2t LZ1O68J4KOk8vb299lLEu6mpSWRearmncvmldTklBVpaWrq6uuRsJpOR41LGngMMMbpT48QTT+zZ a9avXz/hoIMkmuh37ahRtkG7prLy08ccY38XX3DBkj5uueWWu+++e+GZZ1555ZUPPfSQG+36a69t OOgg+Vu6ZEmwrd27d693uPnmmy3meWefPWv6dJlE7/0VHXbYYdJ/mYZwnwAAAADAcKHGfuqpp+69 377yyium0PI8SZWf/OQndWPHXj5q1NzqapH5TZs26XF5Iu79rW99a+bUqab6dQcfbLOAyooKW5yX v3MPOEAX7afIqf32u3zx4p5SMHbsWIwdAAAAAIYXNfbGxsb3hpaHHnroU5Mnz6+q6u5LnpF+HFdd 3XzGGbt37/7KaactyBt4u5NOsys2DX5rKjW9pkYqZrPZUnVS9+Ri7AAAAAAwjKixT58+/c9DxY4d O8Srxa639FfunlTq8gMPbJg4cdu2bcfW1W1NvGVVnP/cMWOkyoYNG0rb1TFjxmDsAAAAADC8qLF/ 7GMfGwJXf+utt7598cV1VVVrAta9cv/9Gw466OrLL5cyUrKyomJPMl1fVlnZcMghy7/3vcHo8Ec/ +lGMHQAAAACGFzX2MWPGvJ+MF1988f0BsXr16obx45eOGuWp+JZ8Msz/OuMMi9zZ2dlQVVXQ1dtT KSl2ybnnvv766+8PAm+88YbmzGPsAAAAADCMqLH/x3/8x/bt25N47OT/+q9PH3PM5s2bk6uvFJYq c6urdwWyWeZXVX1q8mQvmri9FC5o7DNGj/70tGkDnkEU5Gc/+9lHPvIRjB0AAAAAhhc19kmTJl14 4YW9Cag7+OBVuio+f/5LL70UX1gKSDEp3NFftvekUktHjaobO3bVqlXBWtdcc83lFRVJUmLWpFJ1 VVVXXHLJ22+/3VtqTjnllAMOOABjBwAAAIDhRY395JNPnjhxYhLvFWPf5WSeX/Ptb4fWkoNySgpI sWI1+6uzZwcT3ffkU9ZPqakJlf+GCRPWrFlTQl3fsmVLfX19TU0Nxg4AAAClpaurq7m5ub6PpqYm OeIWED1rbGzUs/JEXnrVpYpVz2QyXnw5EhM8IZ2dnVI9nU4XG7y1tVVOWZ8lgls+m82GNqfFgs2B 3RIipTNnzjzzzDOvu+66vxTCjF3+elKpyw88UG3ZLSMv5aCc6ulv11tTKVFuEfKXX345polj6+q2 9q+4LpVqqK29dNGi9vb2zxx7bDDBRl7KQTn16KOP/qUUzJ07d9myZRg7AAAAlBZRVlFTEQy1cXtu 6qtuJjTm0ecmwL29vVpFz+pzV3TleTC41Cqqk6rrXuSEwXU2oc9lYhIsH5R2u2SMPQoz9o0bNx56 6KE7d+5MbuxBWxZCjbo7lVpUVSUqLspd0JYrKypsd+oLqdTsmpovfuYz27dvD84IvE2sHX3pOvEz goI88MADxx9//G9/+1uMHQAAAEqLCK3YhaisHVGtleP6Ui29tbVVX2YyGfVzt7BVV7U24ZdHfSnH Q8snoa2tTe3aU+iEwXUtPdcnmUk6YxMTjD0KM/bNmzdff/31c+fO/SCWoLG7thyasr6ssrLhkEP+ 7403fpCArVu3Tqmq0gX8xaNHNxx66D333BMs9s4771x7xRV11dXB/BlN15GzHwwIiSy31urVqzF2 AAAAKDmuYCsitGq2ufwKvD13q8hBXZoOVtcpgObGqN67SuwFlJfSnK2KyxN56S56azRdFfcUumBw O6Kd0VA29dCzEtbmJopqfLA5cHGN/Xe/+938+fNvjFXrKGMP/WsXjR87tmXRIrmvEgrz7bffPre6 Wqy7rqbmv9Pp+MI7d+786uzZ02tqtvRv9/+n60TYfjxf+9rXrrzyShkKjB0AAABKjhiy56WusQet OOc4eajPaxXV4KAk5/oLvyfGmuViC/i5vhVyKayn3K4WDG4B3cmFHs/mCY5GW1ubXm+wOXDxjP3h hx+eMWPGgw8++NcIEhp7Tz6b5bRPfWrr1q1/LYZrr71W+nPOggXd3d0Jq0ifpzc0LKiq6u7fhxeK 74PMVmTO8uijj2LsAAAAMDS4uSKh4moH1e1dwc71Cb8eVCG3LBTFPahJ5q6xWxKL4rm325OCwfWl WbptjLUcGzkrim51NSdfe46xx+MZu8jqr371q6OPPvrxxx/fE0axxv7000/vKYbH8uwpnttuu61h 3LhllZV7Auv8U6qqLjj77N27d8dHWL9+/SmnnPLII49g7AAAADA06Aq5JbroOnaUsXs57Ypr7OrG 8VKdkKBCJwkuZXTqYT8cWI5NcBetXqy+xNjjCRr773//+w0bNkybNi1U2ovOijnooMvOO6+gLZcE aUXamlJbuy7Qk+UVFXU1NTcsWxav62LpW7ZswdgBAABgCGhtbVWJtZXn0HRus9lgEkuunIxdrVLT ZrRX7o7anJOynuubqnj5ORh7FKHG/thjj/3mN78Raf/lL3/5t/4UZey68/T6ysqGceNW3Hzz34aE bDb7JZHv2tqtgWX/xaNHHzdp0oMPPuhVkdvjxBNPlBGQC8fYAQAAYAhQXRcNdjPDBzsrJjkDyIoR IbeUGDN2r7ymyoit6ZPOPlpaWqSwPBbbz32EKGN//PHH5ZQcP/fcc997770BG7v+dadSi6qqpjc0 bNq0aWi8XbRc5FwUvad/T0TjReZF6V999VUp9tprr82ePXvhwoVPPPGEXDLGDgAAAEOArjarsrrH 1ZNFXN2DtvM01Njdnafqz5Z2onibQxMSZewxwS0p3U55m2StvAaPAmkPEmPsMlxPPvnkFVdcMXXq 1G3btn2YZ2DGrn9bUqkZNTVnzJkjnvzhkHDj9ddPqq1dXlHhdaN2//1XrFhx3333NTQ0yH0ul4mx AwAAwNCg6iuPmrvuEurkbjpKUINV/lWtg8IvTYSac0GCxh4fXJ8Hs2iChq/bURv742a8Fzu52Bco aOxPPfXUunXrxGxvueUWceBTpk1L7TVfmj37w6HirbfeurC5eUpVVXt+qX9BfqlfLnbJkiUnn3zy hg0b5AIxdgAAABgaLJe7t7c3tIAnum1tba7De1tTzZlV/sV11XstuGab6G5QLSCCZ2flibwMNeSg sccH16V+d3lcz7p57BrTPRLTHLgkMfann35aXp5xxhlz5syRg38fgWzbtm329OkTq6t//vOf3333 3TNmzLjoooueeeaZrVu3YuwAAAAwNKhgq/cG0TKqvvKyJY+Wt62pmgGunix+q8v17rq3zQjkrOXe 2GK+t7M1dCure8pT6Jjg4uHBlXz7NUHK61xDk9gTNgdGQmMXuX322Wd/+MMfTpkyZe7cuSPU28XV p06d+rnPfe6uu+6Sy8HYAQAAYCgRG6+PxoqJuKqWB7em5vKr7mrCJvZeK7oDVAtISXfdW73aNXZ5 GbXo7WW5xAcPjdPb26stWnkvSaZgc6AUZezPPffc9u3bV6xY8YlPfGLevHly9h8jBHP1tWvXyiVs 27YNYwcAAIBypjNP1FnNb4mvPngJ4V5wMXOR7SgbH+zO7AsMwNiff/75P/zhD7fccot6u9Qqf1ef NWvWPffc88ILL0jnMXYAAAAAGEEM2NhlorRjx46VK1cef/zxkyZNWrx4sVT/Z9mwdu3ahQsXjhs3 7tRTT7333nulq9JhjB0AAAAARhx7aewvvfTSyy+/vGnTpquuukrUXQx50aJFYsv/Gg4++OCD1atX L1iwoLq6evbs2TfccINciHTvxRdfxNgBAAAAoAzpyRNfpiTGvnPnzldeeeXVV1+V8suWLZszZ444 88KFC+X5xo0b33nnncGz9DfffFOaWLp06bx586TRuXPn3nLLLdJP6YyYtnRsCIwdpQcAAACAgaE2 Liq7atWqKHUvrbG/9tprr7/++htvvCEFvv/9719wwQUnnXSSeO+kSZNE48Wr77//fim8Nxclra9d u1ZCSZ/H55EmWlpabr31VoksTUsHpBtDYOxyfPny5VOnTpUy3GwAAAAAMADUxo1QdR8kY+/q6uru 7t69e/dbb7319ttvS5A777xzyZIls2bNOuKII6RFcfiZfUjHlkYgnm/FJkyYIBUnT558+umnS6h7 771XevLHP/5RmpCGpMU333xzCIzdFXWDmw0AAAAABoBn7KHqPjTG/qc//emdd96RFt97770///nP vb29EufXv/71Aw888OCDD951113f+c53rsqjoi5PvpNn/fr1UuDXeaSh999/X6pLkHfffVcCStgh M/ZQUcfYAQAAAGIQ/VsKsZx11lmpWETdlyxZMizG/pe//OWDDz7Ys2fP3/72tw8//PAf//jHP//5 z3/961/65soTOfL3v/9dTkmBv/71r1JYqgyLscvEIUrUDW62IUbeOP4HAgAAlD+rVq0Sj0JdMHaM fV9D7tuFCxfyPxAAAKD8EWPnWzuecs6KGUHGTlYMn30AAAAYGHxrF6R8dp7+Gxi7wc5TPvsAAACQ EL61C6I2HirqXhmMPbmxG666c7Px2QcAAIAgfGsXpCdPfBmMfcDGbhQsAHz2AQAA9k341i4JGPve Gzvw2QcAAIBQ+NYuCRg7xs5nHwAAAAYJvrVLghr78ccfj7Fj7Hz2AQAAoLTwrV0SRFBFSj/+8Y9j 7EFjr6qqksEpuBcA+OwDAABAKHxrlwTRWpHSmpoajD1o7DIyFRUV3CR89gEAAGBg8K1dKsRL99tv v40bN2LsrrHfddddMjLjxo3jDuGzDwAAAAODb+1SceSRR4qarlixAmN3jf2KK66QYTnttNO4Q/js A0CZ0JmHcQAYQfCtXSrOO+88UdOzzz4bY3eNfebMmTIsy5cv5w7hsw8Aw0smk2lsbKyvr0/lkSfy sq2tzQrIF5YcbGpqShJNiknhAZt/fR7eFICE8K1dKtrb2+Uf4OGHH46xm7F3dHSMHj1ahkWqcIfw 2QeAYUTk3BV1V93T6bSWkS8seSmnkgfE2AGGBr61S0htba38+7rpppswdjX2yy67TAbkuOOO497g sw8Aw0hzc7O6ekdHh3s8k8nocfnnn8PYAcoYvrVLyA033CD/vmbMmIGxq7EfeuihMiDr1q3j3uCz DwDDhVi6anmoXavMt7S05CKMXb4XROzT6bRX3YxdvhfkbGtrq2q/hxRI5/EmC56xk1oPEA/f2iVE 7FqTQG6++WaM/aKLLpKhOOyww6R73Bt89gFguFAnl8fQsyrk8r89F2bsUsuSZ/SUebUauyXb6KTA EmxyfVnxKQd5KWKvZ11j13ZZcgeIgW/t0rJ8+XL5t3PwwQdv2rRpXzb2++67r6KiQoaivb2du4LP PgAMI6rNpsoxeMauqi8vpW5HR4el1qjem6vLcV1I14ZsK6u+bGlpkbNudTvrGjtJMgDxFPWtLYrY GY1+hEP/AyT/qUtKSivxTUfVlQ5odX0yGMMV1T2XhoYG+ac0d+7cfdnYjz76aBmE008/PWYkY9ib G0kuIb6knJL5VEwBvdnkSvVJwXd8AGTzjKDPPgCMXNScvX96of94XWOX/1Eq2O7/QLXupqamXJ+x 63NFs+K1uki+1HXP5vosXZNnUHSAoijqW1tm0KlobFYuH0b317fkn0r5gLub1l3kU3/kkUe6H/bQ f0p6di+3wwygey6ir/vvv7+UvPjii/dNYz/jjDP0hwbpfOgQ6ZdCFO7dIqNtZlvwRpKScp/Yj7De 77OKfqHU1dXFrDhJED2rN3zBd7xYdDUp4d6uMvnsA8DIJWjswX/C+t/VNXb9B+jl0rjpK/pVG5qd bl/TZvtSUf79uj3B2AGKYgDGrrIRxD7X3scw4adSfThKkHSqrir1/9g3n1DLjmr/C0YMOjAohIBE gtAqRlAwg0RbHYgazcQLDsQ/DdIEUUF9cCFRwQykgxJMo14QnDjoQdCB7VU0oNEmktgKDYGoyM3o 93zQGWZwBpltfuudL/f7Vq9VVafOPvvce8653w9Nc+7eVbXr7FNV61ur1rJZX6vuN/7TKvZ29wJX r161krfddtuPfvSjs6bYv/vd79p3tz1LWMY9NBbFgUSfDH5u/o7tgWQ9hy2wWvYb7e/v48/we1n7 UPLBNRTawYPWodgZ2CnFLoQ4GXJUjK3kftVtKPa8AHKFLJpar8nNCsCLEqLZpdiFGMEIxb5QaYxQ 7KavOJfz+oA15MqcWgfoFx3WoNjb3WtUMdH+4x//+Owo9sceewxv6fLly42X05lkFH7H9kDCC/fu IDMW+Sn2p5WhLM/nNd6tNLlip4tJin0HsMFjYwN7QGDDJmxU7YoV6ImAgoKq5Qb2DC2rXvRmCAH7 WBtdfkGeULFjBaaXz9o5PDyUj12I0Uyr2E1DIvcEbkyYD/xpt2BTbNEI0Qh0OSJALq8P8Jcy8s3K BAvo/aLFZcSWDmsEzgRr3x/YoZ92BQXs/3zG1+5eDXuxEO0//OEPz4Ji/9a3voX12XR7+830KHYm MdkvgnfeHkgwScXfjiMBFgS1auc1qIJ2ssGyrw+RlofKpTnDsXbK4xxPtPaxuZBi32oQo0tB4r2I 9vuyWL/3IGT8LcuaIrjEbkD3RXEo1hQ7YgjDWaT3hOSoGG+Li9sEKXYhRjOtYg+hcSiJWcmkcuAX AcYb14wOvFj4DNnsbeKQwu2ClUQVGlZ8QDI7V6pwZuf7sLB7DSDajQsXLvz973/fVcX+l7/85ZOf /GSnXB/6FLv/RVBy4UDKnszgSPdbv+J5DYwRL4ZfnJFRRXnGoVXrnn2Ge39FbXYqc1/kcYI1h6MO Lndcp4aRYhcbAuygLVDBk2BjtRYVQ/ntB7DX4ajoB23OS/VjEluAmmJn9qsQosi4OPZLJZBggjBd zHHYMioZWyiQe4I5m/VV0ehg0aAuYva6LxMc795KUpjhLrJiucj4gGpbuOxP+D+LYnKcTbx8+fJt t91mFd/xjnf8+te/3j3Fbm/4rrvusi/4xje+8erVqz3vhIq9OJCgdqwMfkcMm6UGUrYdHCfeuOTz GlSh493/4jRe2OsNx9aHQyV0jz7YbIOk2LcdjMxijEFIkSgqduzaGqOiWIDYiLW7IaBLil0sBGLb J6P5cyLvxeLqRINoox3Hi/gT5p7+Exxe8xgRiyoFA85J+fSiYu8MlRTiLDNCsdeoxRvnnBdM8xyQ UDQ6kNz+3C2cxEHDe/3jrSRiXfzT8wkg1x/f4WwxR9tEk7j33HOP1b399tu/973v7ZJi/8Y3vvHa 177Wvtr73/9+62rnCwlnMQG+4RzH3jmQOGxoO4a09RtK5zXBJ+9/cTNnOczYa358pp4fSi4m//Wl 2LeUYn6EB7nPxTEMfyY3d1aS45OjApl6lDq+ZeZTU3RxvIXVKbtGhRjmC2MQ6jxE5jjEyOQVn30D 6U5zibHqh6U17kddGLH2dKvOJwbFriAZIdpM7mMfKpmn3iNUk77F65jg/gp8m9ROwS86VPxacHt6 L8FQ2dfXDrJX8WKZqH744YexcD300EPPPvvstiv2P/zhD/fdd19/JEz4LRb62IdK5mnPQGL4ipf3 eesXzmtQwJuqYvtWyxrxLiPvL+rpnhT7VgOvYwjureHHMGNpIOm5EOGu38bamkapw4WO3k54LFkd Qy4r9s5oHHE2QQhKOKlpgJOddoO1487GLSFEP9PGsYOiYs/tdCr2EMmQ28zt5zj2EBRdjNmrVV/Y 7X6uXr36hje8Aemon//855977rltVOzPPPMMo9bf8pa3XL9+fdn30HkAWlTsC38RBqvkxM/8RH9e k3NXQ/tMhvUDqZFFJcW+k9SOThaO4XwkVIzQYwGcCnFMMvO6OHrDYFNIsBBC7BgbrtjhBc1hDxBX V+bkgFJvJZlus7+/b+3AkJ2WYjdMAH/gAx+AaTbd/oUvfOH555/fFsVu2uBTn/oUJevDDz9snRnx Etan2Plz558vHPUCntcwTL3WPv32iOe09u39e0+mFPsZoajYzyW8SoePsTjmeTRTnBQ+cMsK+Jgr q+J7ojh2IYTYbTZcsUNQ5QM1nC/vzQl+0eFWpZeji30Y6skrdvbB6/YLFy787W9/22TF/uyzzz70 0EPU6l/84hft+uivvybFjvL2v/dDgtrWj82iqRA27NtH46GAFPsZpDYSiD954Riu/ejtAmHJRRgw 4pD5ICl2IYQ4C4xT7DcqoJg/yR1WU+ywTcXO+HyWcKuh2OmYOl3FDoJu/+hHP/qTn/zkpZde2hzF /o9//OOJJ5744Ac/OJVWB1Ts7YEUnJntgcQoX3uruTWULMZS0i0fotCHRYodFaXYzxoLHRd+Hzeh YkdJ5pwy2E+KXQghzgIjFHsNyhVKYhiaVRQ7MtOLnYFCK7bjJTeF3Pk59E1tgmIHXrcD68CTTz75 wgsvnJZit0c//vjjDzzwgO/VJFod+CS7Iv6344/VHkg+wjy31tj6+XzAxi9umz7+OhxI8rGfQUJ4 eaah2ItRMdhLFkcFpoD9j6AsbEjDSiXFLoQQZ4GlrPbBwcH5OhQ8EEi8gtiV3E4OUQjXIaVC/iCB t9zI2e44OKZDFQmDAPofBax9KwNvVaP6wm5Pgonhy5cvv/Od7/RS873vfe8PfvCD3/3udyej2O1B 3//+9++9917fh4985CM//elPbeMw4ZfFa2/Al28jh1caA6ndoN1tbP34FB86VfzFrQC1ulWxZm1o 2RXIpP5xXhx1Gz73hccf6OQxU4yKGdLh43CcHOG9ByEFg1WyY59pFFLsQghxFthkq20mKTu6dx7T xqaQP/ShD+UjjM985jNmkX/7299Opdh/85vfWIOmM9/+9rf7Z73uda/79Kc/bWNjXGLpBoJEUc33 bZn7mw9jVOyDCXibRwxT8ec1XrFDVCNpwq7Ak8D0Ch482UVT8qbSmZcxOG1vH6yk/c8OFBW7z34V QgixA8hqbyymlu3X+fjHP3733XfnSI+3ve1tH/vYx77+9a9/+9vf/s53vvPEE0/88Y9/fOaZZ/70 pz/9+c9/Rgv2wa78cY4VsGJW+Mtf/vKHP/zht771rbnNd7/73Z/73OeuXr1qWwC9f8190YaSO4S0 +WPBEGIXqthnHsHQx+4LeKc68yb8TsE+4LAmK/ZiaJ8Qmz+tAjZH8kjGwVPxyBu38vkXruPg1eZO KIC7+dHF7KcGN2/etFqomwMANp/a2xObgKz2Fs2jy5cvf+lLXzJd/ZopuO222973vvc9+uijNgau X7+uN6y5L0YAb3nNuCNA3V8xI26S3srneD8riRZg8bPRRCAWXPSsgs84keRBks/gFmKLqGUkmcz2 Q7qRAF6MENvb28tt+tDERppeTnGqYZM6bMlrYb0bi+LrNhlZ7S3lhRdegIZ/7JgLFy68r8L+/j6L PfXUU1ZxqhxSobkvhBBTAcWLSDPAeDP736en9St2BpjBXe9j0ijafdBafnRP2hEy7/BoPAJ/Luul P13Wmq8nVkRWWwjNfSGE2ASKAV2z2Qyqm+7ufsWOcLJc0h7hk8FrDfr08DZw43uti0fLXy2mQlZb CM19IYTYBGopGDdv3sQtuKw7FTtrFQOz4UKHxm40yC7Z3RwhszdnOE739rcQq1bzsdt1q4ha1rIX 9mjT6rKAdTVExcMZXrt7eHjIuvbBf30rjHSbYuPex249tM9211rDs0I/h/nJgm8HmQJy0a8JWW0h NPeFEGITaCRNw80Oxdip2Ps95LUG/U4BHfDqF+1DXaO6lYdqNfnayN+01hjqAzHsY294i4S+oSe+ rv3Pl4acdFRhXD0j6lk3VEcWjH97+FKMyWdT7Ce+vn8Q/texwpqQ1RZCc18IITaBhmJHkInJ0cEl ip4r0SPsA8WSVOm4fnBwEGLaEQljwhW34G2uJbd6IKqpbLEvMODrpkTHn+GkgF2lYxxvBhsThNPb Z+4XqKtxhYqdLxnV0dWiYue3ODw89Dsg9Ip7AT5Iin1NyGoLobkvhBCbQEOxe1G9JsWePdtB/YbQ F/7pq5ustf5Dwxv2Z34cRTJVtz2C3zq/BGwN8KWKcT686Pc14XG46I8qAPcLQ0mxhxMK9g36PLzb 3LiYEFltITT3hRBiE2godq9aO6NiVlTsOUScTvXh2KXsXdNW3ket42IOfR+OPeGMbDEt7RV4Don3 XyrfHVyWKzRzeIFeXRcL8LVnxV7U5KFksZ9icmS1x2HbZxuTiPuqYdMcxez/kBVSxGY6pluev0tx ac6ytexxVmvph9r3OjiwVcymsS0Zw/HpWMSuW5fsXyUHR2jui8lB4lugWHLELVuvTAZgfcu5dTdK jPsWq9Q9dba686fCwjj2hYmiXjQyRKT4LBu3HL2d2h4NQoSjP6heDJgv+qh9UyGKhk8fodhZoCjI vfYuFijqcCn2TUNWexzFMe+x+etnon2+UlOzc5gq4unxDBRXPE5nZKP3mIwxE82+kT3oNa+55Z9d 8Y+zz/YtfIFKXJ/Q3BfTQrehBz69cFLfkElZHmBVCc3aFe+XCNG8fLQVO+rettuq6CMTwkH/VlAU V6L9xopD0WeADt2KfajEkAD4pSG/+73x+E2ROsryRXHeVuzE+sahXtPkCxU7DyByeuxwHIHf9rEj in5ZxR5mZYjPF9Miqz2OtmLn2mLjFuFejUVjcNtzG+3wydj88gkvS7E3p6efjVVuMWadIddNgdv3 skeYgLfnQrTTdkOuWxkrYMXwp6az5r5YPzypP++gBvY+hH7FbmVQGOuVPYJiw/7nsSNT5/KjOxUs TD+ewkdsnWiXYh/xxvJQtHEFW0bT1q/YIctzSY7kkM7ZOTK9w9/33Fv5RlQMvOu1EJq2Ysejgw+Q 7w3dCxmvPqAI1f1U8icR/YrdOl+LcpdiXxOy2uNoK+E8ZYqTKLQWJmBwKayjn41VbuioUHaYQ5Nj HbO1CwLeLQ3xitDcF+uhJkKgYeBSw5V+xY6SYSmjoOL1YoNc07zOKcJUOLbQDm8QOwO3ZpeO8VtC WsN+xW6Dk/tHM7LwidldXOzZAgSgVMMMGpySh2hve+q4j0AL9r/fArQVO1180AxW1+9KvMPQ12Vv 8SBWt+75dNF+xT4cbwTwldmOFPv6kNUeR1sJHx4ewrseplttNSgeY2E6YC7gqMubOZuhxSs2Jelj Z4ycXee6ZMsXFkB43sKkxgrJu61IHij27PKy6/Y10aytrvbBW2d7J1LsmvviRGgsOzC1bYHNWxQP jQaDoq41SFWDRTIsesymKR64Y3WqZQ/ZYoU10P73CxfbNFDA/gyJRcg5wjpZ3E2wbsgwYuP2RCzX obrPKuJnPCv0MzwInRyXlLTVFOOpMGY6TWr2PllFikmP33j2K/bh2GRn5zmUMyYCPjROhaicQX8c ++DCaH1dbme4WeBd+5+BcHyu7ydfxVKKnX/6sDcp9vUhqz2Oft/1kLbPGbq8agrZZ7v4ZS1cwRz3 H/ykHtzuG4LcN8JtuJ/m2fP/f9h1aG+bmx15tfyq/1urdEooNPfFtKwusIdbxYP3xWV89YWKHX7C oHlg7umss+q2ZCG/tX3UmJVS8J0GHWh/UngX5Y3vOYP2a/ImV/eHF+Elh574NxC+xVJBRLs0aAPF 1GbslWrbq7wZHNyeLu+82g32P2K4dedYi4Ml9jhs9Ox/b2rzTi0/EdHvuS7Adg9fNnwpeghRIFT3 D7LdcX4n9mfYOPPVLZQ6YkVktcfRqdjhSymeI4fJxY0qtHSe7H7lx87XL+Ywf9jOZwvLfgbHGo8L 6dTyc60W/vd/IGodut3+2Z81eW/rrbWDuPdR6bRCc18sS0OxhxjUYtg56BT2gWJJRg4Xj/4ZCcNb Vszr273KTp+eQOg6W81yfDLWPURE8Ch/SCEEDDCg6g6hDoeHhz6i3jful012tajYEZvBnQLeEkMd woMUCCSmZSl/YwNM5yBs+pcIMQJZ7bWOeUaYZL9NuzAFOU+yYGXQgnfswEjRNzU0FTvzwf1DrS4V uzfuxbySiEl0SnGq9+yCsw5A1aNAI9hGaO6LiWgf9HvbWgtFCJ6BZRV7MfOU/YG4pX/P9Ll3OzAW gqF6Nb8HKno9D7d8LaMQCh9famGaXl4zc5peeMN+Zc6KnUv6cOuZRc5moobXSBYTMpViH1yeqbWG gK7+yCIxAlntkxnz9NssLIlTYCtPm8U0Fr+2213Ymuytqil2b6cyxcDRHE1XxTppdSnda2FsiKWx fyuk0wrNfdFDQ7F7h/ZwbHmZl+fJxfoVe1b+trLxPD0E+2GxotDNMjuLZ/9d2L59i+CUyJqcX6qY Q4QtAAKniy+Q7yGHTLPN2sqc++a3BvlBUuxiWiZU7DwnqqUbiGmR1T6xMV8zdma/sD/NVfwBK6wS bAc+wJrYXXzwSWQNxV7b/xZNT8teWJvFID2zU+3cUsTSKDNFc1+smYZiD/v3zjh2Cvvi43ywcXEL UGvcFjec6PnMuxwNm73Q5PDwMGfA+ZdQW9mKKzmXytqayVrFxuFLyTq8nU4oxS5OBptr04pqHGnB 067Xu1ZktcfRVuw2dE0/B19QrUpDSIdbcK2bbQqLPAwEDVlNsRejXKyTyOtZWrEjyqV9y7q0vz+4 U2C8HSl2zX1xAjQUO8OzOdN7FDt8CLWUHJT0YTYLLTgPCv2J4VBxfS9MaoOEZvgNRPsIxY4DzTX5 2PMPJMUuhOhBVnscbcWeLQtzPHPOO490s+8I63lwFvmAdnwOq3o7jj30AYbS/l9asZsVM+GdbbcZ WfrYIc5DvhgqKpdcc1+smZpiZwao3+b3KHaGcOeS4Vmdip1Hh2GpKYaX19q0b2Et+PhwuDV8qHlt ZcMeJEQD8mKIHfJ99o2HlNhGHHtDsWOtrn0LIYSQ1R4HVlcI3cDgMobgI7IVHuXDwk5gnmChrIpP 4vCOJjrJuYYj3jK0nBW7NQUzR8ca/P/WMo3L0ordLAsi0u3RZvetffvHUHa0Y0/Bn9TnZoLbMTNC c19MBFW0D01hFqdX8p2KfXApOd7DgAd1bgGKa2lYxLjWcfVjbHlugbcYIe8Lt1c27kH4IK6KuAKv iN87+GBFfnEq7dDPfsUerAa7IcUuhACy2uPwMZMhtQoFqLexSi9MoGb50FpwvPvT3uHYrgV/flHS M+MJPWev6F9aWrEP86AXppr6f94zxjIIlcEHRbtp7ov1Qz2ZCctRv2L3q9+5Y/xKsrDBtIpcCWo/ dJ5RLl5XB7isnZ/jfR0LVzauvb4uv4utsXw6e0KnBxrnRZb0x5qdin241WqwwbOm2GspD+EW8r8C jVo9JTefyUPQxXYhqz0OU8KXKrAM/OS26prAruVqhcmIIExgjwiR8HyuN1t4KJ1LvJK7yjLWGeuS PQIuffY2tJybKmA9tM2C7SBMANg/M3Mp7Od/y9h1FFAwjOa+OMFl6nzCtGjWvVgQcswebuXDQQSi ULFbgdBmo8HORwzH+aR8RLs1W82K/cFLCNHv4YnhQeG72MrpG/dLIiS3vVIWCP30D8pfM/eNi7O1 GbKDzwjYrYQ4Jd7i2yjuRrGrOrw1c4o7ylBy4YjaQNrhuGLnkdUWQnNfCDGCogN/HBfneC8NInba h7O7BwV23ldmxc5TFcC63kXGA4tccut2Q7bLKGaRiDOCrLYQmvtCiBFMq9h9wPzR0REcqpM0vkVQ deetSlbsuQzzLLj3KQZoIX04BJQKseHIaguhuS+EGMGEip0a0qcGnDUH+3Asy4uxMT2KfUjJwrWU Cmu88Ybt52CQqn2g/p/NZvYnYlathVqYGWNii3dtO4a6Vianb+BxLOCrI8YVAa4MZOWzfD99FT6o GPsqtghZbSE094UQI5hcAjH1IGu5MwJkOSKCQmxMp2JHXZ/wu6xit8Jh98SsZyYXhPB4v2vDloEZ xH77wOf6u74PfJwvwJ2Lj2P3Wc8+Pp9vrPgtzuCpzS4hqy2E5r4QQmwClOVZUXcq9qOjo4WKnWq2 GBUDYcxbvidQ7PjTtLH9ibt8HAtDOR8eHvrzAvsThbEdY+wTv0jYINj/uII/s2LHduDGHOwU2BQK Y7Nw8+ZNxAtJsW81stpCaO4LIcQm4GU5NCc9zJ2KfbhVpTcyTxvVQ4Kn9QFClz52hKYUH+ej6Idb ff74Rv70xNrJvfUF8E1NjQ8lxe6/Avs2pIMG308p9u1FVlsIzX0hhNgEvCwPsTGdih0ZAcHHHrCL Fy9e9Krbw/RVBId76e5VMaGQxt1iziwK+I4R+MYhpHMB/8Ss2H28ja+OuyERAP5/KfbtRVb7FMEE 38zWhOa+EEKcMEGyMsgEvugexR5ENb3WNxwLu2FK2Et9xrEUNflCxc4CRcXu85eLBXgxK/Ygv4Ni D3cnTJQWp4Ks9urY+D+XQOpQTtwe5n4D21NzNbAP9ufR0VG7QZDdAtYaz/iKrRVBHnrAR/TZZz40 N2hXcnVfJlQvvgehuS9OYGkqqhrcou0urjZWMSQ/1pYmm+MTZl+eDJBPCDYQm0OWrIzH7lTsIQC+ lnm6EDNbNv69dDcbN06xt33scOmP87FLsZ8pZLVXhwkg3oTxSlgobAXgLR9QZ/8fHh42GvRtsjWk sRRbay9QmPgBTmSmqKDN3GDxnJEFmMPu+1M7fxSa+2LdS1M4HB+S7eY8zQuOP3ZvL01cwbaCmrgS p0uWrIyN8eavptiZUsrN5rKK3UyVjfmwlWMualuxh4Ac4C/6NFL/lX3kD7YGvAvNUItjryl2vLRi P6XYtxdZ7dUpLh1wfdcEdshPZ9Rcey1i2jhnXEhp9621LREzazwQ1VweaX+xYrBBLlmhelideAX9 CeF2QnNfnMzS5COBw62g2L2qsYnM6ixWXJqsJAJxt0792vddeBwpTpiiFxpu86KV9DYIZ0BhKI7w sQfN75ND24p9OA5K9/YOFhCSm93mubOZ7xzDw/2CFfPJqv2KfXBnE74bUuxbjaz26jSO58KWtrHD 9dp7qfO+vLgVt/keM1IN84pHBIHtFwqsMNlr59cfXx2Pa/RHaO6L9S1NWcMMHYrdT+eFzgSsOcE3 GNYca8qqh40DwgzQwsGcYgtWy+qaaCnG16FuyBD0jdsHu2tlQnWv2Ol2QOHis0InJfjXQc14BQ+Y 340Gwvgcodh5FO5PrqGiFyp2GxI8sWJdL9H5RYon7P4wnQVoT5dS7Dxu4EGYfOzbjqz26jQENiY+ ZlAxx5yYSbLC8HIvG6GXD6OttcYChV5ZU7a22OdgQ4uT2ueYY6tuD7VH4JTQl4SHIYS/tq250NwX 61uakLQSdtmdin241d/YWJoaLdC5RynCJcuHKLOAD0iwkiEBMPgKQl04XX3jPgLQVw/SiwH5tWfZ 5/AgBdWsg705+TqOrXnLTE/OpbLfKOdTIOtqWetjAw+CGXCmWDtIUguD0D8CcTW5rp99bDzku+Gi TTcW8NX9g/AGwgl7eHvWMqa/XbRvhOEtxb69yGqvTmfSeqNYZ4M2i2EyOEl9wHl2MbXbD3aQbRYn tb9IF4E3XlwnvROAFC8KzX1xAksTPNshNqZfsfstfG1pCq74fAtJrNZ+iACknLYVxhqnKsZyRHel 1YJ/ILgcGQEIzwMbh6Rh46jO9RP7hazYWdh6wqUVTXHN9A+SYheT0z4f7wc7i6DnZYi3HVnt1WlL cbqXl1XstfSu4H8Inh+4idopYJTcVteeRbcS3Gi0sCzPwzUms3OPAF+Bt5JF06+FQnNfnNbShGkb juf6FTtK+ihc+P0IF5BipFw+dPM+zxBqy37icdl7wLXoaE7Oavcxw2jcL5g+Jaeo2L3C8ZGKOWFw S0P3xYYzlWJncCwHbWNbLbYFWe3VWajYDaZxjVPs9OeEaBPOTZuMZkG8dIcRRCQnob/Inx0PzhDj Tx74wiKzWfuM876wa4DxwkUpds19sVFLU8ijga7uV+w+saUWPJyDVQh1grWQIxa8KgY4DsA6ycWz WAWdCfEJ/lgTJcND2WZRsfvYCYYCFgMavfgXYiqmUuzDrem6DGgvSgixLchqr05nVEz2Xfc3yNPe hdPNLA5PbBH410jJCQsFDRYO1HwttFmLf4OR9VZSil1zX2zI0sRp62NjVomKCT72WkIoCcHh1mCI Y/fP9UK6qF7Y82Lmna/VXouKcezFBxWTDYsXhVh9zk4YZ44ILgT5W7PteSo2H1ntSaZYben2Kp1n uMVGEKLpHVmhwRCiORy7youzmwIbjndSzOgB2WTTMz8c79ZDUJwvudCvpcxTzX1xKkuTXyIYG+Nz yYeOzFPM6P6DwoBVRwYcD+wg2kcodvZ8nGLnN5ViF0JsF7Laq9OwYt49lf+slaw1GMIyfXxpIJhj D5K5gm1izNswt615m0/JjZ1F6Js/IEav/BG5b1xo7osTXprCXPaZ4wsVe4h9HaHYsZ74K/AnwDux ULHnnT6q2JqDvoUFMJ/3hXNJrkX9ir24gvWfmQohxCTIaq9O0YoxIsWv84eHh/AvBWc1/eeNBgd3 qA0bBDuSIzmtWM6T8uQcK5+ulc8CvGWk8fJG1gej5nQwHwcrNPfFCS9NQTBzGVmo2Bm1zmIjFHuO VMeCgE19W7F7be87j0D04lqECBy/HfC99V6OfsUemh1cAqwUuxDixJDVXp2cKMqT32BNhmMbxHhO HhP7GPWGWQzaHs7t3FpbIbOWlUFoDY0gCvjMU5gqH43DPuzPyZYLBVCdhRVBp7kvTmVpymdtTEkL iv3creSVZIRip5sCq02I7msrdjoluJiEowF8EcQT+qUM7gIm4xSXsqUUO44mudLy/UixCyFODFnt 1bEl/VwCkaJFmWqC2UtrhJf7k180WAx3MUuE9hl2YgbRt8a8sHafUavWgWHuU2KbVjK469FDVs+7 A9pWVFfOqea+OK2lqRaG52+dK2GLQAgpaSxNDawRv0D5zFOsM0Gx+0fYEhrWItYFiNPzaxFP97DE 0asQ1qLwoKJi96/IVkimBdmH7YqKsd6er+MXcNos+77hVgN753gnmnRCrA9Z7dPCFkbmdU4CWlsq u9MKW5Wa9xs9bDS4sP/L9kdo7otdBavN6AWhXReNh4vegb/iWmS6PXstQsLOJsOD4CLcd2B3wxfe vyVppGgJIaZCVlsIzX0hdo8ccjOakBk0m82Kaa0bC8OZbpTgXsYfNHQq9ps3b/K4VopdiLUiqy2E 5r4Qu8eEih2KN6QLbVEQe2cCQkOxF18jwyNDfoEQYh3IaguhuS/E7nHx4kUTnFMF5jH/CLp9u9Tp QsWOqH6f2UTFzkSAnPGEt3FwcFDMcUbYv2S8EFMhqy2E5r4QYodZqNiRZ8qwdtvsQLHzCk8WfN4x U02Lil3B7UJMi6y2EJr7Qogdhpmn50ow4iVHxRiU5fDDs0BuP4hzpAPPZjO9fyEmQVZbCM19IcQO M1qxB30ON3uOaS8qdiHEtMhqC6G5L4TYYVbPPAW1ZF4pdiFOAFltITT3RT+z2exSk2ItZOd1Rghc u3ZN4kdMiBS7EDuArLYQmvuiH5+Rl6HgOTo62tvbo7apSZ1i+7VoYSHGIcUuxA4gqy2E5r7oh/G9 bR970Dadih1yPccPC7EKUuxC7ACy2kJo7ot+ihl5mRGK3QQP5LoUu5gWKGobVOdL7O3toRiG38WL Fw8ODlZX7NYsNrZ6/0JMgqy2EJr7op8exQ6tAsEDOQSpc+3aNZND8GTadfuTVaiprly5kqNiTEFZ C1ZX71+MAKNrYSjX/v4+r6yu2FFYil2IqZDVFkJzX/TTo9i9qxwloV4Y8cIPN2/eRBWkprJ6aL8z qkGIIrPZ7EYTP7x5xf4/Ojry7difxXMitB8Sq1G4M9taCLEQWW0hNPdFP8w8LQYYmPBGsWJUjOlw +NVNxjQ8kFmxWy0rycaFEEKcNWS1hdDcF/1QsRdpZ57u7++zHZPfNbd5VuxCCCHOOLLaQmjui34Y FVOMLmAMQFGx+8D1YpwwkGIXQggRkNUWQnNf9NMTxz5UFHsIGJZiF0II0YmsthCa+6IfKXYhhBAn j6y2EJr7oh8pdiGEECePrLYQmvuiHyr2SxUQyg6JfvHiRaj0FRX7wcGBlbTW9P6FEOJsIqsthOa+ 6AdKuwFkuWls/Gna++bNmysqdtsI1AoLsUtg22tTpnYLn69du5Y3y3YxVyxuq30O+BZhqwp9AuIM IqsthOa+6MfM5aUmtKcwr7iSTS3asev5EV6ZAOiTYmEhdgnbq9rmdG9vr3iLO1nsYTNWYH9/PzdY LHnlypXtejl54y/OFLLaQmjuCyHEJkCBnfenWbGH4DQIWkSjhQZNxueSOP/aopdj38t6fnR0pHFy NpHVFkJzXwghNgEq9iyns2LPcWJXrlxBdca9oMHsl4ZoDw55ITYZWW0hNPeFEGITgCzf29vLsTE9 in2YO6J93Zpib+eGHB4e2i080T4wfubo6Ag54Cxg/4cYttlsZhsB1g13h+NEchSwpvzGZG+OPY4F fHXvY0cjCLfL/QS2bbHW+CAcLii4bnuR1RZCc18IITYByEsTpVDaXl52KnbkdLNkTbEHYe+Box4a mJE26IlPPEd/QhyOyW9cRHV89v1kQA7v2v/snj9iYAF20sexMy4o9IRvjMcN/kH2f95BiG1BVlsI zX0hhNgEKMtNeYbYmE7FDs3cVuxo3Cgmn0IYM67m8PCQWwAqdkp0f3eYO8n93dlshtagutltfils HEJvrQCy1Fkd/cyK3Uv0/f19/07QFL8gBbwU+/Yiqy2E5r4QQmwCXmyH2JhOxT7cqtK9F5pAuxYd 7Kzi3fum3tFacOCHx4XNAvAXUZJ7AV8dF3MBKG1806zY/Rs4Ojpi33wtgupS7NuLrLYQmvtCCLEJ eMXLCBOI507F7oXrUFHsOeTbQ/c1A9EROj4cK/aiEr4xp9grSvqs54djNzuEdC7gv05W7CFzltVx N4jz4kWxRchqC6G5L3aS2Wxmxp1iI9/Cyfsw1yGBRq2eklvBVnd+VwmSlbExiGzvUezXrl3riWNv w9xPRq0j0GWcYmeBomL3QrpYgBezYg/yW4p9t5HVFkJzX+wkzE1j0Gy4RdvtlYlPrGM4rq9VLLl1 MqAmrsTpkiUrY2M6FXtIKR2n2IFNHJPuaLChyVf0seML1hS7j8NZVrEHDzwC3aXYtxdZbSE098VO QoGd43WLiv28gxreyw9uAYolt0sJQD7VIpnFaVGLA+fe0A/FrI2ZX8lQ8GUVO5I9Qx8glQ8ODtqK nf33e2Tv8/dppP4rh6j7w8PDMOmwd+5X7CE0yD9Iin17kdUWQnNf7CTeJe7T6IaKYg+qxpQGrtPT XpNJ8N1l56EQy1L0QiM2Jit2HO4QOKv9iB1G+dghjNkIJ4LJ4IWKHQ55u4Itg/2Pu3B3Y0NhrUG0 m7Bned9b+x/VrZjPRe1X7MOx6x49YTek2LcaWW0hNPfFTkKBnWNjehT74NyDqNsIRWjrIlNcph+s oukWOj9x3dqczWamTPbmhJ3FMPcWWi2ra9qmmC2IusgQ9N8RjVt1+2B3rYyvbg+1u3wcJB9q1Z7l O2nN+upiKoqKfTjWn0GxFwO0cjLmsood5y/MV0XLaHahYmdXUT3vILC99Y1bdeZT8Lm+OofiUoqd 5fk4H34jthFZbSE098VOQpvOSOB8C382VA3jAYaxip1bhhw/g1teV6AkU2K9vMlROqZzQuP0Xvrn BnWEu0F6BY2Uo4nygxQGv6ZBW5SUthfzt2zfdynhN4OhQY6oTvA4xH2Z3mbLYaMHuPHkFUS/h7rE rmATGnaRw7HktoFdrO4fhDcQGs9vD8Wson0jP5fFNiKrLYTmvthJKMsZCexdyp2K3fvlaoodJ/tF 1yijcOH9xik/S/qTens6ww/wuMPDQy/Cqc/ZAUYvoHHGTiAMmI3jW1OxoPGaYrdn2S1GI4RQh/Ag KXYxLbUjhmXBMUHIHF8lCVdsArLaQmjui53Ey3KIzBDf0qPYvUpvZ54WfXcQ/P6W93n6EN/8uJym Z7XYVZ/Q16juRYuvUlTsPuPPy/ucThjCj4WYhKkU++DyTDFZNGJ3AFltITT3xU4SZLmPjelX7DD0 ENXF4GEIeK91PUi1Y4BxOMTPmtwL6aJ6oc8fnQlBy0dHR9TkIbrYf9OcQpg1OV9RMXQZ4l/6R0zL hIqd50TEhqsc7FuNrLYQmvtiJwmy3MfGLBvHHqJibji8yq11wysHnxuYRfVCxc6eFzPvfK2iYufF omIvPqio2IsXhVgRjMwJGzTdjskirb4DyGoLobkvdpKsaRkbA895j2L3txqZpwthtp0PoRmh2Nnz omLHrmS0j7349qTYhRCbgKy2EJr7YicpalpElfgEz6Gu2EPs6wjFblWYsAlMtzM4Z6Fit88hkIYX EW8TOuMvonEfQu/1fL9i513E3vtvIcUuhDgxZLWF0NwXO0nDCw1Hd1DsJncZ62KSGNre52OOUOxo xKd/evd+W7HzcRT8PCPw3aYmt2I+hgeffXQ6Ho3OLKXYuXNBU+iGFLsQ4iSR1RZCc1/sJLVIbwrO oNiLWaU+LXSEYj86OkLjSFDlZ/ir24p9cKrb1+UOgrl1vgC8976uv8uWl1LsoTVUlGLfRiYPFBfi xJDVFkJzX+wkpsxNUvqwEHLx4kV/y1Tu+VuxK3Y3ZJWiQe8w78FEu7V27hir7p3e1qAV8IXDIxBX k+vmxq2Y319AVNsVFvDNhgftzWm/PVzBRex6pNgn51yJ8MsOx+nM4Sfzt8JGFWdG3Jmirh94qJWx YiEuq42NKD/Ut+79F9+e2BBktYXQ3Bdi9yhmno7DZNv+/r6/gjh2CZvJ4aGJBzI77ONqO6Z8tITs Bp7FFM9rUKv2aBbrGXLFM51toXYwJzYBWW0hNPeF2D0mVOwhidX0WzErVqxOToK+efMm5TSVZL9i tx8LdcNhE3ITGApVbNAejUSMHuHNFhDxZf/zlGeL3r91216+T7IWm4OsthCa+0LsHhMqdkr0mstX TEVW7CAkHfcrdp+MXBwhUPK1BpmpfXR0VIyB50WMDR+1hTCqhr/a2rQyViBs/dimFbC7pvlDMBiw Wo27qGvt++AfXPeNh+C3oNjtM6rjWcUtqu+kBP9akdUWQnNfiN0DWmgq8WBqZH9/HzEV9kHe9TVR U+y8BZd1p2JHfnHIKSb2I1prGCGNBtmlrMmh5w1TrSGvuaiiPXDy+yxvxt4whN7f9XFZ3EIW7yJH wzfuA/6ZNF2sXnx7obCPEQqdbOyPxOrIaguhuS+EEJtAQ7F7NQhhiRzJADSkL7ZUTEu47n370Ng+ ugbpDNjB4djFPvM4JiS35maRUWtfNoTo+HMc6xi1PVqz/1HArltda4p/+heFnFlrnxLd32V1K4Dq 0OFZsVPS892ynwwZ8g+SYl8fstpCaO4LIcQm0FDsEJNwFzOyvcY4xR62AHQgwwUNWe5bo9ed1VHA J7cWT3nQsg9xtytWC5ocdf3WwAfw+C0JgP8fkh57Ae9UD9Wp53kXmbn4XkUfu/85+CAcK/gvaB9w V4p9TchqC6G5L4QQm0BDscOhDU/ymnzsmRBw4gNjfCQMq/vC0Mb+CqHr3r5OjrCiKg7fHV8qB+cM TpMX0139ZgcFwkPD1qMRU8T0EJQM2Rw4DpBiXxOy2kJo7gshxCawVFTMwjh2Bp8sfG5xC5CTOlEM Ihzq1MfVB3GbffKeHAEe4thrXyrf9QWKCdfQ3uhJsUDQ4V6xh/4XSxb7KSZHVlsIzX2xk8DhFjCx Efxvw60n8vlWOGEf5lLELp47BhGzucH86KUSNkOy58JUvg2k+PZEg4WZpxhCnYqdkRu1CQIv99Dt jWeq6XCrci6K23beK+YRRjgD1yHaRyh2OuGLgtzvHYoF+Nql2DcZWW0hNPfFTtKI9Q1WuC2Tgjxg HhwVe44H4MVMOEavwdBcPiLE024FRXEl2m+sOBR9BujQrdiHWz3zgU6nfQC+cfSHg9kredLwsdut 0CVMKzS4ULGHmBl+F9uMs3v+rg8oKobN8In9ih3R72FDmmPsxYTIaguhuS92EoqQGw6z3cyPY8l+ xQ5dYVe8xefWwB/rQxX4R1Pq93jaIQyoiFC3R1Bt2k8g9bIUxaHIAcaX2a/YbUyibhCxHMkLGwxA qXqHvx+x/uduyFefCgogqrHtbSt2r+0BtgYIRGcaaU4IxZzFo/03zSm9PYrdT3P/ZqTY14esthCa +2InqYkQuq9pajsVO4VBLhmeVWsQGmahm73ovlvorza5Yk9sBM+gQO2u3SrGBfXUHeYBGP1HAI1+ LnzQbuMPVsIhjh82/Yp9uPVUCEFWfAqnQL9i950sTisbt4xOqTXIfYT1zQpz+4AR2Fbs8OejcdTF n+FYATmz3KFzNuEuq2NK8tFLKXZKdLxVbmSk2NeErLYQmvtiJ1moahYK7OFW8dDW2xAq7Qb5XAgJ H0gzzN2MdvHg4MDn9PVgD/IyzCfx2RPxIATeo0D4ClQ1zD30d22f4hu3dijs0bi1RhUUqvu3h8+I nc79HOaaP3TyDAbVnCthryUMBrz5Yo4AboUf0ar7cPHwO7YbzOCnCaM3j0NrrbF/tC754LGFmaf+ S1mzHCqh7sIhjbHqC+AYLj8Ie5Ac9+L37PZcfGW8EMxcKfY1IasthOa+2Ekaij3kxBWDWEDQnJ1C eqGPvZgSiGeZGqEfj6o1J7cSuhyxZaDPEGKJARXBv0q5xfLQG7hLSY9jheA4pWLxjXt/JqMd8ttj T6jr0M/wLfwWQCN5KnB+se4jjIVnPR4czTQOd9q06xa/rHeSr/Lo2WxmA7UYTr9UgrnoR1ZbCM39 0Zi6OF/HL+YMqjQxY7dCTGnAKsJvubCkaNA+6Kc8HpqJolnY9wievAUwIx7i2GHcOUigjeHQQ98o j9m94EgEOJr3bnMIb4wcvATvFWQcMj/7oN8QMpTjjX1EfW6cgUP+Jft34vvpH5SDk0OgtRCT4BX7 KnDTHeYOV5VtxL7LjTq13U3nNhDFVnk5UuxCnB1eeeWV22+/vajKnn766RENtpUeFjFb5RAwiSo5 yjTAw2JKta3LN9wQFip2Cma+58wqir0o/vnTmwz2vm4fCcMBQInekK8UydYgrCElRPElwJuNpuBg D7tC5ADWDgIGt9lB4yHGxrsZs2L3b8+HEPifA9SeLsQqTKXYB3c+VTy92t41swaXEZv7Yevdnqe2 joWIrHHdk2IX4kzx4IMP5oXojjvuePXVV0e01oim8IGRXqIvVOwhriD7HkUny0bFLIxjX1axB/Fv /fH+Ja+ciw8Kpr/xdB9DgghwnssXxxufVVQv2AIguLf4Almr2HjQ4cUvmPtWNPpnMI5drBscX44O hsmLDNMNrNn+3JPNhKdmRfcFzVCYmO15ysg6ZBljmzPODSXFLsSZwqZ8VuyjF4EeCddQ7Aj49IUZ pcArQVuKfhqK3UeGDN2KHUq1ttsyS2QaG/7tTm0P42UWLUS2FKNh208PqYV0149Q7BTqUuxCnCna 55K1idmep1jlQkL6uGh/KXYhzhTFwJhxITFDhzCzxcqHuFDkmLTzt7wLPcQEhsBg0U/D+jADdOHv 6I0R4liKDfJn8oHxCxU7hTqlu+9eCFZpJLX5ByFfNYSatxV7cAyiivWhtltkBAsHc62fyyr2xhmE EGLdLFTsyLfFxLQPWKPwp91ClpatP35JQbaXn9pt50MDKXYhzhohMGZ0SMzQIcyQA8hzRoocnqIy nqG4fJnsQYGtjo08LWrWhzHhNCKdin0opU8OcyuGn6lnC1BsPwjjfNRC+ZrzthB27keIV9ptxY49 SAgr9dmm2Rvmjyc4mHM/89trK3Zlngpx6ixU7FhbQmQ7zZm/VQtWt9VyKR+7WedrxzzyyCNmvvnn yy+/rJ9MiN0mBMassmf3/vMA16tiVAz87bhS9NzaXUY4KPN0HMWYTL5V7wXqV+yHh4f8US7NManM YdCzBQhAl9Y81TaKEDPT2LgxTNQ6Y08Mu7y2YmdX8SAjRJnyHaJxuNeo55mnVutnv2KH1EdTDHaV YhfiVNbMSyUQ8gfbBBOGdAAugEjpgkULieTD3NJxtVwqM+uee+4pZsJev35dP5kQu00IjBkdEjOs oNiL7lPfsq11XmEq83QE1JMeCHgT3vl37FHsw1y0B28SdKb3fvcrdvuhg9rnqAhPaYwBM5Q+gt07 uBYqdoy0xnehSucLZLgOB7Mv4PvZr9iHuRLwKbT2lKmiYnBYX8N3mF8cr2XhvGPLPts3jBa/Pc9H JBOyN6e2Uo0IQhBaMz0cxsWTR+8D8ed04WLRQdHm0UcfzZ0xGa/fS4izAANjVgmJGVbOPPXt1JQJ ne0j8nTOOLPZ7Eai9pKXvQWHMyI5gyup3eCyT8dT8iMCJgXNYubCeAlwjjWe2H4QGy9GvNv/VqBY 3T8oP9T3zSpCzdoHFJsw57qtQ7h9hgOQvV14vAUFwrimnBGAqU0V7dtfB41lBNuuhaNInHF6fOxD JfM0bPOzmcPUxh52KdF+/fr1PG1Nxuv3EuIswMCYFdNYTkCxD8eBE3KRiU2jOJjHAUe9V7xMgJ2q n/aIGyWoY/00XKjY2SaEim2oa7qFe+11J9K22/d7ByHao3qpkbbw+CyA2MKl5kIOjFFIjBBnBAbG rBISM6xBse/v79tqGQ4TkVooxS42jQkVOxNabbT7OPZJjpZG6JCg2PMczydfORIAIVjF9j3jXN/F Li3c+OuoTkw7U4ZFit0GavHsaSnFHgJjFBIjxJniwQcfXDEkZlhGsfMEsK3Yi1moOUpQiE0AsRZT 7SV9wHwx3WCVlts6xCd6wxdNxe4zi+061bV9COo3KHY8FH/m9jnrIaTxGu26D3rnO0F5NNLoUlBB 1jJ2QPgTGcrezc78QY1k0TlTiiOtrdjz2ROTd/o7FgJjFBIjxJni5z//+YohMcOxlq5ltMFYQ4TD Is9ms4VRMUw1NUtqRhYyYOESKsRugEiVaTM0F+oQn36LNFIodl5hdm0tsIQBwOw5ykNO5/ZZgJHw nOxBsbPntS7xe/llBBuBkDlbTBiUYhd5vN2o4EdOI9zLmzmcl3EomhHEOF+Y1h3wgTEKiRHi7GDz /b777nvzm9/81FNPrdIObW4RrFdmwVnM1PtCxW6rIo07UPSpEKvAzNNzJbwOCVEx3mcOF3d2DMIx jsb9oUAuXBTMXrd0KnYet2Ft4TaB7UOu5x1KaH+p/GhxpmZKEY5e5lxjjLUVu21XOUHyNrMfBsYo JEaIM8LLL7/82c9+1q9C999//+gN+40ms9kMxcye8orhb/l2/JVr165dmjMuxlUIQUYr9iy5s1Pa 5DE83iiPu8XE1WIsgT9N6FHsjS6hwWJkHYC3UxkxooYNnvN16DuCW4lX9ubkdrjbtUGOGC0wbgQy MEYhMULsPK+++upjjz2GhNPXv/71X/nKV2zduPPOO7EImIw3Ma+3JMTusXrmKciK2uM92/2Kvd1+ VuyNLvkjv+KXnTBTWIiTB4ExCokRYrd56qmn7rrrLtiyT3ziE88999z/m/Piiy+adDcBb9dNzJuk XzEXdedBKH6DYi2EA4WThcyVK1faJwt7e3snozdwxhFSCwEyBDUStoiTUeyMURlOVbHD519U5lLs Yqt59NFHFRIjxA5j+/H7778fWv3ee+/9xS9+8d+J559/3mQ8ypiwXzG4fbfx6W+NQEeT3CZrqT3a UmcoRe/nvKT9/X0fRWAF1qc9GtoGwkyyZ4uYXLHbGEBUQK2F01Lshu2LETkcQm4wg6TYxfbyq1/9 6sKFC3oPQuwePmT9zjvvNDv1301MzJukXz24fbdhMG3bxx60x0LFjgImwq3MtWvXspMQOpkyft3e wnb7iMkMckhsLOvwscOh7VNNfQC597cX2x9Kih1x5oz+5ZWlFDuuQ5yHwyAUZuKqENvCK6+88s1v flPWWYjdI4Ssf/WrX/3nP//5nz4ef/xxBbc3KKa/ZZZS7CbRQ5v5CoKEGS1zuood3cunAGIzwa9p w6mdT8eoEtPMC+Ux2zQBbFeY3EoNn73cvv2hpNih+ZE9as1Cro9T7Lzl9X/oUki8FWIzuXz58h13 3EHnm6yzEDuDD1l/8MEH//rXv/5nSUzem8iH4Fdwe6BHsZvSgDihHIJ4MKEL77Rh1xklbjrcBI+X FuEp8FhSq6ARajCrbnXtAyLM4Yq3i3YliGq7i/L4jLgdVEEtipms2FGX8iaIH3RAGn4zoZxuh3LB L40rPXHsCNPy7Xj3NfaY/opvfygpdj6CxVBlnGLnthej1IZ9qI7OS7GLjeXpp59+17vehenwwAMP /P73v3/xxRfNOiv1TIhtJ4es/2cFTOqb4Fdwe6BHsVPGUEJAV1Bm80MtsARqh87PEH/LHQGdhHR4 thWXlyi+BXaJ5YNiz+EE6BJ3GZ1xF+JUmM1mN5r44c0r9n/IgLY/g761AYys6hxqAoUc4lJC+0W1 jKxnaxazw3ej3aXcIK4g4xsj1vez1gEhTp1///vftL933333z372s5B6JussxJYSQtYff/zx/5mI X/7yl+95z3sUPkeYeVoMMKCCLUbFmCqGX90kRI5UH+byw64H8TzUM/JYnU5UxDPYUzoVuxWALoIb HwcBoX083QSPbwoOTOoxqixNRkGwtdyQfAd/SiXExuJD1t/0pjc98sgjL730klLPhNgBfMi6/f+1 r33tX//617Ky3Gb6L4+5cuXKfzmefPJJK6DgdkLFXqSdeepFr0/T8417Dzz9gTkkuKjYvT+zU7H7 XQDChv8/+2YCHUWVtuGeQzAJ0N0BlUUdgqMkOQMCyvoLCu6I/GyCAecoBEGWYQkSCIiIghABMWcA WUaUJSCKSwyoUUFZXFBUQEVCWBLWJBBDBhMMEOjzv5Pvzz2X2rq6u3pJ8j2nT06nu+rWreqqus+9 9V4qU5RPo/3quIvJPD9Tk0EPVJ4uHURwKSnmyTJMCCJH1p944gncZo+5A3dp0ToPGTKEw+0ME5oo IusQb4WKHz58eMqUKeTeT/bv37lFC/GSPTO6bt27HQ56PehwzLDZ0MOP+stfmtavD4enotARQHeA w+3CVDXTBfT83aVj7CK47tIxagEJhphqqk78ahq7PGJvxtgNypRjNviriCKI0tjYGWNwIoXCMDtP smBCHDmyfuedd+Jfj6aeidYZwp+SksLhdoYJHeTIesuWLd99992TWqxYsaI17Npmw2spjFF6ufRf S8LCYurXf3bChCNHjigKxHZFfK5Zs2bp6ek17cibHFvWNHZFYNg4+C2PeAfL2GncXq+ebOyMyUtG 9GSDWAf+IZjQRBFZf/31172berZ169Z77rmnJrfODBNqKCLr6E2f1Gfq1KlTatVyGfq5/ILJt3I4 nuzbd8+ePQbFooMgJjl269YNC9ec4+8PY09LS0tKSlI8spf9OVjGTsOSVHl1Rp2NnWEYxmuKi4un TJlCY+NOpxPvDx06dNw31qxZc+utt9bM1plhQgdFZH3MmDHom58y5OE770w35+q5Nlsvu71zixaf f/75KXO88MILuMnQnWHkyJE1JD7nD2NXp9BdV3symbYcTTFp7HI9xdxS88ZO72mSqSLbwDl2hmEY r1m6dKkItT722GO7d+8+YR1QhRrYOjNMiKCIrH/33XdmpLp548ZZ7ly92GZLrlMn5vrr33jjjVMe gi7D8OHDqVY1JD4nTHW2DhQAIN9+6qmnSI+NjV24tBjHpvmewocpmiLH4MmosTqVqTZ2V6XnU5lY l+rghbGDpKQkRZ+CkvbiE2yFo8IMwzBuwd24TZs2dDdu27ZtRkaGsX4fPnx4g8ScOXMmVDL8ySfl 6WnOigG9x/r0oalnw4YNq1GtM8MEnT179siR9ffee8+kTufk5ESYiMSstNnCw8LWrl17ylu2b99e c+JzZNoGkA/DYOlfGpp2m2OHAItpnuKNWJ5KgzaL1bOzs8UWsa6msZNmyxNIvRtjJxTZGOpTYNPy ugaxfIYxeX0p0Jz1jH6x8VeayXl8Tt1qufMrr2Vm0wzjNbm5uX369BGh1tdee00dOkWLf2+7dg3t dnGHRzt+t8MhXiMiI2luGl6p0ty0KTZbo8jIsQkJ+/fvF6Vt27aNw+0MEwDy8/NHjhwpru6XX345 zxM2b97cyuEwE4nZY7Pd7XT26Nz5+++/z/OWdevW1YRwO1r22YYIVYDcik/ovWwRVI4cDscxhGN3 qcBMaDwjI0PoB9D0EBh13759USBKRvlyNWhdeWG5EHWB9IlYRVEf+lZdbYbxCHEPkcGHisc3Bj1E zd4r/lWUjH/l01VMtVZvWlGUenP+E3u/Fs4EEjmyHh4e/swzzxw5ckRzmtiKFSu61q2bb3r2GV5Z NtuDDse9d9yxc+dOzTLXrl1bY6eeMYy/KSsrS0lJiYqKokts+PDhBw4c8FShly5dGl+vnmZkHZ8v CQtTfJ5us8U4nWOHDvViW4IXX3yR43P+gMa01U4eFCjZbmwyDOMF5BVdJIRpyH7ukbGLjBl6r9Tr pJiZeiYIltHctN6pTuXIz84sxK+FM4FEjqz37t0bwnxSn6lTp04x8XBchFrHR0Y2b9QITn7SHTVz 6hnD+JX09PRmzZrRZXXvvffu2LHDO3keO2pUik5kHTeQwf36tXI4tl69QJnNNic8PObaa+e+9JLX 0g7hr2nh9gBAWXfF7NRggWrwnFPGH8jBLQF6iPS5GGk3b+xCxRVl0kQMMZ9ar0CKlumd7eq0m4X4 tXAmMCgi65s2bXKbMu1z333rzen6krCwpg7Hi889x1PPGCbwoOvdrVs38TT2rbfeyveBHp07p199 dcfUrz9t4sSjR4/SAlu2bOncokV8vXqKB3D4d0S9erc1bfr+++97vfWvvvoK3Q2Oz1kIpdmDPsxO A+wZGRn8izCWo2ns4qxzK9gulbFTgWLChQx1POWJG5oF6lVJJG1g9VQIpc6ys7OfqgB1Vsfh1Pkx vBfRNXF1qwtnqhaKyPqSJUtMSnXzxo2zTARZWzkcg/v1g4Hz1DOGCTByZN3pdM6cOTPfZ8SFv7Xy 6v7555/Viy1durRpVNTz4eFlOuF2zbVMgk4Hx+csBI170FUZFeC8OuMn9PTYdfXcZ5PGLjxfc1sQ afJ/l1fGLgfjaRNUQ/E5ebhiXcWGxCqKBI66cKaqIEfW8feZZ57Jyckx6dJYMsJEJEYYO5rUU97C 4XaG8RRFZP3pp5/Ozs4u8Jljx47hws+12Xo7HF1attyyZYvxwkljxkTb7eqHcek2Gz7Ht1jG68qg A8LxOYZh3GJg7JTrlofEFbFzOXzuduRcgd6SIgOvXgWVJN9OS0ujCtO/YmAcfVtjY6f32AR1HFCO mNCtLpypEsiR9T59+uzdu9ejTOnmzZuh4i7TqZj/Pjd/5pnc3FxLpp4lJiaiu8E/IsNoooisf/31 1wUWAUWHscdcf/3KlStNrvLLL7/0vf/+jg7HTlW4fUZ4eNOoqGXLlnldH3RD0BmR43P86zMMo8DA 2NWua4B3xq4381TvoZJCyOlf6LreAooqUR9ELpwmxlKKhnPsVQt1ZN0Lf4bwx9erpynnjSIj73Y6 9+jMTXvzzTetmnqWmprKvybDyKgj6wWW8sMPP8ydO9eLgfGPP/643a23aobb8SG+wgJe1wpdEhFu j4uLy8zM5DOBYRiBgbHTcDf5sPDeH1XQXFHvjF0BCbxBDk3T2OXKGxs7zX6lDckhdr11mdBEEVmH dXudIx07alTK1S2vHGp9//33b2vadISqdc612XrZ7Z1btNiyZYvXm8a6d955J7fODCOjiKzPmjXr dOixfPnyplFRM1Th9p02W0eHo+/99//6669eF75+/fqmTZvSEejevXtWVhafFVWRvLw86ER2djYf CsYq3ObY3aq4nGMnJTbIgYuzV7MLIFLuevho7C5phqms7nrrMqGGIrI+ceLEo0eP+jL7rEfnzunu PHzu7Nkx1147R9U6G09YM8nKlSu5dWYYlyqyPmLEiIMHD4agrhPHjx+fNHasZrh9fUW4Hd9iGa8L nzZtGsfn/ArJgAJogMjNCugrTTcQwVrNkoVmkCAp1lJvWrGYAtRKMcxoLUGftMu4xcDY5a9MGjvO KDr3NN2bRuP79u3r8mQ0XsZ3Yydw2qMyIgZPORk29hBHEVn3xZMFzRs3zpKyLvBnzcXQ0xw3dGiM 05muF273oe+AFZ999llunZmajBxZv++++7755pszOhw6dChdYtasWZMqGfLYY11athSviLAwMTjT +X/+54wf2LdvXz/DcPvy5ct9KXzIkCEcn/MT4kG/rM3iE9kEjDVJYewkEnLil8qUJYQKVBi7ejEZ 6LTa/K2CzM1TH2MCj96pSJEYeWjajLG7KrPiWF2xWElJCW0rLS3N5Wdjl/uh1E0QaXy8kXsTcieC jT1kkSPr7dq18yUpKnPs2LGIWrWEcrsNtf7www89Onc2CLebn8WmOa9t8ODB3DozNQ1FZP3tt9/W tPSm1133/1GZa67p6nSKV2J4+AzoccVracWTL/Eqk4a7T5w4ccZvZGZmtm/efLDDoYjPpVdU+Msv v/SlcKzeuXNnjs9Zjt5onlBu8aF5Y6d1FZqBMqkEoUmaBUKNZEfSrK2fjB018cLHmMAjzhARTcHZ RdYNxFMS88aenZ1NZcqPlsRVYKYLYIAc1HFpOTYZuOgviCtFnnkq9yaoY0IFKgpnQgFFZH3ZsmUW zj7bsmULih3y6KOwZfNrffDBB3rh9t4OR5eWLVGsL1Xi1pmpIagj6wZK3NHhUM8QN3hRpLzf/ffv 27fvTEBY9Oqr/43PRUSUVUxEhcBD41FzSwpfvXo1x+esxUBCFDJg0thFKrikpESxmCIwbDxSSkOI MtAqchv8pbWwCbzBX0jO4sWLybXUsXmSOvkTLI/9wipiSRRC1aOUsrryTOggh7oVk0Dljp55Y3dJ XUX14x5x8nhn7HTSijNfbew4G+XnXPRGbEj0JugBkHhPp6iicCa4lJWVyZF1/Dpeh0IN+Prrr71b cf6cOaJ1VoTbWzsc6AX4MvVs1apV3Doz1fvqliPr8PbDhw8X6jN//vwRkZEmXR22HG+3ky0XBhbs ReKwYbFOJ24OEHhrCz958uRzzz3H8TmrMJAQk4LtutrYSUjEzDj15kQJegXqVUlEawisKJaUYzzq deUN4a/C9+SIsoAHLUMZ/GRdrgafiC6bAJ/QjAx1CfQVRcEFWB0LG0ypMCjQZIWh31id3sgLZGRk kI0DLICzVN4QFkYJomKKOSZy4XxuBJH169eLyDp+FF/s138cPHhw/FNPxeqH25+bOJGnnjGMAkVk /dtvv3UrqyMTElJNuDqlx6Pr1//3v/9dGDx2795t3AHxhd9++43D7ZZgYOxkvwpjh4rPViEbOy1m ZnKonrHrOT98iRIC+IuNlpSUyCF80ja3xi72Av+KYVWUTNP6xAxZv05uZRimOrFz585OnTrRvahl y5affPKJL1KN1cUMteXLl8+aNctyb8fdzyjc3rDhqlWrvC4cXRUOtzPVBkVk/Z133jGpqfe1a5fp TtezbLZGkZGTx407efJkYXVHBE05Puc1xg/6SWhp7E4viqB4KG8wFK9ZuNwFwHvx0F8xXirXVox8 0r9yHsDY2LEjim/pFKLBTM6xMwzjEfn5+QMHDqR7YKNGjebPn68Oc37zzTdw79WrV0+SeAQ3mpYt 6RVTOTJPdHQ4aHpa42uuwb/97r3XTxPQUCvjcPtPP/3EU8+YGktxcXFiYqKIrL/00ku/e0Ijuz3f xAD7ePSRGzdGR+D3msGaNWs4Puc1bo1dyLNHY+zmjV0NKqM3xK1p7PJovMkxdkpEqOPubOwMw5ih rKxsxowZIrI+bty4Q4cOqcUVHzojIqDfcOAZNpt4pVekx+mVpRVqHVy3LnQaUu3vqWfqcLsYaYd1 89QzpmaSmpoqR9aPHDnikZdieWd4uF5kvVg10v6Q03l/u3Y7d+6sCdJ+6tSp6dOnc3zOCzxNxbjN sXuailF0AYxVX9PY5bCxW2MXSRjxaECkhdnYGYYxgxxZ79Gjh8FYdGZmZkeHw+TsMxFqbRoVtXDh wjOBAt2K8RVTz9JFmj0pyaqBfZQjpp6hazNlyhRunZlQBtdsXFycGD/ctm1bked89tlnHZ1Ovch6 tNP5aliY4ttMmy3Wbh/15JM5OTlFNQD03xMSEkR8bunSpXzuucXA2BcvXix/ZdLYKWquN/OUAudy zMbMaLyitr4Yu9g1msonrkoXGzvDMO6QI+u33Xbbhx9+aBzdnD9//ojISJO6vt5mi7bbgxVq3b17 9yNduiT07//bb7/5Y+rZoEGD6Lihs8OtMxOCwCG7d+9OZ2nTpk3T0tK81tFXXnlFceGjO4xOcfL4 8Xl5eXBymDn8XB10h8nD52e/+KK1eoweBPYuBL0dHSIRbm/Tpg1PITTGwNjpMAofNmnsOMlp7Lqk pESxmPjKbYHGtfXa2FEluHpGRob4CqeHSP6wsTMMo4c6sm7GVEcmJKSacPWdFfH1fvff7w9bDh0y MzPbtWvHrTMTaigi69OnT4cS+CKio4YOFRf+Hputq9OJ7vCePXvkZb777rv727Xr7XDkqiaAU7h9 w4YNvisxNvroAw90dDqj7XbqL4Sgt7/++uu4qdLx79OnT25uLp+Tmmgau5jSK0/qNGnsrkrVx195 9ii5sckugHFtRY5FbezYIlVG9BfoSQFtSJHzAVhMVF79LcMwjCKyPn78ePOhVrTIme50PbfiBuXp vLaqC7fOTEghR9YTEhIOHDhw1mfax8TsrIisj6hXr1V09MaNG/WWTEtLi2nYMLlOHe1we/v2e/fu 9a4OuLImPP10rNO5/upMzooVK86GHvn5+cnJyeI2y/E5TUh6yVQF4hNZp80be3Z2Ni1MGRhCzp+4 LVAPGqWncrAVtbG7KvsLKDwpKUlsV2xI9CYoNk//UheAbF/MS+Vzg2EYRWR99+7dHtlpI7s93+QY u9PZ74EH9u/fX0Omnk2ePJlbZya4KCLr27dvt8o/nTirw8Njr7vu1blzzcjqjMmTYxs0WKIZbnc6 Id7Qb0/rMGro0GbXXJOrmvcab7ejQ/H555+HoLeju9SvXz+Oz+kBa22uAqcudFceIXdVarkZY3dV 2C80WDHHU6HWBgUagLrRiqTc6mJRoBB18naKrIsNyQl2eeYpoDoDLMPnRsiCXwc/seYj9b4V0Ht0 u7qowPmAfp9mgeolq+JTe5zDYqqIP1DcFqpQ4Z6iiKxnZGR46qVHjhxxhofrRdbT9XPsENqa4O3o nnDrzAQFdWTdQu2EXUfUru2pZkNWhw4Y0Nrh2KqarzonIsKk/CvAKlgRq5dpDRE8+sADljxQsBz0 Jtq3b8/xucBDWRT/+YMe2KJxX4Aqxj9QVUQ8CtH8SnQexfMjNZozHTSRO3RVAuqu+uncpq6Nn2ru 18I9QhFZf+WVV7ye7YVm0aXTVj7SpUtXp3OPqnWmJ9evv/56CMZN/QGOEofbmUCSmZkpIuszZswo KCgotpqjR496t+KOHTvuuu02dbhdBGw2bdrkaU3Qd2hdv36mzhDBlMREfxwB33njjTdEfA4/E5+3 DFMVEYKdlJSk/kph7JDAHyWwilr46ZO0tDR5Sbg6baVqKcTixYux4+p5377j16nZITLvWxFZT0xM zMnJ8dpFofojIiOVz6ObN4ej0gIbN25EE4yGOF/ryTUa7m3btlklxnl5ecnjx89+8cXQ9HYOtzMB Ax1DnGY33ngj7u0haKpg7dq1sVrhdprE2vOuu37++WePCty1a9cD7ds/5HRm6QwRYIsheBxOnz6d nJyMH6tZs2Z83jJMVUQeElfotKaxK1aHHApFlwtUj0v37dvX7TC724c1Bt9CotyuaxwUcbuAyW2Z KcdAqj0d0lc/dwsFY5cj64888siePXt8tNBRQ4emmhg5X/DyyzFaT6632mytHY6E/v2zsrJ892Fs HXUYX6dOTOPGGzZsCEFpxxnI4XYmAJCxDxs2LDo6etKkScePH/9P6FFQUPBCcnJsgwZLa9dWjI2n V4bbjx075lGZ7733XkyTJomqjkC+zdbb4bjrttu++uorT+v50UcfDR00yB9HoLy8vLS09OOPP2Zj Z5iqC2k5jYGr8y1ujV39lZ6xG5QAxHC9YkIE9QgoCS+mYEP+ZUdFR4NmZGh+C3URsy2oqIyMDPXu a64uz9qgiR5iKod64oZYRmyIilXMDZEXE3NSxG6Kud7YKfWUFtq0KFAxi4Q+Vxce4DNKEVnfuHGj JWnM9jExOysfPSePH5+fn28QfEX7i1ZYHW5fEhaGVnvG5MkGqxuwfft2VCNemgCbZbM95HTe3779 999/z1PPmBoIGfu//vWvL774YuTIkfD2hQsXhqC0A9zYn3rsMfTcd+qE29976y1Py0yZOTPa6UxV zXKlIQJsDhs1Wbf+Dz4YGxmJXoC1e11WVvbHH38cOnToww8/fO2119jYGabqQlpYUlJCrihnY0wa O43oiiW9GGPHRsXUZmHmVBMqXATmhZmLmsBs6VuUj0oK46UKYL/E8viW6qB+IiBWpwVE4XKOXST5 hVrL9VTshTxVXO3MNI1XFIV/5d0Uh11t7LQWFUjvab/E5tAZURcesHNJEVlfsGCBhfLpRJNat675 6V179+7teddd6nB7sc2WXKdOTMOGXsyPe23+fAj/ElXrnGmzxdrtowYP9mhyHE89Y6oBwti/+uqr r7/+Gj30Pn36tG7dOjMzMzS9HfXscHW/u7gy1u7FqDg4duzY6MGDcQdQh9uX1q6NO8YLyckFBQUG 4/9TEhOj7fb1FQP+uGtZtaelpaX4gVA+7gDvvffeu+++y8bOMFUaoYVCfUWDbtLYxZIUBVHn2FGg cY5dXt1VMSouNi1UVji2+JaWJzuVvVR+XkDv5W4CyiGblWsrL0DSLluxbOyiLyAXJddKfCvyQpqj 3IrgimI3KTlvYOzyIRKVoQcErmCkYhSR9QkTJng9WUyPx/v337x5s6drbdq0STPcnlv55HrHjh0e FZidnT10wIDWDsdWVev8alhYtNOZMnNmaKZ55alncCp0r/jux/iOwtjBN998s3r16jvuuKN3796/ /fbbuZDkzTffpGxbasVlmzpvno8F/vDDD5rhdnQHptStG9uw4bp16wyqQSm+FJttwrhxvu8dWpDL ly/j77fffvvBBx+8//77bOwMUw2QxY9GieV8i3ljx7cUJpGD8TIGCQ0SUWiz2ucVA/jy5ii/rf7W JXUB5IopNkdurOgsuCp7LrSnamOXj4Cszegy0EC9vCFZ/jX3S2Hs6t00GGMXI/yKvXMFw9jnz59P v3LPnj09ncYVAF6dOzdWP9wOA8cx9KhAeD5sH86fq2qd/xtub9IE7WMISntBQUFycjJ1rDp16sR3 P8Z3NI0dorhz5865c+dCDidNmnTixIkQlPbTp09PnTBh9JAhx48ft6pMuHGsVrhdDBHg+NCSeIN/ 5aF+vPAvHN7HOpSXl58/f37fvn0ZGRkffvghGzvDVBsUWihnY3xJxXS5GhoW1qsDbixy9FrOcmjK pxBpPTUVC6il11XZMRHeq1hA9nC1sSv0Wyyp+a3mh5r7pbkjxsZOeyEOGnoH4jFE4I29f//+2GJU VBRqdezYsRCU1aNHj1K4PVMv3F7x5NqjMteuXRvbsGGyqnWmcPsD7dvv2rUr1I7DhQsXYFPcajNW YWDs3333HT4cPXo0TraFCxeG5mC7P0iZNcs43E5xevVzOnwolN4LcHWXlpbm5OR8+umnGzduZGM3 hhKkmkld+kp4CJpXhdJQjFZhNbSWeslAZlOtIjs7W+/gWIKBEDIGKLRQzsaYNHY5HOLSz7G7/fko jC3UnbblD2OXRbrqGjv9WPLkUxHvCZaxT5o0acSIEaE89eyXX35x++TaowIh+S8kJ0P4l9aurRlu Hz14MLowHhU4JTGxUYMGlu/7n3/+iV/q+PHjK1as4FabsQpjY/++Agjko48+iiXx5o+awYkTJ/45 ZIimluNeob5d0CsiLOzMmTNebI6u7sLCwu3bt3/00UebNm1iY3eLmJumNmpF222QHBADZXKBmkuq n4aHMn61CJqu6KeaU0LYUwWtKqi1UMygNGnsiimlXhg7JFmczHhPB5x6DWaMXTMVQ2EYdejFdXX0 Xb378hbNGzulYhQdUkrR+8nYsXdiv/BexOxdwTP2qVOnotUO/alnaLxidJ5cN65dG8LsaYE4/nqD ZqmV4XYz5bzxxhvR9esPueYaVM/C/UWDfuXKlaKioi+//JJbbcZazBj7DxW89dZbbdu2pXB7DfF2 ir6o43Oaryz08Zs08XQTpaWlly9fxl/c9nHL/eSTT9jYTSIEWy0JmsYuz87DezIfgOMsr4WW90cJ 4TOK0GyIU1JSgt3x09MBzaFUq5C1rfqheehol2UZ1jN2klL5hPfC2KkONN1SrgBdIAbGLjYnB+Dl MX91klwRbqf36omrlAsyb+yWzDxVG7scwsfxEQXKYXtFZVCT4Bo7tdqrVq264447evXqtW/fvtD0 dli0/OTauyFxGey7Xrg9sTLcrrfu5s2bO8TEUKg13WbredddVu0mWvPz58/v2rWLW23GH5g3dtyX fvrppwULFlC4/dSpUyU1A9wYI2rVyndn7Ljw//fuuz0quby8vKys7MCBA5999tmnn37Kxu4RYphL rdOaxq62GrIF0dTqaRK11+p+gQwaemNryq5A71us60vhNCvQ5HEz2JZxJQV6xu7pYwjN/aqBxi6y MQpjp5C5QDwqkh8MeWHs5NUokAbVxbb05FMt0jStldaVJVzsCK4s6u2KWa5ybcXqig6IeWN3Sc8m kioQCR9NY6c5s9Q10HuUIA4Lqk0BOVpFnnlK+yVqTiUoCg/AWaQ2dmq1586dGx0dHbJTz44fPz56 yBCIOsXOIRW+l7lu3brYhg2n1K2rF25XbOXgwYP9H3ywo9O5s3LJFJttwrhxvtfk4sWLcHW05mi7 udVm/ISnxr579258Mm7cuJtvvnnRokXV29UPHz48LD5e8+mb+jUjLGzqpEkmS6arG3ewbdu2ff75 52zsXkBtOsVxFQN3Jo3ddfWYoUEUwaAEMQgvpqQJcaXUq9z6k6uIdSEqIhlLeiYG/AmsKxcuxwBo RXIVEUUWq9OQo+jIkM+I0tTbwnu5klSs+rGCGMkUOysKF/aFHaS6yYeL1E4UqHfQ5A/9N4wfRPT2 S/infAKro1nqM8S7HLv4rRXxMLfGLn5KeV350pOntYpzSbH78tbl88QjY3dVprPEyW+QipF3GSeb 5m5SqkeumFygfOaLLYorXS48AGeRnrGj1d6xY0eITz2DS6BFs7DA06dPvzBlilG4fcgQNLVYbOqE CdF2+/qrl4m32998801fKkCh1lOnTqEd51ab8SteGPuePXv27t27ZcuWAQMGULjdH7Z88uTJfyYk RISFPfvMM4WFhQF2dWzxxalTNW8Ceq/eDsf69evdlkxXd1FREQ7vF198gcPIxu4dok2nUKs8Bm7e 2OWoqhdj7PiNROOO1ak0UYLswDRMKudwxGN3fE6WqxhBFeOZKFzIibpwWl0IM1mEwklkExajtWKP aC+o+6OwIMX+0oRW2ZFcKs3G4VKPk8vH1uCgif4LzfmtfictjdC6/Qrnxo8qPC3QbU1mVyCP2Lu0 nteoH4VQ+l29rnzJ0IWpuGSEcmuuLm+IjoAc3VHsrPyGKiyyPcYHX1wgmo+E5Iqp60D7RTkZg8L9 jYGxU6uNdqRfv341aurZoUOHhhmG26Pr158RHl6m+har4AB6t9HS0tIrV65A2nH8udVmAoDXxg5+ /vnnDRs2tG/fvnfv3vv37y+1jrkvvUSZN1xfuMpwra1atao0UEC8Yxs1Uj9oM36hL4+DY1AsXB1X 9/nz53/55Rfc8L/88ks2dl+QtZx0VzieeWOnsU0yT80cuxiX1hRI8mRZEsiHZYXAX9Ho0/K0Ofm9 sAUh0uqkriiQVlH0DkT9qZ6axi5vS2T7XVfPDZQ3pBfNVQx1qgs3NnYzB626pmJqOFY9OlEPkov+ b9WaIe4dbo0d7Nq1a926dTT17PDhwzV86hmacr1ca0RY2JkzZ7zYVnl5OZr1ffv2odX++OOPudVm AoCPxg75/PXXX7H6zTffPHnyZGiGj7Z86tSp2L/+dWBEhGzL+RWPrjrExMBy/erq2PG7W7XSm2qa ZbNtrXxloishvVC9iNq1DUrG1Q1jz83NxXHetm0bG7vvyFouJriRdpo3dtlyNaMIYjxZM/tNwk/Z V/pEPaFPfkxPTk6moSkYYpyQHhwouglitN+lM6IojEjT2OUjIJ74UwpX4VG0dfPGrngAYWzsZg4a G3u1xMKwE50nuEBwaokHQ9XyuYwak8ZOrfaCBQtuuOGG5557zjsvrYq89dZbFG53O86GNj22SRNP y7948SLa9JycHDTf1GqzsTOBwRJjRzcTn0+YMOFvf/vbokWLzvvGqlWrNB9g7bTZOjqdAx56CFfK easpKioaFh//3ysrLKyr0ylesrbh0obP0+vBDh2elUCdcVg0S7506RKu7vz8fNxCcZC3b9/Oxm4J Ci2XszG+pGIU0/1gtgbP2UVPQawIeRDuqpZPWaQ17YVslp68a4ZyxVqaZiv2VG3sim2J8jUzvZof quugV7ixsXt60Jhqg4XGjp6myFCpZ3lUbzwydrTa+HDEiBHw9jVr1lTvqWci1PrPhIRYuz3fnbGn 22z/e/fd5ksuKyvD8UffB0debrXZ2JnAYJWx/1bBjh07Bg4ciDJhoT7687SJE6MdjvWqSwyf4HN8 i2WsNfaZM2fCvZcvX/6phC9l0tV97tw5HCgcVRxbNnYLUTutyMZ4OvOUnNxg5qnbmohwuBwm98LY Rc2rsbF7etAYRg909LxO8lddPDV2arXR1nTv3r1jx45ogPwqzGbmc/mPlStXRtevPyciosxEljXF Zntm/HgzxaJBv3LlCt7gYKpbbTZ2JjBYa+z79+/PyspKT0/v0KFDfHx8bm6uL8abk5Mz4KGHOjqd O6++yuRw+/mQBK6Oqxt/Dx48iMOI48nGbjlqpxWDt4o4ip6xK6aUemfscrFi0mVSUpLLnLErwjYi Uk6VUQwb0uqysStmwBmkYvSMXTMVI6d31Phu7B4dNIZhZLwzdmq1cWm3atUKrTOaV8tjpWj6Y5s0 6e1w4C/elwYWNKkdYmLiTQytixcWNjNF7vLly2jWcavUa7XZ2JnA4A9jP3DgAM7t1NTUG2+8cfr0 6WfPnv3TB+C3HWNjhzidissQ/w602/EVFvCiWPQmUNU//QCubrj6iRMncMRw9NjY/YTmKDRlYwhj Y8dPoJgy6YWxk17il1LUSp4cqmfs9ERAs8eRXQGJtJzxpvA5hXXlWaiErNnmjd2lFYn3dOaponDa NXkqK31CBZo5aIqeCMMwAl+MnVrtefPmUev8+++/W2LL2MQDHTo85HRmVebD8R6f4PMAuPqRI0ee 6NVLPbjn9tXa4cBxMyj50qVLaNOPHz+Og2zQarOxM4HBf8Z+8OBBfD5u3LibbroJMuCjBi9fvDj2 uuvUj7pEuB0GbrIo9CCmTZwYUavWmOHDrXV1uroLCwtxZHDEcM9kY/cferkRkkO1sXe5GjGlVFGg R8Yuou84w3GB4C9ti3TU2NhphJ9MldZVSLiwXCqcdF2RHhGroybypj0ydqwiipLDKgbGTguTk6sL F3MK8AaVF78IFWh80MReq39ZhmFcVhg7Wm18Pnr0aHj7mjVrfBRmaH+jBg361Kql8OFMmy3Wbh+T kHDq1Ck/uTo2PXPq1NgGDVbWrk3P37dKr6U224zK15SrZ6hFhYfjGEY3bKjXZ7lw4QIONb7FYXTb arOxM4HBr8Z+6NChw4cPo6iePXt26tRpx44dvvhwfn5+0qhRsVFR6Vrhdlyzs5591u14/sIFC2ha 65DIyIULF1rl6nR1l5SUYN9xiHCs2Nj9jZ6xi5FqhbErUE9V8y4VQyItF0vpDpc7Y3dVqLJcN3ld zcKxohh8FsPg8upinNwjY3dVjM/LkXLjQ0HTY0WWRjOQr6gYrSIKNDhoovtAzxr4PGcYBZYYO7Xa aI969OiB1hlvfAmC4q47ZujQOLs9U9U6p4aFRTudc2fPtjx9WlRUFNusmXwniQgLu7tVK/Ea9o9/ PFvJzJkz5RlqqLBxqBXSjkNkstVmY2cCQwCMHRw5cgQn8O233x4fH3/s2LEyH0Dhvbp27RoVtefq 20IxOtF168Y2arRhwwbNFXF9tW7WbGRlyK2T04nLsMxn4Oq4uvE3NzcXxwQHh409MKB/hOMsh0YE OP3kr35UoamCVKAXlohVKHmOv3IunaqhWFi9CZwM6nXVhSuCIqI7oLe6vCH17Dz56ImvxGKaKXpF 4WJhval/ioopdlzvoInjxlF2htHEQmOnVvvtt99u3bq171PPsJUHO3To7XDkqlrnxDp1Yps0QYtm rbRjl1F/CwukUGtOTg5KNt9qs7EzgSFgxo5LAHeDRYsW3XTTTdOnTy8uLvbFkxX6LV64UeB2gc41 qm0s+eiM+1gHgKsbrl5QUICDgKPBxs4EDAtnaKrnwKqD6AzDhAiWGzu12q+++iqF24uKinyRXvh/ bKNGU+rWLb66daZwO5TeWse2ikuXLqFNx20QBw2HkY2dCUECbOxHjx7F54mJifD2tWvXXvCNRa++ Gnv99SmqcPtWm62N0/n0oEGo4aTRo+NUQRrcOtDf92XT5eXluLrPnj2LPcURwHFgY2cCiYXGThkV io5Tjl0kXhiGCTX8ZOzUlo0dOxZNjI9Tz9Ayznr22dgGDZZWxMuV4faoqKRRo/Lz8z0tdt7s2QsX LPjTaijUWlxcjCMjWm02diYECbyxH6sARfXq1atTp07Yri/mXFBQoOnkeOFeEWe3q30eLyzcq2tX 77aInjiOG7rk2B3sL/aajZ0JPH379oVUWxUdgbTLOXYUzhlyhglN/Gfs1GpbNfUMTeTwgQNbOxxb r25/0SLPiYiIve468/qN9jG2SZO4sLAxw4db6+pXrlwpKyuDpShabTZ2JgQJlrEfP378xIkTOMPv uOOO+Ph4/OuLt2NzmuF2vVeKzTZpwgQvNoQjBmPPy8vDPmJP2diZ6gSnxxkm9PG3sVOrjUbHkqln qMzdrVqpw+35NttIu711s2Zo/szMXMvC8pGRCxcuLLMIuPrFixdPnTql2WqzsTMhSHCN/eTJk7he li5d+te//vX5558/d+7cRR/YvHkzLv859eq5NfaBdntaWppHhV++fLm8vPzs2bPYHewdGzvDMAwT eAJj7NRqw5AtmXq2YcMGzXD7HpsNNg4nRwUUq/z3AfqoUfID9E5OJxpQ310dTfmFCxcKCwtxEPRa bTZ2JgQJBWPPy8vD50lJSfD2tWvXeqfrsP3nkpKaqR7Aab7aOJ24ME2WTFd3aWkpKol9wU6xsTMM wzBBIZDGjlYbnycmJqLdQevsiyfD+WdNm6YZboeTw8zh57B0WnhhxSS1OVeHWiPCwnzsOKBBxwEs KSnBnhq32mzsTAgSIsaen5+PSxWl9enTh8LtHul6WlpaswYNZmhF1jVfuPDNjOdTZB26jhqi/tgL NnaGYRgmiATY2KnVRlGWTD1DUU8PGtTG6VSH21MiImDps2bMaN2s2Ui7Pf/qBbJsttgmTXzZNA4d mnW4h5lWm42dCUFCytjB6dOncf63bduWwu2X3IFqd4yNHai6ug1euPDjbrjBbck4OOXl5YWFhagt as7GzjAMwwSdoBg7tdpolSyZeoYadm3dWt1w498pERGa89HSbbZeXbt6t7krV66gTYddmG+12diZ ECTUjF2wbNkyCrf/8ccfmkaNEuIffrhTVNROc6JebLNtrXil2Gy9u3UzcHVc3XD14uJi1Da3EjZ2 hmEYJugE0dip1V6yZMmtt946e/bs//znP754+5o1a6Lr1zf5cBwN96QJEzzdBJpytOlozbFHHrXa bOxMCBKyxg6wGIXb161bVy5RUlIyfdKkiFq1RlYY+FKbbUblKzE8vFtUlHhFhYfbKomKjESnnl4f ffBBuRZwdYqso3q5V8PGzjAMwwSdoBs7Wm0sP2bMmLi4OLRNF33g3LlzHdu27VOnjltjH2i3p6Wl mS8ZDTqO1fnz51Fz7BR2jY2dqeqEjrHrga1QuB0VI69eu3Zt17ZthX4//cQT0ytZsGDBFonCwsJy 07gqIuuoT44ObOwMwzBMcAkFY8+rAJt4+OGHu3btijde6PrmzZvNh1rbOJ3YKZMl4yhdunQJ/iBa bTZ2phoQIsbuFlwObdu2HTx4MNYqtxpXRWS9oKDgsAnY2BmGYZhgETrGTk/D09PTW7ZsOWLECDNT zwhspXe3bt1Mh1rxiggL04vIqkOtZ8+eVTwZZ2NnqgFVxdiJ1NTUW2+9dc6cOaWlpZetwFXh6ri6 6bpmY2cYhmFCmVAz9tMVzJs3r3nz5rNnzzb26jNnzkwePTouKirdtKvjlWWzxd1wg7Gro0HH33Pn zqGeNAeNjZ2pZoSCsXsEyh8zZgy8HReFL66OnnhZWRnuLajbQQ9hY2cYhmGCQqgZuwAljB07Ni4u Dm2WplQvTk2Nu/76FJ2ppjsrJqbRa6U0PQ2vNvXqxT/8sIGr47D8+eefqJve7DM2dqYaEHRj9w5U r3v37t26dUOVrngOdhy6jmpkewsbO8MwDBN4QtbYCQq3U+ssoqeoSetmzSL+8pc2dep0i4qiV5zD YZPoGBcnpqcNfvTR6RIGs9JcFZF1bNd49hkbO1MNCK6x+8iGDRtatGgxcuRI3EDMu/rFixdxdR/w GTZ2hmEYJsCEjrHn64NmC63ziBEjaOoZakLujQZuSyWog48T0ODqRUVFZOZ6sLEz1YYqbezEnDlz KNx+/vx5t67++++/o2JZFsHGzjAMwwSS0DF2t7z88svUOpeUlJRbBxr0CxcunDt3DtUzOfuMjZ2p BgTR2C0EFRg9evQtt9yCK0VzNyHzf/zxB2qSZSls7AzDMEwgCQVj93TqWVxcnI9TzwSuisg6KnPI E9jYmWpAsIzdH6DmDz30ULdu3VBJeR/Lysqw3d/8Bhs7wzAMExiqlrETqJiYeuaLq1+8eDEvL++g V7CxM1WdwBu7v3n77bf//ve/jxw58uzZsxcuXMDVvc/PsLEzDMMwgSHoxu41aMU8nXomh1oLCwtR w2xvYWNnqjrVz9iJoUOHDhs2DPX5NSCwsTMMwzABILjGHrCpZ8LVL1y4UFxcjCod8Bk2dqZK06NH D5xOdrt94sSJATD2gDF//vzHH3/8lwDib2OfNm1a06ZN8WN16tSJz1uGYZiaSRCN3dqpZxRuN9Z1 WD3qEPjZZ2zsTAiCE/j222+3VQAhXLRokf+MPZDMmzcPxv5zYPGTsS9cuLBt27b0G+HCx0/D5y3D MEzNpBoYO4E6a049Iy5evHjixIn9foCNnanSrF+/vkGDBuSEnTp1wslWDYx90KBBewOOtca+bt26 Xr160e8SFRWVkpJSVlbGpyvDMEyNJVjG7ifeeecdmnqWl5dHO3jhwoXTp0+TWvsJNnamSgMVnDFj Ru3atXF21apV6x//+MfmzZstNPYAQ8a+JxhYZexPPfWU3W4nXcfdLD8/n89ShmGYGk7gjT0AzJ49 +5ZbboHxFhUVoTL7/AwbO1MNgBb269ePLBG6mJycbImxB565c+fC2HcHCR+N/YUXXoiOjqZfoVu3 bjjgfGYyDMMwrkpjT0hIqE7GDl555ZXHH3/810ARGGNHT4SNnfErOFdFuB3quGzZMq+v/WBBxv5T kPDa2JcvX96+fXsRWU9PT+ezkWEYhhHMnz+f2ogWLVqsXLnS38YeMLBfMPZfAohfjX316tU9e/ak X6p79+583jJ+RQ6333nnnTgbPb32g8jLL78MY/8xeHhq7OiP9+3blyPrDMMwjDGpqal169al9uKR Rx5B6+wnYw/w7DMY+8+BxU/GnpCQwKFWJsAowu1PPvkkTt2qYuwDBw78IaiYN3Zc0Xx1MwzDMCYp Li4eM2YMtRrh4eGjRo1C42KtsQdl9tnegGOtsT///PNNmzblUCsTLORwu8PhmDZtmplrP7ikpKTA 2HcFG7fGjnpyZJ1hGIbxAjS499xzD7Ug11577dy5c60y9mDNPtsTDCwx9iVLlrRr145DrUwogBO4 devWdDbefPPNK1asMLj2gw4Z+/chgJ6xr1q1qmPHjnx1MwzDML4Ab0QjQq1Jq1at0tLSqq6x7w4S vhj7hg0bevfuzaFWJtRYv359/fr16cy86667cMaGsrF/FxoojP2jjz4aMGAAX90MwzCMVaSmptap U4dalj59+qB19s7YgwUZ+09Bwmtjf/rppznU+n/s2w10FNX5x/Geoz2FesRUKaIVilYkVLRUFCkH FNR/wZeeElQSATEWLGmxghBehIooIC8qEUwFX7EGjYIFI0oQlSgK4SUaRRCiYChiIgJGWAFF3fN/ zCO3l5nZyQ6QySb5fk5Ozmb2zuyScO/9zd3nImFpcfuxxx4r/z/le//+/eX/tt33E8Hdd98tib0w MdiJfejQofRuAMBRZxe3N2jQQB7LBBQosdfs7jNJ7EU1J2hinzBhAkWtqBUcxe1jx47Vvp8gJk6c KIl9RcKQvv/AAw+0atWK3g0AqD52cXvjxo3vu+++2pLYZdZeU6PiTOyPPfZY+/btKWpF7WIXt59x xhlPPPHE+sSgiX15Ynjuuecuvvhi/S01bdo0NzeX/zkAgOqTn59vVoBlmn722WerTOw1S2tZV9c0 /8Sel5d33XXXUdSK2ssubpdoumTJkgRJ7G/VtMWLF19//fU/+9nP9DPKO+64g94NAAiHXdzes2fP 1157LVZiZ/eZzTOx33rrrY0bN6aoFbWdo7h9wIAB8h9+Xc2ZMGFCamrqmzVq2LBhpnfLQETvBgCE zC5ub9iw4eDBg4uKihyJPXF2nyVmYr///vvPOuss/R126NBBnuX/FWo7R3H71KlT368hmtiX1ZDp 06ebknV6NwCgZtnF7b/85S9nzZqVmIm9MGFoYp83b95FF11EUSvqKru4XYLrnDlz1oZu/Pjxktjf CN2zzz5L7wYAJCC7uL19+/YvvvjiBwkjoXafiZdffpmiVtQTM2fONMXtl1122dKlS8NP7K+HSIa+ 3r1707sBAIls0qRJprhdpq2VK1fW+NYzs/ssQeL68OHDKWpFvVJRUTFq1ChT3J6RkbF69er3QnHX XXdJYi8Ii70hhd4NAEhkMknddNNNprh95MiR62paIuw+EzNmzKBkHfVWaWnplVdeaYrbJ0+e/G71 08S+tPpNmzaN3g0AqHWKi4s7duyo89epp546a9asGk/sy2rO3LlzKWoFREFBQXJysvYFibhPPvlk cXW68847pe+/Wp3mzJnTqVMnejcAoPZasGDBKaecYorbX3jhhfdrgib2N2rCSy+91KdPH4paAZtd 3H7ppZdK7q2Nif35559PS0ujdwMA6gCZwuzi9uuuu2758uVrwxX+7jM1dOhQiloBT47i9oEDB65c ufKdo23cuHG9evVaUg1Gjx590kkn0bsBAHWJo7h9+PDh74Uo5N1nIisri6JWoEqO4va777777aOq OhL79OnTzz77bHo3AKA6pKSktIxt4sSJ2qysrEwCpz6Wg/ZT/rKzs6VxUVGRTxtHcfuDDz4YZmJf Goqnn366c+fOFLWiDmjpy3R2e9DQccZ/HDD69+8vjaOHFre3atXqiSeeOLqJ/eWj5Jlnnunatavp 3TNnzuQ/CQDg6NK9Uf6JPS8vz47o8kBOiSex5+Tk6CwWz0xtF7dfcMEF8uO71UwT+2vVLD8/v1+/ fhS1os6Q0cBn0NDO7hg0dJyJZxyQuK4XN0ckACclJenIcMkll0hCLjpi0g0lsecfMfln2htSRo0a VVFRwf8QAMBRpzOpf/x2RPQ4E7s2iz+xR13F7WlpacuWLSuuNtW6+0yNGTOGolbUMZrY/Tu1Y5SI J7FHIhGN647EHq0sbs/MzDTF7TfddNPy5cvXHIGjktgln5ve3aNHj9LSUv5vAACqSZWJvaSkROZK aSPfdcK15+KcnBx54JiIy8rK7KX7+BO7klh74403muJ2ed13qod+Mv5K9ZgxY4Ypam3btq0pDwBq uyo7tXvQMIldBofsStLGPkXX5KWNtNRxw31ZicTdu3c3xe0TJkxYfbjGjh177bXXvnS47rvvvt/+ 9rf0bgBAaKpM7NrAXi3XxK61pua4NJO5WE+RNvKUNIhEIvF/Gu5QXFzcoUMHU9wuU3w1JfYlR9sz zzxzySWXUNSKuqrKxO4eNPSIBHh70EhJSTGn2LtjYiV2JfG4VatWprj9scceWxXc7bffLon9xeBy cnK6dOlC7wYAhMzMpJ7VntHKraMyser0KvOphHBT7iLnTqyks7BEdHNZk94PO7GrBQsWyLRoitv/ 85//vH30HN3dZ2LhwoV9+/alqBV1m/Z3ya7uEUNXzt2DhsnwekRX4PUiek1pY1/fJ7Eru7i9a9eu ixYtOozEvjAIGXyuu+46ejcAoEY4VsNsZtL0rGOXZ80km5eX5y49ta9/2Ik9erC4vWHDhvquUlNT CwoKio4GrWVdfJTcdtttFLWiPrDXyR2kv3sOGjoO2IvqGtrt23z7+lUm9qiruH3AgAHLli1bGR9N 7C/Ebfjw4fRuAEANMgXnnVzM9OqZ2O3JNxp7kj3yxK4cxe1Dhw5dc8SOyu4zkZWVRVEr6g9TcO5m ErhnYs/OzjYXkW5iJ/x4BhNPjuL2KVOmFMbhn//8pyT2vDhMnTq1devW9G4AQM2qso49GiOxO06p 7sSuHMXtM2bMOPLEvugIPPXUU127dqWoFfVKPNvJPRO7fYo8PiqJXdnF7W3atHnyySfjSezP+5o9 e/ZFF11E7wYAJILaldiVXdz+hz/8IS8vb/VhGTt2rMzaLx0WeQ+9e/emqBX1UAImdpWVlXXcccfp yHDVVVctXLhwRQxjxoyRvr8ghrlz56amptK7AQCJozYm9ujB4vaf/vSncvFjjjmmb9++r7766qqA tJb1xeBGjBhBUSvqrYRN7NHK4vabb75Z+6ZE7oyMjIKCguUumtjnexk5cqRZEKB3AwASRPyJPVaF qgo5savy8vKePXvq3Hr88cfLVHsYiX1hEPfeey8l66jn4k/sZtAILbGrDRs2mHK1E088Ue7u3zrU 6NGjr7nmmv8cSnr3ueeeq2clJyfTuwEAicPsPPWk20tzcnJ0FpPGJSUliZPYVWFh4e9//3t9h82b N3/wwQdXxkcT+wvx+fe//33xxRdT1ApoYo81aOjI4Bg0Qk7sKj8/v0WLFvo2zj777NmzZzsS+3MH Pfroo2b7alJSUlZWFn9lAEBCkUzeMjZN7NHK4G2mY2HmZSPWJKvXr9bErnJzc0888USdczt06DB/ /vzCqujus7yqzJs3r1+/fscffzxFrYDp7P6J3TFouMcBeWyPMPEMJofHLm6/8sorpUe/+eabmtil az/99NN9+vTR3i2GDBlC7wYAoFrt37//jjvuMMXtvXv3XrJkyYrYtJb1eV+33XbbKaecorN59+7d KWoFah1HcfvAgQOHDx8uiV2+m5L1X/3qV6+++iq/KwAAwlFeXt6+fXtT3C6Tsn9iXxDDtGnT7KLW /Px8frdA7WUXt//85z9v0qSJ6d15eXlJSUmTJk3itwQAQGjS0tL69etnF7dnZ2cvd9HEPt/l8ccf v/zyyylqBeoeu7jd9G45qNV0/H4AAAjH/v37GzRoIJNy9NDi9o4dO86bN+8ti9ay/sfyzDPP9O3b l6JWoG6bOXPmpEmTTO9OT0/XLk/ZGwAA4ZCUrpNvYWFh1FXcLoE8Pz//zUqa2J87aMSIEaaotXv3 7hs2bOCXCdR5MkQkJSVpx6cwBgCAcKSlpenkO2rUKHOwvLy8Z8+eprh92LBhJrHPmzfvnnvuOeec cyhZB+ohLYlRFMYAABACLYnRyVcLY2yFhYW/+93v9Nlf//rXffr0ueqqq7p160bJOlBvmZIYCmMA AAiHKYmxC2PcbX7xi19og2OOOYaSdaDesktiKIwBACAcpiTGXRhj0+L2Y489lpJ1oD6zS2IojAEA IAR2SUyswhhbeXl5cXExvzeg3nKUxFAYAwBAdXOUxPgUxgCoVtnZ2Z06dZLvPm0KCgr69+/fqVJm ZmYkEvG/Zl5eXkpKSsuD5Fy5wmG8N33RkpISd0mMT2GMtJez5NxgL1ZSIq8Xbdnyx6+UlGhOjrNN WVk0MzPaqdMPX9JYTgEAoO5ylMT4F8YAqD4TJ06U3iffYzWQ6Ks9VOO3PiiJHVYd7fUUkeMOwFWR 4C0nFhUVuUtifApjpL08JecGeCV5b5LSf/KT/yV2eSxfdux3tNEHwf9RAADUCu6SmHgKYwBUB//E LjFbs7dZJNdAHisPSzNtb/J5WVmZvoQoCbgonZ2dLedGIpHS0tIBAwbIFeR727Zts7KyCg5yn3U4 iV0TuPwSysrMv/zHg/rpgxy3f6x8cz+GdnMKAAB1SGFhYZeDmjZtmpycbH6kKhUImX9iT0lJkWcd NTO6cl7mlVT1apmZmZ7X8VnJj/99ykDhCOoS0e0340js8mMVl5YGkr3dCV/erTmu+Twl5ZAG8pQc ZJkdAFDXpaenz549m98DUFP8E7tkdQnbjrVxLXTxTMJ6NXcNeV5enjwl3yVsy+kpVvSV444jcrqu 0msxvLyQPtDV+4YNGz700EPRytV7+7hEdE3yJrHLjYN51v2v+B9N7C1bOo9Le/m16G9Griz/KEe1 vyb2I7gNAQAgQcgs6VgBsyVoYpd3K5M428pQD1RZx+5g6l58nhWSkCVye3Z8XaI3P2qxun3ENDB1 7JrhtdkJJ5wgV45EInpE2sib1zV8LbDXxK50t6y2THGskB/6nn5cTpdMHmfHj0R+PIuBAgAQFl3m 8p+1ZZbUuU85Pih3MwtcZg+a+/rxJHazzqY/SgbwLF51kPaOhbu4yD/K3ncmD1yrhc7GVX7mDiR2 348/sZuc7NNeBxO740vetvuspmtzxDTWPi6R29S0mMQedVXFyPDiCOFaYC/fTWI3Y5SOBrHuMn6Q l/e/Xq8dX67sX+4iDdx1MgAAVKcqZ22dDfWjZ7Nm5a5WNcy6md3e/XF5PIndnrXz8vKqvLNQh7P7 TP45Zr6WE+XLrLy5yWyujUnsqNN9390Zq7wRlttqGRzsjm+fpbtZdfTQNXm9rL4HfT8atn0Suz5l 3wjoFlezxu7I5z6VPP8jL2p6vX7Jj56nyDimA0Ukwn8hAEBo/GdtXfWyF7p1zUoOepaG6owsU6r9 mbjWrzom2XgSu07B8bxPW+DELm9VV9ftBXw5qKWqjnsT3ZJGYkdd7/s2DcnB7oIrO76paTE37Hov H638JE6OmxFDX8Vsa/VJ7D5r5p59375U1aSZdPlYN+wmrtP3AQDh8p+1PXeT6QzoWRsT62q6UC/H I5GITJ0SxU1iN0dMYz0i301ilwc6v8t3x8wrM7hc1q6btWdtfbaKWhrdfeaenXUt3Rw3Gd4UzzBr o+72fdObtL/39ykSq+yzch3Pj94c1e8ay7XGRg/qAz1iwnZIiV23l7oXH0ylujlLjmgxjFw8xt4c AACqj/+sLdOohGFH4q0ysbs/OtfsXVJJp1ST2DWK25OsKXY1U60+MOw6GXPQ1MyYWds+S56V9t6/ Ak3sMkE7JmKZo+UpM2XLAy1ul+Ma3UnsqLt9P1r5kVmVteuGBukqN5zKuKFL62azid7Om1tye5CJ ldjdCVwuJQ0CJ3btyJ5V63Yf174vP/retgAAUH0C1bJGrZ1cnlOzHNT5VDedybzsLp7R01NTUzWx m/aOBlFrqpVZXmO8zsu6/G4+bdcG+qPEcrP7TI5IAJD2VX+mbxbPJULInUisKG7+ySR21PW+r2vj mq7juZr2UOllkUMLvDWim96n9+zaWO/6tTDGUWvnTuzSlzWxm4RvXkKvINc8nDV2zyoXjeh6F2/W 24nrAICaEzSx6/Tns/PUrI3b69vS3szjOuF27txZErtJ+KbKXXOCLr55rrPZF7E/qTfL+yaxm48G zEfwZbE+zpbj+pG3+dLldK9aff0tkNhRN/q+2SRuk+Ts2ELueNZ9NXMTrXfrEyuZocD+hMs00/5o 3+Y7xhnt+5r55dnTTz990aJF5oV0Ud18EGDu1oPVsdt361okIw80ousoZ7al6550+8vrc0YAAKpD oMQe/wY0ScuS0rVm1eR2nehNXaskdrM4Zu4CzH60qG9i9/xkXH/UWdtR6RrX7jN5e3J9+dfpfK3z eJWfmAO1ue97Wrx4sV1y5hCrH7kL2LQnOlbptY87PlZz3IDbHda+rx88eHDUKteJVREXrO+biG7f sJtFCcdT9lfcCx0AAByhOBN7JBKJP647yPSq55r6dplhGzVqJIld5mh5rJU2emW75NU/sR+13Wee Cgp+XHX3fBUSO2o/3eLtSfuRz7M+5MY8Oztb19g9N327N5vrPhe7nMbsOlcS2uXHdu3aLVq0yB5Y 5CXktezPzhxXdl/Km1xBbit0jd1xk66bWTy/Dq3/AQCg+sST2M1ur/6+lZya6j0jva6SmYwt0V0S e1ZWljmoD/TzbnOFkBK7JHNp7PmULq+5nyKxA6HTOnZ+DwCAeqjKxK6FK2abmD8N9p6zqp2x9ZpX X321uQvQD8rt/WhR38SuT9kvpDcFh7P7TOO3528gVjInsQOhI7EDAOot/8RuNnllx7fHSjeEyimO iVWPm6oYSdeNGjXSK2uNqxa32/vRol6J3Szya8J37zyVI4ETu7wBrUp1/BvlR6pigIRBYgcA1Fsa dFt6kXyrSduzQayQb7aeaX2L2Xxqdp6qk08+2XP3mZ207ZhtlvrloFwnEoloe7kLkHdi7hS0ZjVw Hbskf7PjTE60N5+y8xRIDCR2AEC9JXG3ZQy6ITQWn0Ia3U/6k4O0WMWxHey8886T0O7I59IyMzPT HJGz9G3YDcxLywW1gUnyOpvr2zbr+Z6X8vxF/JDSTVDX6J6X591YLi4NSOxAiEjsAAAcdbrcHSsk p6enz549+8hfpaysTF7CcTtwJJf7IYfL18HKHAAJgsQOAEDIjlZiB1BPkNgBAAgZiR2oLSKRSJFL lWdJm4mVfGJ2SUlJdna2tMnJySmL8cGWfo4mYiX2ON+Pz/ssosINAAAvJHagttD96Q66tTzPa6+H 7o5xNJZkbreRrG52qdsbXhyXsjfFNGzYcPTo0bFeyLELRsgrujfg2C/hON1nbw4AAPUTiR2oLTSx a0Q3TNbNycmxG0vGNvFb19jlgba0I7GerjFbjptkbu9G1xPliDSQZpLY5UdzjyBH7Cto/pfrmNNN A8/ELnneBHVpqa/uuK0AAKCeI7EDtYUmdjtLKxPOTUGLyfaOOhNJ9XZLTcuOFfVIJKKxWW8BSkpK 9BQ5rg1at25t3oZcRxvbi/wa2k3ljP4Yq+JFA7x5Vs7Sl+PPDQCAQWIHaotYiT16cBncrGzbkdvd 0lSe6AXdVSi61q3FLRLF5RXtNfN27dqZUK23AI63pJc1tTGayT3/RRLU3afrm6emHQAAg8QO1BY+ id1emvZfpo5EImYp3lSkOHaSmuV0T6effrp5G55vyc7hukQvjyXbS4aX5G/fRziyvdKPDKhmBwDU RjK3dnKRmc5zGU1pTakucGkNqrvNpZde2q5dO1NcKnOlY+72JLOwtNT34Flxat6t+4Jy7kQXx0Xs 06U9f30g6pvYTe2KfzM3e8undDfpeibPO0iMN8Xwp512mq6Be66xa+G6HtTbBwd5Sl/Fc5E/1so/ AACJT2cxT+6pWSZTeyI2j6WlHYB1LcveFOa5hc1BnjW71dyb1KIHy1ZjXdDzH2JfwXG6fLdLZIF6 PgjEiuKmmCRQYpccbnabmtFAznXfuevKuTKJ3dSxmz5uBh97EV6OSAN5Sr5rB9dn9TGJHQBQZ5hZ uMii5aaO2VkyuR60F6hl/rUnyujBta9GjRr99a9/1SMy+Zo47bOyrRc3q+Ia+02Zq9kEp1eQV9H2 JgDoGp28c881dvPP1M/lzaf2/AcAfKK4JufDWGM3pIdKr9RP5XQQcN8p67Bzyimn2NtXzaChn4s5 buT1MzV7PDEhXy6lowGJHQBQZ8Sahc2KllnjcuxBMyQD2y31gm3atHHUsXvOoYb7Q3BdeTOh2pHP zSlyWdPAzPVuero9v+uNhv+yP1CfBwFHN9Qe53Of619pJn1T77tjZf4uXbqcc8459m27PDCf00lP l6jvf8tgltapigEA1DE+k7X9lCln9YzE0tIUlptPqx2JXWZbecqnEEXX2cyP9jY3R3pX9upf9GBi N0/5tLT/de4bEIBBwLBLx00/8hwEtKXeQbu7m2GekiFF+rgd8iWxDxgwoMr7eu2zjuFCaWLPruTu 3dykAwBqrziX1+IvIzE7wtq1ayeTY6xF7yovotOrxIBoHIndNLC3xJq7A33W8W/0PAgwCNh95PA+ aHNUuHn2WU349qUksXfu3FkTu7TUYhj7dH11+yUc8dt8lGZvmHU/y18cAFDrVLnpTJfUApWwSuNG jRrZm0/NCnyV7M2t9su5q2LMYn704A2FHdr1R80M7pKbKIkdcA0C9mYWOei/mcXcjLs3s5gSdM3e jmaa0s2HaGapvHXr1vYHeY5M7ujFZvFfd6ZED251MQ3Merv9lkwRHQAAtUuViV1XpYJuOktNTe3e vbsdnuOcLuW1zEYzewlOJ2g5KBO3TPF2RNd/hd4XmOuYDwVi3W6Q2AF7EPDk7iDSAbVvmgpz09Iu U9H87NnM0UbvsjVguyO6nmJe0b5n11Psm3SzMz1qfdhnLm4/CwBA7RJnVUzQxJ6enm7q2GXqlKnZ JHBdRbe561Gj1mK7maP1M3E7//uUy0atNTqdu0nsgCe5ve3kIvfIsT4X0z2kpv9KY8/Kc+l6ppNq M3edjLQxlWyNGzfOysqyn83LyzPPyqXceVtv1c0HeY4aPHn/5g14ng4AQG3hE8V1jctn76chE6tM iDIdRyIRuaDM9XZiV/aH4I51PM/EHj24BGeHAXlLEyuZWlafxK4La9LYM5x7lsoAqCldunSJs3YO AID6xiexO3aZeW71crfUFJ2amupI7FErYBcdKlpZ9OJegtNKGE3s0szx0vbKubwBeeBYQ9PErhnA ne3tiwOocSR2AABiiZXYTYmp+aDZ7PR0LImbpXhtqen95JNPnjVrlt1MC8tjrWl7PmvfI2j8zsvL M8/qC+mz+lhCuHnWLOnrj3q6nfndW1kB1CASOwAAsZgcbpewmm1ijmVts4FL8rxWp5jacpOWS0pK 9HQJ7aaZ2VZmR24Hu9BdJm49xWR4s5NU69L1hsI8K5fV62sNjDTWq5kldG1gNq7q6fHshAUQDhI7 AACxaGJ30ADvma7NHlK7saOaRSKxxHX3NT0rauyzTLA3e0sdL20/6yiDkYvbb0we20vu0coyGLsB FexAQiGxAwAQSyQSKXLxP6WsrMzsAI01w6anp0+aNEmSvH8zN2mppziK0pUc9L+gvjF5XVPM43jn +pYIBkCiIbEDABAySezunacAEAuJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIH EAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQk dgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABC RmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcA IGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2 AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRC YgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1A ICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHY AQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZ iR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCA kJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgB AAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJ HQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCB kNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIH EAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQk dgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABC RmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcA IGQkdgCBkNgBAAgZiR1AICR2AABCRmIHEAiJHQCAkJHYAQRCYgcAIGQkdgCBkNgBAAgZiR1AICR2 AABCUFhY+BMvDRo0qKio4PcDwEHu6z0HjRYtWvDLAQCgmsg86558u3fvzm8GgJvcy8sdvXvQGDVq FL8cAACqicyz7smX8hgAscgdvXvQKCws5DcDAEA1cRfGUBIDwIe7MIaSGAAAqpujMIaSGAA+3IUx lMQAAFDdHIUxlMQA8OcojKEkBgCA6mYXxlASA6BKdmEMJTEAAITDFMZQEgOgSnZhDCUxAACEwxTG UBIDIB6mMIaSGAAAqkNpaalE9KZNm7Zt27agoCB6sDCGkhgAnjZs2JCRkZGUlNSlS5fi4uLowcIY SmIAADjqcnNzHVvGRI8ePcrLy2Xm9S+JkSk7KytL5uu0tDTJ/PwygTpv//79ksw7dOjgGDSGDBmy ZcsWucf3L4kpLCyUBjJoSHtWAwAA8GcW1XW2PeGEE66//vrFixfLQXmsq+udOnV6+OGHHSfKfL1g wYKMjAxT6G42qMq58iy/W6BOkrCti+ra5Zs0aTJo0CAZNOS7HpGnzj77bHdJjCTz3Nzc9PR0c65p P3PmTH6xAAC4lZeXX3rppWbSbNeu3bRp0zZv3rztoOLi4j//+c9mUpZ8Hq1M+DK39ujRw55w5dle vXr961//ku96RG4BZGrmlwzUJTImtGrVyv4MTnr9Nsvrr7/etWtXfbZt27Ya2uWsSZMmOVbjmzVr dv3118vpdnutxAMAAEa/fv1kljzuuOPkwbJly8piWLhwYZs2bUwOt+dcOT5o0KAXXnjBnrLlRwn/ 2kDmaK1rBVAHnH766dKvTz311NGjR7/77ruxBo3HH3+8efPmnoNGx44dx40bJ8HeHjQeffRRCfDa IC0trby8nF81AADqmmuukfnxzDPPnDx5cnlVpkyZ0qRJEy16ueKKK7Kysnzm69LSUmmg7UVGRgZT MFAHNG7cWHp0q1at5syZ4z9ibNmyZdiwYTJcaGhPTU2dOXPmxo0bPUcMOS6DhtwFaHv5fscdd1BZ BwBA9GBil5mxd+/evXr1+uSTT7b7+vDDDxcsWBCJRL777ru9e/d+dqiSkpK1a9dmZmbOnz+/WbNm s2bNkiO33HKLTsFJSUmS4fmdA7WaJvbc3NyuXbtKwN5elaKioqVLl8pwIefu2bPHPWi89dZbd911 1/Tp09u0aSNDh4whpuKuRYsWWokHAEB9ZhL722+/PXny5AsvvHDDhg2fx2Hnzp1ff/11tHIKlkl5 /Pjxr732mky4t1Rq2bLlmDFjZNpt167dokWLZEa+5JJLdApOTk7Oz8/nNw/UUprYX3jhhXfeeWfg wIFyp79t27Z4Bo1du3YdOHDg+++//+KLL7Zu3SoDhQwaMlbIPf4NN9ygg0bHjh0vv/xyCfkybphK vC5dusi4xG8eAFBv2Ym9uLj42WefbdWq1auvvrojPhUVFd9++61MwQsXLpQJNz09ffDgwfJgwoQJ aWlp559/vjyQ7/J4/fr1cnF5yuxWKy0t5fcP1Dp2YpdBQ+70O3To8N5778U5aOzevfu7776TcSM7 O1sGhMGVJJzLWCH39VdccYU8kOPDhw+XG4F77rnn5JNP1kFjyJAhMuDw+wcA1EOOxP7uu+++9tpr F1xwwfjx47/44otd8dEimQMHDkycOFGm2hEjRqSkpJi4Lo9vv/12OS7fP/74Y/l+wgknaJ3qqFGj qFMFahdHYpdBY+7cucnJyc8//3ycI4aMLXv37pVB47PPPjP3+JdW0rEiIyNDjjdv3vyRRx7ZvHmz /KihPSkpaebMmfwJAAD1jTuxv/fee2vWrOnfv/+FF15YVFT0RXwqKio0e2/ZsuXGG28855xzJL1L XO/du7fG+CFDhvztb3+TBzk5ORs3bpTjOgU3bdo0NzeXPwRQW7gTuwwaK1as6NSpU7du3T788MM4 B40vv/zym2++kQvKRTSu61ghA4UMFxLX5ceePXvKMLJkyZJVq1ZddtllOmi0bdu2oKCAPwQAoP6w E7tMi6+88opMvmvXrn3//feffvrp5OTk8ePHb9++/cv47Nmz58CBA3JZmb5lnpXZVq5sx/Vp06Zd eeWVMrOvXr1aXuuCCy7QKbhDhw4ya/PnABKfndjlBvytt96SQUNGjHXr1j300ENnnHHGww8//GXc 9BO677//fv78+XKnP6SSjBUjR47UuC6Dht77l5SUzJkzR5K8DhppaWnl5eX8OQAA9YGd2CVFt2nT RqZgTezr16+XFH3TTTfpitbuuOnn3WL27Nkyvd56661///vfZS7Oysq6rJI8OOuss+Tg1q1bH3zw QVOnmpGRwRQMJDg7sUvMbt26dX5+viZ2GTRWrVqVkpLSrVu3TZs2xT9o7Nu3T0K7pPdx48bJ4CDf //KXv8gd/aRJk2TokMfmuAwa8r1BgwZaWSdjF5V1AIA6z07skpZTU1NPatxk6tSpmtg/+OCDDRs2 LFq0SEL7iBEjduzYsSduX3/9tU7BQ4cOlan2zjvv/L9KkydPlh/l4G233SZ5Xn7ctm2b/KhTcFJS kuR5/i5AwrITu3TwCy+88NRfNZs3b54mdh00HnnkkTPOOGP8+PHxjxhyKS2SkUzep08fiesyOMh3 GaNkrNBBQweT3NxcuR3QsUu0aNFiwYIF/F0AAHWYO7GPGTel+5U9JJ+byXfjxo0lJSWZmZnJycky EX8Vt71792qRzIcffvinP/2pc+fOU6ZMOffcc4dVkpn3iSeeGDRokMy/0lhmf8nzOgXLC+Xn5/PX ARKQO7FPnjbr3Lbtpk+fbg8aa9asGThwoNzsz507N9Cg8d1338mrvPHGG+3bt+/bt68MGjJWyIgh Y4XGdRlMVqxYIY2XLl0q44kOGl26dJHX5a8DAKiT3Il9/JTp72/6/PobB8rj4uJik9g/+uij119/ /eqrr27RooXk9r1x279/v07BS5YsadWq1c0333zXXXfJ99LSUrngvkPl5eVJG/28u6Kigj8QkGjc if3xpxYUrf/kkv+7fOzYsfZtvgwaCxculDtxye3z5s2Lf9DQT+iEDDUyIEydOjUzM1PGDRmRVq5c 6Rg0ZsyY0bRpU93Gzl8HAFAneSb2Dz7eIV93jL8nOTn5pZdeMpPvpk2bNm/evGzZMjlLcvtjjz22 P2662C5T8JNPPunTRhrIfK2V7RLp+QMBicYzseugkdonvVOnTm+++aZj0HjxxRf/+Mc/Sm5/7rnn 4h80vv32W3m5Xbt2vfzyy54NJNhLGxk0duzYoSvt/HUAAHWSZ2LfULqjZMtO+cp/rbD1b9sMHTrU nnw//vhjydLLly+/9tprNbd/HR8tUhXfHEqDuhzft2/fBx98IPcIp556KokdSEyeiX1j5YghX4/+ +9kzftNy0qRJjkFjy5Yt+fn53bp109weaNCQ8cExaGhQl6d2794tb0PuCEjsAIA6LFZi3/TJF/q1 flN5xqAhMsm+/PLLdmL/73//u3Xr1sLCwl69ejVp0mTkyJHr1q07EJsWxnz11Vfy3XFQZt6dO3cW FRUtW7bslVdeIbEDiSxWYjeDxjvrS6++tvdll10mo4qd2HXQWLx4cffu3eVmf+LEifKjz6ChhTHy EvJdj5igLg+2b9++YsWK119/fcmSJSR2AEDd5pPYSz+tMF/zF77y27PPueWWW4qLi+3E/sknn2zb tk0Ojh49+swzz+zQocPjjz++Y8eOby0ay/ft27dq1SrdGqZzbrRysV2usHbtWpn6V65cSWIHEl+s xL750EHjocfm/ObMllOmTHEkdh00ZDT4xz/+ITf7kt6feuqpbw+lg8aXX3755ptvyin2oLF37165 mgwaco9PYgcA1BM+if2/5V9uLd9tvj7asv3WYaNOa9Z88ODBGzdutCffTz/9VM797LPPFi1alJaW JrNwenr60qVLzRK6NFuzZs0bb7zx0Ucf6REJ8HKizLxyKRI7UIv4JHZ7xJCvt9/78NrUPqeddtrU qVMdib2srEwHjdzc3JSUFBk0MjIy1q1bp4OGfJexYvXq1QUFBdu3b9dBY8+ePXKu5H+58SexAwDq Ff/E/unnexxfGz76ZOjw25o1az527FiZUh2JXebWzz//XI488MAD559/vuT2vXv3SvBev369JnaZ ag8cOLBr164dO3aQ2IHayD+xuweNlW+v65X2Q26/99573YldBw0ZIuTZli1bZmVlSTLftGnT+++/ r4ld2uzfv18GDWlJYgcA1E/+ib1sR6R8p8fXex9suiljULPmzQcNGiQzpiOxSxrfuXOnTOgXX3yx HHQk9m+++WZ7JRI7UBv5J/ZYg8bqd9anXvdDbpfRpri42JHYZdCQTJ6dnd2vXz857kjsX331lQ4a JHYAQP1UZWL//Iu9sb7Wbtg8asy435zZ8rzzzrv//vtLSkriTOzllUjsQG1UZWL3GTQkt/f/699/ +csfytdnzpwZZ2KXV9FBg8QOAKifqkzsOyr27tq9z/Prs11ffbJ9d+mnFXOff7nH1WmNGze54YYb ZEr1T+xff/31toNI7ECtU2VijzVo7PxyX/nOyNbPdn+8reJfDz95+VUpJ/0/+2YClVW19vFvpV6r r9RredXq2uBYglM5lqmpeXPWW6alZpmWSoWWI5o5hJbj1cqb5ZCaiCiiiAIioogIogwyT4KAMskk M8r6/ut9Fvvbnul9yQn0+a93sV7O2We/+5x99vP/7X2e8/Q/7OzsZGKfMGGCgtixvaCggCIGEzuL xWKxHk5ZQuy5BSV515Ufmdhjk69FJGQGhCXDf1EPEfvBgwf1iP1ylZjYWaxaJ0uIXR0x8JGJPSYp Ozw+0+t0GKoSD+Y2btyoSez5+fkiaDCxs1gsFushlIXEfr2oTP4UFJaqiT0kJv2ZZ/9JxA65uLi8 +eabamIvKSlJqhITO4tV62QZsZcqgkZ+Yama2IOj0wWxQ3rEnpeXJ4IGEzuLxWKxHkJZSOyFxeXF pf//MSb2TJMOHDgAYkedMrHDiGHx8ZKY2Fms2iULib2o5JagYUzspA0bNmgSe05Ojhw0mNhZLBaL 9bDJcmIvLb9Bn+LSCsuJPS0tTSb2xMTE/Pz8WElM7CxW7ZLlxC4FDUuJffz48QgaCmKH5KDBxM5i sVish02WE3tZ+Y2KGzfxMSZ22GiGSUTsKSkpCmLPy8uLulVM7CxWLZLlxF5ecbMqaBgRe0aV/vOf /4DYETQUxJ6VlaUOGkzsLBaLxXp4VC1iR3mzxA4yTzfJ2dkZxJ6cnCwTe1JSUm5ubsStYmJnsWqR qkXsVUHDiNjTq0TEjqChIPbMzEx10GBiZ7FYLNbDo2oR+82b5okdJnvVpP3794PYE0wSxJ6ampqT kxOmEhM7i1VbVC1irwoaRsR+tUrr16//8MMPETEUxJ6RkaEOGkzsLBaLxXp4VC1ih//iY0zsAQEB V0zat28fiD3OJJnY4b/BKjGxs1i1RdUi9qqgYUTsV6q0bt06EDsFDZnYEZrUQYOJncVisVgPjywn 9pKyCvoYEzvAO80kEHvv3r1jTJKJPTs7O0hLTOwsVq2Q5cQuBQ0jYk+rEhE7BQ1B7Dk5OYgbmkGD iZ3FYrFYD4ksJ3b5Y0Ds/v7+qSY5OTmB2Ok1MZnYs7KyArXExM5i1QpZSOyKoGFA7KlVWrt27Qcf fEBBQxB7fn5+YmKiZtBgYmexWCzWQyILiR2IrvgYEHuKSXv37gWxizfFBLFnZmae1ZGC2Ddt2sQd xGLVNFlI7IqIYUDsKVUiYqeIIRN7QkKCZsRQEzvKcwexWCwW6wETkLhJkyawOXt7eyL2//73v127 9woMjZeJPaegRP2xkNgvVkkQe0ZGhp+OiNh9fX2/+uor8t8ePXqgQu4pFqsmqKSkBLP7evXqYWx6 eHgQsX/++ecj/j02NCZNJnbNoGEhsYugIYg9Li5OL2gQsQcEBIwYMYKCxsiRI/nxHIvFYrEeDMEH O3XqRAZXv379M2fOgNgjIiKKioqcnJzatWvn6n5SELveR5PYUdVlkxwdHUHsoVUSxJ6enn5KXyEh IeXl5Tk5Ob/99lvTpk2phUACzCa411is+ygHB4dmzZrRkGzVqlVQUBCIPTo6uri4eNmyZd16vH72 QrQgdr2PJrFfrtKaNWtA7CJoELEjKMXExOhFDBA72oCgceXKlUWLFjVs2BAVPvroo5hZYH7BvcZi sVisWqqoqKiRI0eS7VpbW//888/NmzeH+YLYg4OD4ZLZ2dn40rFjx42btsB8M64V6n00id3Pzy/Z JCL24CoJYgd7n9DRpUuXysrKgOvXTIIF29rawnzR1EaNGq1YsYK7j8W695In+P379583b97QoUOJ 2DG0w8PDr1+/7urqipm+y2Ev46ChSezJVVq9evW4ceNE0BDEjqilGTEQUjIyMkDm16qEkmB+airm FwcOHODuY7FYLFbtUm5uLgCYvKxp06YwR6Li0aNH29jYELGHhIQA2sHV4PYhQ4bYfDXrUmoWLFjv oyb206dPJ5m0Z88eEPv5Kglixy8eVwnmm5mZWVxcfE0ltAotoWYDCY4ePcpdyWLdG2ESLSb4rVu3 3rt3L4ZkYmLia6+9Zm9vT8ROQQMRIyYmplu3bitXrTeIGPioiT2pSkTsImgIYo+MjFQHDV9f34qK CkwW1EHDw8Oja9eu1Oy+ffuikdyVLBaLxaoVAug2aNCAnhfPnTsXRpwjCSQ/bNiwgIAAMt+wsLCE hISSkpJ58+a1t7I+6OaVkp6v91EQO2z0kkkODg4g9nOSQOzp6enY5XmrhPPm6MvJyalNmzacp8pi 3TNt2LChfv36NMH//vvv5fF49epVzPS/+OILQewXL15MSUnBrg8//LDvWwMuhMXqRQw1sV+q0qpV q8aOHSsihiD28PBwRdBAsLpx40Z+fr5B0FizZo3IrEOIy83N5T5lsVgsVg0XPdTu2bNnTExMrpZ+ /vnnXr16AZ6J2OG/KAmKhmni2Gk2M2MupSddyVN/FMR+6tSpRJN27979xhtvBEiiR9jx8fHuklA/ nLegoCDXAi1evFjOU+VuZbHunurWrYuxNnny5KSkJM3xCAwePnw4hjYRO7gaM/3i4mJHR8eXXnrp +5VrNSMGPgpiT6zSjz/+CGKXgwYROyqXg0ZERATm+MB1sxEDLZ85cyZBe6NGjRwcHLhbWSwWi1WT RcT+8ssv//rrr3k6Onz4sLW1tYuLCxE7bDEyMvLKlStlZWXz589/pb31vkOeCak56o8BsZ+RRMQe Gxt7uEr4FXLePIuFeQQQgiyYX0dlse6eRDKMt7e33nj85ZdfXn/99dOnTxOxU9DIzMxMT08fP358 5y6vefoEaAYNA2KXgwYRe0hIiAgaKIaIlFcdBQYGDhw4kGb63K0sFovFqskiYl+7du3gwYMXLlyY ryPYbteuXbds2SKIPSoqKj4+vrCw8Ny5c507dx4waPAJv2AguuIjiB1YnmASEftpSdiVlZUF5D50 6BCcNykpCc6bX03duHEDDv7cc8/Rw3TuWRbrLomI/ejRoxj4f/zxh96QdHNz69ChAwa1IHYEDXB1 SUmJp6fnK6+8Mmny535BUYqIIRN7QpWI2OWgQcQeHByM+tGS7OxsVFutiHH9+vWbN2+C2+l0uFtZ LBaLVZNFxL5hwwaY4CeffDJx4sSMjAxNg7t8+fKAAQNsbW2F+UZHRwOzUb6iomLnzp2g5Y8++fx0 YGT0pWzxEcTu4+MTb9Kff/4JYj8lCcSek5ODCuG8QPfqOm9paSm8G41xcXFp3rw5EzuLdVdFiOvr 6+vt7Y2YsGzZMr2xiek8ZvrLly9XBA0ANoAZB7Zs2dLmqzmh0Wly0BDEHl+lH3744f3335eDBhH7 +fPn0QaarVcraNALMiEhIfv372diZ7FYLFbNl0zsfn5+dnZ2gwYNSk1NLdBSZmbmrFmzOnbs6ODg IMw3Li4uISHh2rVrZWVlsGZw+/QvZ58NjgOr00cQe5xJu3btArGfuFUg9rS0NHLeAotVXFyMU0hP T/fw8ACuw3yZ2Fmsuy1B7AgaZ86cmWiS3iBNSUn58MMPaZIuB43ExMS8vDyElK+//vrZZ5+du3DZ hcgUihiC2OOqRMSuCBqIFagcQaOwsNDyoIEwhfKYBRw9epSCBhM7i8VisWq+FMQO//3ll1+6d+8e GRl5XUfe3t5du3adMmVKaGgozDe2SuD23NxceOI333zTpEmTEaPHHnQ/HRabQcQOh6ViO3fuhH0f v1XZ2dloDCz4umVCyZs3b+K3AgIC3NzcMINgYmex7o0UxO7v779o0SLM9DHp1huwzs7Obdq0sbe3 J2IXQQNDFaM4OTkZ8QTcPvmzL739LiJoELGLYitXrgSxK4IGBQHgt4VBgyb4WVlZmDu4urru2bOH iZ3FYrFYtUWC2BcsWABPhP+ePXvW0dER9nry5MlCfS1ZsuTll19GyZhbBW6nHNGNGze2bNnytW69 Vq75L4gdnE8FiNiP3SocVV5eXmiZbty4UVJSAuv39PQ8dOjQ6tWrv/vuOyZ2FuveSBD74MGD7ezs QOwIGuvXr+/Tp09wcLDesAXPjx8/vnfv3iIUCCUlJSFiXL58GbVhsj9oyMgdjm74CVFgxYoVY8aM UQSNq1evlpaWWhIxwOpge8p79/DwcHJy+v7775cvX87EzmKxWKzaInmN/csvvxwwYMCpU6cCAgKO Hz9ubW09Z86ca9eu6fnghQsXunXrNnXq1NDQ0OhbFR8fn52dXVFR4ebmNnz4cPwEKqRdO3bseP31 1z1uFcpbQuxlZWUw39TUVNDC0aNHd+/eDSv/ziQmdhbr3kheYx8yZMjkyZNB7Agau3btwkwfJGww hA8cOIAys2bNilYpMTExNzcXQWPLli2dO3fGT4hdROyKoIE4YAmxo0IEDVTu4+Nz8OBB4PqSJUsQ MZjYWSwWi1WLJK+xg9iXLl3ap08fLy+vwMDAc+fO2djYoAAYvkhfOOT555+fP3++gttRA3wZRoky bdu2hbnLxH70VsXFxYHYDX6lpKQErc3Pzw8KCkJ7jh07ht+lhTImdhbrXkoQ+8iRI9euXQtiHz16 NIgdQ97Pz2/SpEk9evQICQnRG8vXrl2j3HVwuALaMa/HWE5PT8fcvGHDhgpiVwQNEDuKGQQN7L1+ /XpmZibadvLkSWdnZ7D6qlWrKGIwsbNYLBarFkleY3///fcnTJiwfv36Ll267N27F8QOPIajWVtb z507Nzc3t1hHIGSwPbh9xowZcO0ok/r37//WqLfwF959/vz5qCr98ccfIHY3Sd7e3jdv3iwtLdWr H3tB7LGxsWfOnAEngNjh1/BcJnYW695LEDtG7ptvvrlw4cI5c+Zgpg/epqCBMY5JOsZmsb4QChBt wO329vYUGRAoOnbsiKAxatQo/CsHDZR577335KBx9uxZCgualSOYoJ2FhYUREREUNEDsu3fvZmJn sVgsVi2VvMa+Zs2aadOmDRkyZMuWLVZWVosXL4b5wjeDg4O//PJLWmwv0VdSUpKdnR1xe0BAQLdu 3f5w+eMl65ccHBwiJW3fvh3E7lolOCnhumadN27cKCsrS0tLQzNQJxM7i3XfJYgdYQFwjogxffr0 H3/88YUXXti6dSuCxoULFzBaP/nkkx49eoSGhhoEjejoaOJ2RBvEmSeffNI3wrf+E/VxuBw0MNJB 7CJoIBoYBA3ahXCE6YMIGkzsLBaLxarVEsTu7u7+5ptvArkXLVrUs2fPgwcPDh06dNiwYT4+PnDS kJAQuFuHDh3mzp2bl5dnYMHp6enE7TDiZs2atWvXDvYdIYmI3cUk+Kme85aXlxcXF+O3wsPDUYNs vkzsLNZ9lCB2Jyen9u3b79ixY+LEiWPHjkXQsLa2njp1KgYsBY2dO3ciAmCclhgK3D5lyhQKGoD2 N954I+JWEbFT0MC/9O65WhUVFQgmmZmZFy9eBNUzsbNYLBbrgZEgdljY5s2bhwwZYmtru2nTJlou W7x4MSzYy8sL5hsaGhoWFoa9sOAtW7aUGgrcvnDhwqZNm3bt2vXbb78F9odXadu2bSB2Z2dneDrh ukJgdTSMkm3gvPhpJnYWq+ZIEPuCBQsw6KysrNavXz9z5sxXX3310KFDIPZevXoRsSNoBAUFffrp p4gz+/btMw4aycnJX3zxRaNGjfr3749x7e/vL4IG/gWxI2gkJiYC1/WCRmFhYWxsLMIUZeIxsbNY LBbrgZEgdlht586df/rpp7Fjx3700UdAYrC6jY2Nq6urMF9YIRDaw8NjxIgRQHpwe5k5HTt2DA5O 6L5o0aITJ05gIgBij4uLA66ry2MjzDcjIyM6OjoyMpKJncWqaRLEjtl369at9+zZ06NHj7lz52Jo t2nTxt7eHqNeBI2LJjk5Ob311lvE7WaDBgpPnDgR6I5DMMAx6onY09LSKioq1OXRJASN1NTUqKio iIgIJnYW634JCPGGSXBnzQKjRo3C3smTJ9fGsxtlkt5JAW/M1hATE2N8+tiFAijG95LZyy7fcvj7 MFwKIvYFCxacPn0aKA7nXbZs2fTp062srNzd3SdNmtS3b1+4nkzsJJnbyy0QoXuzZs1efPFF1Hnj xg1FAdqSm5ubmJgYGxtrObGjwZs3b2ZiZ7HujQhxd+3ahaCBQQdo37Fjx+jRo4cOHYqJ/9tvv/3u u+8qiF3B7TjKkqABvCd0R9BALFIHDZrgZ2VlxcfHI2hYTuyIG2hzbSR2cnwD0yfHNzC4miw9XKHt ehCoEPv7nbrs8i1nIWOjj2hAISyo9+7cuZP2osLaeKFam6S+o+ikLBl0QUFBxqePXSiAYnxbGl92 xS1nYXCo7frmm2/oZsMXPz8/Hx+fgQMH0nIZaHz16tWAYZnYFQLVV4vbCd29vLwUrI6WFBUVJSUl xVbJEmK3t7eH7cJzwQkw3z179jz11FNM7CzWXRWYHKPsscce27hxI4YkRnSXLl3Wr1//7bffWltb b9u2DRYmP5hTaO/evdXidkJ3WJgiaJSWlubl5SUkJIigYQmxr1mzZvv27YdMQtBA4KpdxE6OT0R0 5coVxV5swXY9Xqr50sQVEKMBBKrF/n5HLrvilrOQsQWxQ+opAJj2wSN2unq0Sz0kq3sxmdh5RBvL 1taWBtGECRPgbmfPnh09ejRMGY7Wt29feblM1q5duz755BMnJyd8Bz8Tt4PzK6opNKCkpOTy5ctR KhkQOyABtHDgwAH8tJubG5r69ddfE64/+uijubm5fJOzWHdJGF/9+/fHWKtbt66dnZ2/vz/GY8+e PadMmYKA8Oqrr2L6rxk0QMuTJk3CNB/fZW7/C0GD3nNRBw0DYgefb9iw4fDhwxQ0MAugF11xImhG bbn4gtgh9UKxWO57kIidlpVoJrJz506zlbC/35HLrrjlqkXs1FnoOM2u0awtyCSDmmNMMhgXBodj lzFLG/+02Ku+tWg6iY2TJ082uK/w61SJ3sUULdTsiysmWX5S9HN6e7Hr7mXdGHfTX+tH+bKr9+qN aLOdXjO1YsUKQGyjRo3wRa/MunXrKM7DQ8HDsLnly5dbW1vv3r3b3t4eW0JUAi2vXLnykUcead68 +YwZM7DlyJEjw4cPhwPClPH9hjnhd0tLSzMyMkDmETrSI/YTJ04cP37c09MT5gt0f+WVV6j9PXr0 AD9wBGax/rIwg6ZZfLNmzTDM9Yp9/vnnNOgmTpyIaT6GJ4gdQQPT5wULFtCDOYXAydOmTUPQ+Oc/ /wm2xBZHR8d+/fo9/fTT+EUwtiVBo7y8PCUlJUJfesTu7e3t5eXl4eGBoLF06VLKoINGjhxZi57K kePrYQ+26K2xwyWNLUxAhd7vGuw1a9PGP22MK+TX5MsGiQcGWCW3UM/f1e03ixZ6e83C5+3fAwZ7 jftR8zaQL7t6rx5kal4furzAV3UvUEoMzb/k2tCndNPSfYt/RbW0ixKZRAG579A2cc8Lcla0R4wI yu2Ra8APiV9X/DSJyoua1SdFoI6TEuiuvkryqFSfvtxCyocXfUFtwyH0u+Lml1uF8gcPHtS8IOq9 ikutN78QLyOoZTAAxYmoK7/NfqTTl88aFYq7VD2iDa5PTdbVq1f79u37P5LatWsHt9IsDGuuV68e yrz88svwtcDAQCcnJ/jv/Pnzg7W0f//+NWvWtGjRolOnTg0bNqxTp84777wDUAdOL1mypFevXk89 9RQ8Hb55U0tFRUU5OTlRUVEXzcmA2Pfs2TNs2DA6NdDFtm3baovtslg1U5jwIkrIQQMxBONds7CY 6WPsY2AiaFA23ebNmzWDBojdxsambdu2HTp0QLR5/PHHQcvYjoADV8J2HLt48WJQtzpiVFZN8MPD w40jhjGx//777926dRPx0JKXxWqUBD6pn8JTSoyaK8jxhRXKFkYmiwIytyiYxwCoIFQluzD9lmzr xu5pgCskwjwiHL3EA2Oswi+K9hOzCX+nXxeHY+/169crDdmj0hB7FJdaL/dbvIygKYN8cj28tKQf DW4DuuyiAO0VQ0NN7AbXR+AT1SmfC920qFaujYrRSwqiAYq9okniX2q5yAHDWeNw0Y/ixMXTGXwR e0Xvo23y4ZSxgy2izXLbRD6Pgsnle5LKyyFF0ULRfnGCei2kISCfPpVRtEocQs+eFD8nzkhunuJA TZqVU5sU0nt6RcOKGin6UXTEbfajuCzyZRTXUEHsBtenJsvBwaFRo0ZoKnAaaO3o6Ni+fXs663/9 619AZfUhsE5KLGnSpMnevXvhdzC7Dz744NixYxdUcnV1BeQDksHMjRs3hgk2b96cVs82btyIAjhq wYIF5MLz5s0TLlxpSlmPjY0NsViaxP7pp582aNCA0mBQP2fCsFi3KXoehzH1j3/8w8XF5aeffsIX ChqYfV+9elUzztBMv2PHjphEY5xibCJoXNASgBmBBfFh0KBBmGIjaOAvgoa1tfWWLVtQ4PDhw599 9hkiRqdOndauXZuQkCCCRl5eXmRkpOVBQ03shw4dQsPodBAbMd2ojX0k8Im8Xk6MoS0EqMJYZSQQ ZidMXH5PkJxUkc9gDFT4LToczigDoSaPqd3TGFdIRB10iFjPlC+IMVbptVAQu0xE1GxL2EMTe+TT EQeqM0Mqb01tUktzhdwYL832o/FtIJOkunIFsRtfH4FPlKAlGkBUhprl2hT0DmHGJN+94mrTTEr8 Ov0cnZR8ham7qUL6RUhcT3yh1lLv02nK8xpqM8035amifGoyslIZMT+VD1e3Vr6f9VpIF0RB7PLp UxvkVtFJUauoPfLP0S2KhonfkhuvmFzLvRCkL3V5arZ8IqhBnrLdTj9WVhG7fF5UoTyK5e9616dm Cuw6adIk6vcuXbrAvGhNG11mb28vLFiTci9dukQZJo899tjWrVtxsud1dPTo0cuXL8MNYcGg9zlz 5uBAxeoZXBIlsfeLL74gF46OjsZPXKi+ZPNdtWoVahOzD37PlMW6TYHGe/ToQWNqzJgxycnJCBoF BQVg5pkzZ9avX9+Acv39/Z944gkUeO6550DFBkEDs4CMjAxvb28EDScnJ0y6QexWVlYtW7asU6fO 008/PW3aNCq5e/du0PUzzzyDAY4whQl+dSOGgthnzZqF+ukEbW1ta+8EXwAPPYWXvUkYk+xQ9F0Y ZeWtK4ECQoTVkunT4RYClTxrkJe/jN3TLK7IZehfdeKBWaxStJDar/B30QbsNWYPY+xRPAJQF1b0 o+VEVGkOL4370extoFi0rKyCKKpczdgGbCbwSXH61Fq0Sq6NyFBelBZQLSOrvIYv9zh+EcfKz1zk s1bzs7iMVKH6mshjRy6p3ivXJq/fKu4B+Vzkm5zaTy1UpBvJj5nou1w/bVEsjItDRO8QotMVltsm EnjubFBSI7fYSBfwdvqxUuvhmny4TOzG16cGxnO4J0wQzYPJzp8/H7guvCk/Pz8+Pj4yMnLKlCki k2TTpk2KGlCeThAeamNjc95QuDJeXl5w4SNHjjg7O9PqWePGjTt27Ni0aVPUQKtnVHjYsGGA7XN/ VTDf/fv39+zZ02yGD4vFslzbtm0Tz+PWrl2LsVZcXEy70tPTMSMODg4GORuMO5QBddNMf/HixcZB A9yOMIX5PoYzpvMrV67s168fBY0GDRogaGCMHz58mAoD2t3d3W8naPz2229t27Y1m+FTWyQDj2xk RLNEdIoXtWT/QmH18pTMDDJoGQOVZuKuDCHG7mkWV0Rt6rU1wTDGWKXZQhkkRNK1Yq8BexhgD7UN td2NVCtjvDTuR7O3gZoM5cPlW87s9VHjk1hlVdcmepkSosQTEAWyyqylOBztpEcG4p1W0eOaLyyI jeIxR+tbRRspbUmNeeIsKqVcDjmjSZ4PVuq8UiGe5mi2kC6m3umLtCV1m2laqkikke9GqllOb9PL FcEh3+tLXV48slE3jGZMt9OPmpdRvM6juIxmr0/NUUlJybx586htrVq18vT0LCsry8zM9Pb2PnPm DLzPw8MjKSkpLS3t6tWrJ0+ehEtS4U6dOikiDKoSVN+mTZt9+/YFGcrX1xcujOkAJgh79+49cOCA ra1tixYtYJS0egYe+P3330HsP/74Y8BfEuYFkyZNMl7rY7FY1RKm52PHjqWR3qtXr9jY2NLS0pSU FMQKRIzAwEAM7TSTEFERB6ysrPQy68RMH+rWrRtqMA4aGNHAckz2EZ0cHR2dnJzGjRsHbu/SpQtC xyOPPPLiiy/6+PiA2I8cOfLXggYOHDRokFidMHiLthZJjU/kRPSdIrl6HRjGrXBDNV8JKQ7XAyrN FxIVEwoD9zSLK5XS2q+CiMTCqTFWabaQ1iH1Tt8sexhgj5wwT1SmBwkAbwMiUmB5pZRFo4eXlvSj wW2g98KvuqPNXh+5JSIxRqTEKDpFQK/IShJpNpYQu7jg4nCRsVNpGbGLJCL1qwRmiZ3OTvNSGKBm pTlip43GxK7ZZnGzoaMVo1Xcorj55bcwFNNVRRssz2NXj1Mhqv92+rGy+sRufH1qguCe4qH2hAkT IiIixK68vLzo6OgLFy6Q8+bn51eaMsnB7bt27RJ9B+NW5KkePXqU0tqB3DNmzDBYyPrzzz8xWcDU wNXVlZbcMV+ABa9Zs4ZWzxo2bIh5wdChQ3/44Qf/6mvhwoVNmjQxzqdlsVjVEqK3/DxOzi5LT08P CwtD3CBWJ4TAX3xfuXIlZdZpvj+ybdu2xx9/XCy2GwQNHIsYiy8I12gJgga+AKrt7Oy6du2Kn6hb t+6sWbOaN28OsK9uxDh58uT06dNpgo92oiUlJSUPRq/JTicnxqgzYei74p0vkXptCbEbA5WFxK7n nmZxhc5OE1MVCdjVInbaaEzsBuxRaYg9aJV49VWR0q9ug+V57Gbx0iyxG98G1SV2g+sjt0Qs1NNG 4ka5NgIzfJcTHiwndvFQQ32hKrUe0IhfRHs0n79QDdQYenyjwDz1JVW/uUntF3Nnxeu38pg1yNsx JnbF850Yk0T75XMRV5iKiess7hlNAq/uGrvmtaIndPK1+mv9WKlF7HJykZrYDa5PTdC6devE+2J7 9+4tKCiAD4K3Yabx8fFubm5XqhQaGirm70D3hIQE2PSCBQtA1JrWhhrA/2Kko/JAlYD9AHscC4/u 37//1q1bYZdw3pCQEPw6DgHPw3ZfeeUVEDvs/nR19Ouvv1pbW1MDMCWp7U+0WayaIMXzuFOnTmGk +/j4HD9+vLi4GMSL7yJoIJhUVFTQgcnJydgCkjfIrMOEWjy/A3sjEKmDxpdffgmc/l+Txo0bB9fD fN/FxYVejXF0dNyxY0e9evWmTp2K0HHo0KFqBY0VK1Y8++yzegsRtV0KCiUvoxe1hOUp3kTDd/kp qt5LW0LicGOg0mQeOb/U2D3N4orme6aiDG03xiqDvB290zfLHgbYg+3iZPGdUtwFvCkqrNYau1m8 NO5Hs7eBHrGrJz5mr4+iJfKavPoGVqc3a756qUd66ixxRXcYv3mqfgtD5IFXqt4qVezV6xFx39KB YoKgaKHizVPR4+I9C73TV7/KKg5Bk9Q5SwJ91e+kVGrlh/81qV8nUdwqt9OPooDcU3JwkG854+tz 36M3zEjkl8IlU1JSaDscNj09Hf579uzZqybl5eWVlZWha+CMcOQLFy6AqylDJiMjAyT/0Ucf6T0+ lhfbp0+frnj0vGjRIpovkJ588skmTZrMnTvXy8vryJEj7u7uqB9U36dPHxA7zPSUZYJ9DxkyRDTJ wcHhYUApFutuKyoqql27djSyMJwRGWh7eXl5amoqBntERATCAgJIYWFhaWkpKB0DGSECMAySp3iC vb6+vm+99ZbIrENUkX9FXmxHiFAEjY8//hjBhI7FF5S0srJavnw5diH40JL7+vXrZ8+eDWIHjloY NBBnXn31Vb1kvwdDCmInj1ZYkkF6s+arl3qkZyFQqd+Mk1dQ9dzTLK7o+az8VpoxVlXeuuBJklPf 1advzB7G2KP3dqdetnC1ZIyXxv1o9jZQL3LKbxnIt5xZNlO0hOqRK9dcY8e5YDuOEs8mqrXGTg8C qDa598Xo+MYk8eyDmkfzXJEkI2ZYiukG1S/2ypNZzZQSAfM0gxN10gkqnrzIVwASj0L0Tl889qJW iUNoCIjhST8n9hLZygcqlt/v1P0pulKR1nKb/SgnccmVq6erxtfn/greSu+L1a9fn14NhrFSfEtI SPDz80uvUmJiojgqKysrOjo6MjIS22GLMGVsLC4uxncw9muvvab5ipZisX3Hjh1nJb333nuA9r/9 7W+C22nJffDgwY6OjjB62Pfu3btB4Pb29ifMycPDY8qUKQ0aNHjwnmizWPdXmDKL53H79u1LSkry 9PQEqGMXxvv58+cpYly+fBnTeXEUtoSEhMTFxVHQoPdSYfr4jnHdokULzQVtxWI7UFxEDNB1jx49 ECIEt0O05I5KCNp///33w4cPg9idnZ3NBg1XV9cxY8ZQPYiKimX/B0kKYpdTR0QZ9eIqvhB1CCSo 1hq7HlAJ5kFJ8eKYOktZzz0NcEWTDOUWChI2wKpKKdmYroCAAYPTN2YPA+whcJUvl8wVtyljvLRw jV3vNhD/0nkJsKSUD8UtZ3x9FC0R94CYNGnWJucX0WWUO1eP9MSauRgC6G7FurHI46KjFIve8i2t zutG/XLzRF5Wpf50Uj4p4mTRU6INIo+dROcr5ywZEHvlra9LqDOvFD8nDzfF5aID79TKs8j8l8/F wqwYs/0osvI0K1fccsbX574I/Dxp0iRqDBgbZkrbi4qKwsLCQPKhoaEZJuXn54PJYcTHjh2Dw5JX ZlQJ/4oFgZSUFBg3Nv7666+Up6pOGheL7VDPnj1lbndzc/vss8/glU888YR8rWDBL7zwwi+//IIy IHZc1eOGWrly5TPPPEPHjhw5Us6tZbFYf1ny8zhMpTHSaTsiAGb3GNpRUVHYmJmZiTCSk5Nz8uRJ zLWxF3/9/f1F0AgICBBJMojS2AK8t7Oz08usE4vt0Ntvvy1zO76DzwnURcQAw4PkraysKLyA2DGz MA4atra2NMGH8F2RWv+ASZ2bTfYkPwqXkxAEowrzooVHddax5uHGQFV5KyGIjGXRPLPuqYcrmtkX QnQKwu71sEoUViCTMegas4cx9qgPvCML7CQDvDTbj8a3gYBwzZarJ4kG14cyZOQHDTS1UdzDMihS 1jT6mjZSDfQdfzWz+uXD0U4cjr9Ed3QINUDuNTpE/dSD8pfkBigk6pfboz4pWahT0Uh6cYOmLYpd 8hWgl4bkFCy9XxGp5uoC4owoXV/vwLvxCJKme+rKb78f6XC5L4TUt5zx9bnHghu2bNmSRsrs2bMj IiJgqWSRCQkJwcHBmSalp6fTS6bQjRs3YKw+Pj7R0dHYlZWVBVMWG2GLcOTAwEA6MDs7G/SOmmkt DhC+bt068etwQxsbm7p164rcchir/M4XCvfq1atevXpyqgz89OeffwaxL1++3FNHW7Zs6d69O5Vv 167dA/lEm8W6LwKuP/nkkxhZ4OoNGzZgjo9RT+CNOX5ycjKNfQx8hAU6pLy8HCju7e2dlJREQQNB hjYC7yMjI93d3XEsHXjt2rXw8HCxjKDIrMOvf/DBByIagNudnZ3loLF06VIgumLJvXHjxnv27AGx Ozk56QWNVatWtWnThspjPoJJx8PQmwqnU7uhAico3Vo2L1FA0+wUhxsAlbpCQkdFtoCxe2riijER qQtoYpUQapYBRpyy5umL+g3AxgB7xIF3kNXlE9HES0v60eA2EFdM7guDW87s9akhw0QvF6hGvYfI erBFqUqPPPKInZ1dlknwWS8vLw8Pj3PnztGWgoICgDccDcZaaTJlkHxWleLi4kRtaWlp+Bc1YDts l8gff/Edc4HBgwcLhIZNi6NgwTK3W1tbY4yfkYSfBvM//fTTtOSOkl999RURu7tK+/bt+/e//y2e aMsTBBaLdftavHgxpZRjXkxBALN7DFIAOWbx+BfhAnZ26dIlbERMAMz7+fkB7Kkwtoh3ZCpNSTII LNiIXTk5OUT+RUVFqARRQi+zDpUruN3BwUEOGvv375eX3DHFQFQBsTs6OqqDBo4VC30vvPCC4tUb 1r2R+s0147VxFuteSmRhYWYhHrXUhJRm1sMjInaY1IABA7p3737s2LFsSTDQ8vJyKllcXBweHn78 +HHMKLELEF5sEmwUhA+3hSnDKMWx9BCcjo2Pj6eNBw8eBJBrrmIRtwMDZG73u1WbN2/u16/fu+++ i+/g/6VLlx65VagBYP+QPNFmse6LiNhHjBjRuXPn4cOHA8XloJGXlyeW1gsLCwMCAsDtiYmJFDQw f0dYQKDw9fVFyVOnTiEIiGMxrkUOjKj2t99+a9q0qWZmnYLbe/XqtX37dkXQWLJkSZcuXb7++mt8 B7EDzuWI4eLiMn78+Pr161MSzooVK/g9l/slkcVNy60ESHJGCot1HwXyAZ/LWVua74qyWHdP4g1x 2Bmc0crKasqUKbgzr5kUFhaG7bTqdfHixbi4ONqenp5eVlZGNdy8eRMe6u/vD/fELkB+aWkpLBsM DzuGX8Oagfp0IDwaf1evXk0WDIucN2+ezNX4bmdnJ7i9VatWmMweOnTotEpE7K5VQp1iKCmW41gs 1h0UEfvHH3+M4PDDDz9gvo8xiyBAYxykjVFfaUqfA5knJCTQ9tTUVMQKqgEhBf8iaNBRCAvYUl5e jn+B96jBw8MjNjaW4gliwpUrV+bMmaOZWVep4nbw+YIFC7y9vdVBA8T+559/iqAxe/Zs8SqN4kVX 1n0REEgmIgASpxywapQoq/y+5zOzHk7JxA4DPXv2LBAaFgwYBpbDLnF/uru7w0CB6zkmFRUVgcaP HTsGL4bPwpRx99KujIwMbJTv7ZSUFKqHTBkbwfOwYJjstGnTRJ7qpk2b5FYpuB3q1KkTXPjo0aO+ VXrnnXe+++47FxeXbdu29enTRzPllcVi3XHJxI6ggcGIaT6Cxvbt2ykOIAh4mJSUlETIjaCBIe/l 5YUQUVJSgkNQhgoD3RFPROWJiYnYRQ/4CgoKaLm+uLgYlYDkhwwZoplZV6ni9rp16/bu3RshwlcS 4sPOnTsRNMD8HTt2FK/P4Cy4W2uOmIhYLBZLraioKLItuNvhw4dB7IGBgd7e3pMmTYKjgX5zJcFA iborTdnp4eHh4Pbk5GTsApCXmHTu3Lnjx4/Dgn18fEJDQ8WxqFk8bgb800b81oABAwSTK3wTBUDj aJj8Ijn+BTDA+kHsoPqxY8eKJ9rYzk+0Way7LcyvMeLq1KkDQkYECAgIwEDGvH7QoEHdu3c/ffq0 HDQKCwvF0jrAG5APcga3Y1d+fn5ZWRn+njp1ChN/bDxy5EhMTAwdiH9RMwUc/BVBw9XVtUOHDiKz DqAut+3q1atoXqtWrUTEQGQYOHDgqlWr8Cu0OIDQobdWwGKxWCxWjdW6desef/xxsuCPP/4Yhgvq Pn/+PHD99ddfhwsHBQXlmRQZGQljFUmqlaYXxLBdnSQDX8Zf7IIdw21xSGZmJiYCISEhJ06ciI+P pwoxBcDfffv2tWjRwuDZNLlw27Zt5QW0Jk2a/P3vf+cn2izWvZeNjQ0NvSeeeGLu3LkgdgoaO3bs wDidOnVqbGwsjXFEDIx6cSBCwfXr17EdAUFsRIi4fPky+JwyZGhpHRtTUlIwN6ckmeTkZIonEL6s Xbu2YcOGmpl1JJA8pvDPPvusCBpoKmb39Pa63lEsFovFYtVkAXfB6uRrjRs3XrVqFcw3ODgYXglU fvHFF2fPng33hFdeuXKFMmTEsTBWEDuMNTExsaSkxMfHJyoqiow1KysLRixK4lj8m5OTg11wbSJ/ oD4MOiMj47vvvhMWrLdaDhdesWKFwHtamccUgHuQxbrHwjDv168fDcOWLVtu3bqVgkZoaOjChQsR NJYtW0ZxICEh4fjx4xj+4liM+qSkJE9PTwz8wsJCBA3spcLYLpJkEFsA6jicdhUVFdH20tJS/Itg Mn36dLOr5WiSra1to0aNRNBQvPPOYrFqpmDu32tp586dcjypme3ERkUjgT3Y/tNPP3HP3m2ZvdTU R7X6HP39/Tt37kym1r59+z179oDYw8LCLl68OHPmzJdeemnDhg0FJkVHR8OC8/LyxLGw4IiICMA8 LBgFcLngtjBW2CXsGBvxF0hfUKXTp0/DqStNa24wetqIicDkyZMtyUiH4YLqt23bxncmi3UfhUHa vHlz8cY3Zu4gdgQNBJNPP/20Xbt2Bw8epNEdGBiIUS/PxPH9zJkzKEkZdwgICBoIHbQR4QJIn5KS QodnZ2ejBprm40CEINoeFBQ0cOBASzLSYaAIGors94dc5Gtqwelq1Cufmu0Etqkb+QAYcW2R8aXG LYS96Ljb/In/0VHr1q3vYEejqlGjRt3xdqKR33zzjSiGYIWNb7zxBt88d1tmL3Vrkx6AM3VwcBDZ JmPGjPHz8wOxg8Z9fX3HjRtHa9owSpgs/Fd4KKm4uBi70tLSRLr7zZs309PTcfXIlIuKirAFh+Df U6dOwV6FKWNow7LxBXOBbt26CQYA8/Ptx2LVWIGfV6xYQe+J16lTZ8aMGefOnQsPD0fQcHNz6927 96BBgy5cuECP0hA9gPTiWIQCxATskhejsBExAUGDmBxRpdK03o7AguCAqhA6APAE+Ygb+OLs7Pz8 889zjlx1Rb6mp8mTJ9+pH8LE7XZAxaCdCtB6YIy45sv4UqO70Tu3+QYxkTDBuSx0OvX+HXnCfvsg rdlOugLyOMIEExvv4LBi/eU+fZACBSx43rx5devWpRyVOXPmwHyjoqJwvyHwAtrff//9hIQEeGVq aio8VH75C24L86WN8FN8SU5Ovm4SCsOIRcn/Y9/sQ+wqzj8efCHFNkGUUlNFE0tsKhW1FIkSDELR gKAmUlppqMpqGyFolRUtvsSAQf+oDSELBkSjBFqpQti2Gl9iNtHEdU3SvG2ja5IaW7vRRI1xzYsJ Xn7f3q/3+T3OzJl77u6a3bv5fliWc2fmzJkz55zn+c7MM0hHCrPolMHhw4fphRcvXvy9732PL7ym xYQY5kAkz5gxgx/sqaeeumDBAjMajz/++I9+9KM777wTkhufNixDECSDrx6JL7/8MhIhxVeuXLl7 925ahnfeeQcpZpdQwIyG7Z3BAX7u2bNn7ty5jH6B1VLcSxno12JFZGudgzWNOUD/mGwnZBtSAr88 vYqe7FHgqCn2pO6iaB+UZz1Yij2uYcmSJYM4shCD+ExH3tAePnTatGl838aNG/fUU0/B+cKBbt++ He74jDPOuO++++BMIbC3bt0Kb7tv3z47Fy64u7v7tddeQyIKQJBDycOxbty4cdWqVagB5eG+kbV/ /3642jVr1nC5HP9R5vMqn3zyya9//Wtc/YYbbtAbKMTwp7Oz8/zzz6fROO+885577jkYjW3btkG9 Y+D/gx/8YOHChfy6O6v4IJlDhw6tXbsWiSyArC+//BL2ASmwD2+//fZLL70EW8FcWA9b4IORQf1M h9WaPHkyrq6QuTKYEo6zbNpwUC40WIo9TqdoVyTM0WdoFXuc1d7ezkEcwIEXyfE4DmNSnNtWhU3F WUxhAZyerw0leQqum2knB7+8ejzHjuOJNXDs5zH6+vpaW1uZhbOCN5zNjk/EhZAeRIvxZi2R8/9x tdY8XhdV8cRguIHcOLFSi4MqirIresQY1CRvxPoZr5A9iKAAGuw70D8mU+y4uvUhnlTm7S3qluYC PTB+/Hi64EsvvRQ/obd37NiBvvrd7343adKkv/zlL1zXhlelD4XfhCDfu3fv/irvv/++D5LZvXv3 pk2bmEV/jUSI85UrV77++uurV6/GKABZ0Pyoau7cuVLsQjQXUMsWWXfdddetX78eRuNf//oXBPnM mTOhqDFsxzfO6XSIbZyCY3z++2v4xTj8/PDDD7u7u5nFqXVby0NVsDyMuIPRgKm56qqrpNhLklHs cZb3j3BqcLWWRf3g/TK9P3woD/gyeLmCx1dUG3WCuXJ4z0w7OY1pWYE2My8c665KJHt80HWR/GOF gQJhPXYLdUWIiT3WFsgDRhDFmqFoG2Y+njyjPE2P2YOIu4jyLPmYmGg3G7Q5VuyZbimi7hy7vU5o p71jHMQBa20sz9g8dp2Vt9h4mxufUiWuzcdlIT3TTv/qBhO/fqQQrBahc5jic+3Fjk/Ef3Y1+8EH z7Mqu/3MRYPYM+TiRY2j44pGatZRMUVz3RzOJG/E+nmiw1cFwxJ3kS1n+HthgWDRMLiLTLc0I/Pn zz/ppJMYp3rTTTdt3bp1ZxUI7Msvv3zq1KldXV0HDhzAu7FixQp44U8//RQ/IcjhQHft2gUB/+67 73788cc4gGI/UAUpEPOsH/73v//9LwrwLPxEDS+++OKtt94qxS5E04EBu4+su+eee6DYaTSWLl16 4YUX/uIXv8AxvnekL1u2DAaWZuHQoUMwGtu2bXvhhRdgEBgtw8A5ACuNRF7i888/37NnD+0JzsLA Hz+fe+45WCQp9pKUn2OHjIz9o7lyFvaCzWq2aXD+pOqwxGRt5j0tDDjTzkrNs9PRe0ec1AM205iU PRTtGfkHPRB7c1bFmsuIEC/24vuiFo3nMPPbMJM9k1eevp9NEeW7KNA8XhElVaXdeL5biiiKY7eG sal8KPhpnRaEo2QUeyUS0qaWraNQCWvgKMMUHU5k/RnF7gWzvxDb7EeXfO68aDAewWvJi3LUxkps yGN9W6nq2OB98KqbJXGuDU6ZwlxTufzi8MkHat+anQzFb3SO3V5+ew3YVOtG62feqT0X9jm7yNfM e/HP1DcVt8PL2UMMDEVRtzSvC549ezY7YezYsQsWLNhR409/+tO5554Ldf3BBx8crOHnK+CCN2/e DHnPxe4vvvgC7hWJ69evf/XVV7dv375q1apPPvmECh9ZXAGH85ViF6J5gd6+7LLLaDTGjx8PQ2FG g5F1sK4wLGY0YB/sXPx8/fXXYTeYdfjwYVgGiHMkvvHGG0iH0di3bx+0Ogb4sBsbN26k0ZBiL09R HLvt7DOHSF9pP4NwlIxit9PjGS0/384UyhXTY3CyqAcipIxij7UZj80TUYfzoqYNfDgBJydLyj87 kRqJMqO8CDGxxxQfxlA0h9noHHtd5Wn9bHdqnVD5utLL3wt7OLicV+x1u6WIzCDFB2ZQX/mJ5SCx IcXOiwZqjS8P3//4kWUUe8WNKP2F2Cc+WIXvOTszeMd4Ca6A+Lc9+Qn48WPwM67Wd07yKwvGj0XD yX7gP/kg0VobLNPw6mZzgmfkn0LmXnh6bCiKuqWp2bBhwyWXXMJP5oc//OEzzzyzrcY999xz+umn P/LII4eqdHZ2dnV1wZl+/PHHy5cvP1TDr3fDC0Pk4+kgnTIeryvcMd4HKXYhRgbLli3zkXUrV66k xeju7v7tb387adKkZ599lsYBHz6DZGA8YUDMaPz73/+22j777DMYDQzzkQ4DgpQPP/wQA/9XXnlF ir1RgnXweE2cxUxd+HN9YkOKPelM/ZQjvbafPcsrdq++7EI2PWjBq3Au1P+VlFpAAxjuUlf+efEW /CwpQmKxZ5ejlA2u3j/qKk/fb/7qJik5fsk800C8+dO9Yq/bLflbsBEl46uD6dBKQcy8fz8bUux+ ZcHwy0DJEOgixe4nvYML+UUK1Gz9U3d8Gmf56WU/1OJX4EWsLbgYNvOc3K3JbrS1gIyO5YgjSfIp 26OM+5ldUdTP/o3lMJbR+z6aJXkv/jEF45RMt4wAO7906dLTTjuNt3nttdeuWbOmp8ratWuvv/56 uGBIdChweFL0JzzvgQMH8JOzZO+//z5y8X/Xrl3ws/C/yIKwR9bOnTtRePXq1VTsd91116mnnopL 3H333fKtQjQ1PrLulltu2bx5M43GihUrfvazn02dOnXLli0wBe+99x4+fx6DI0eOwDi88847MBoY +2/dunXVqlXM4jodFD6MBhX73//+d4zux4wZg6v8+c9/Vp/XJZ5jN1fl9U/sKCtfX+5vSLGbDEu6 yEpKgPUvKsZWChiNAyVj/jc5q0bqyj8/qR5U1Q8RkgwzTiocjjiKKLqRjPJkgViTe52DFE5m+miW +JnGj8l3Y91uKSJWwra44+NJko/M30v/FHsML9qQYrclm0oq/IY7CPwwOZiKT77t8YcQfIBWxg/Q TJomby1zXauNX0HRcLLROPY4TN2Ip8Hj20Rj/JAnCHTvh2Iv6paRYeoPHjw4Z86cE088kXGqt99+ +4YNG7ZWgd+86KKLrr766u3btx+uAWVu58IFv/32293d3dwphhRIevhodA4V+2OPPfbjH/+Y3Th5 8mRoe/lWIZodfMg333yzRdb94Q9/2FrjySefPPvss2+77bbdu3fTYsDCwCzYuZDob7755o4dO8xo 7N27d+PGjTQaUOwPP/ywzeRfc8013NUu8iSVsCkWm8ZMKvaK83r9U+xJKv1V7H7d37L8vkLWUKSc g9vPyL+K09VBNHI/REjFRRr4GdGYRuPY6yrPon62gYnXYLZ9r9+KPdMtRSSVMPvcv2/x0KPy9Qn/ fij2zFCiIcXO2W/bvpEsxmERr8s4mfiZ4t3AHXG7ZdErZB3Cn9x7YsPJ/EeUaR5vAR3CaouWRTis S5IMCM+MmvP9bJ+ShdyzkjgqJqnYg4WSut0ywlzwjBkz+PmcdtppixYt6q6xYMGCCRMm3HXXXTD7 8LBr165Fz0Cr45Surq4jVb6ssnPnTsj1TZs2ocDLL7/sK9REmRAjDAztMQznN37OOec8++yzZjRg Lk4//fQ//vGPMA6HDh2CDoeYxyn4j7PMaMCMbNu2DUaDiv3pp5+++OKLWeGkSZMGJcbyGCHprWyb mwnRIHKDeF3RD8We2dXVkGIPNm8m9QyaCrVDvcHcODqFDcOF6sq/iotdMTHjr96QCLFbQFXsmeQ2 PV60SBH5CeegGzPKM6/Y2V0MF2dH5fcmVLKKvX8BBkVKmFPHVqffoWDEQcu+AX4XRqDu+HCDLuVk eD5aI25nsAPCX4hjyaLQr/j95D3if/KxBiHftj86uJE4kCkOm4nvwmrLDCf7QTDKsHfSNhRnFHvS INgGUt+ZcfRU/BDz3TLy6OzshKPkm/nTn/4UI7vNVaDSb7vtNu44g5Pds2cPSv7zn/9kDAzYt2/f Pxx33HHH2LFjOWl/99137927Vy5ViBEJBuOnnHKKTYmvWLGCRmPNmjUzZ8684IILkAJD8Z///OeV V1559913aTRw4kcffWQWY9WqVTfeeOPo0aNRycknnzx//nx1bEMUKWHYcD4aBoH7lX3Dq5RYhGeE tEl970y5xu2jNcoo9mADrL8Q9+gFusuEENWC10smS+rKP3+hQFT0Q4TEtQ1W6Gxd5ZlX7PG+v/iZ BjrHd52vvG63FJGZu/abl23Tq13C1nH8HlsUxk9ckdIuUOzc8mAbP/07wJ70sU/JbyHYwW1BWVZP vPPUb/v1s/HsSdsZbRtO0Xg7kQ+RoTVxL9nSktf21k5e1HZ8s4WZaByrrWg42Q9srcTqDG4ko9jN hljv2QpUHLTPPmTl+VW/ZLeMVB599FE4TfbSr371q1dffXVDleXLl19xxRWTJ0+GL6ZQr9QCY7pq 4FzT/NOmTXvrrbfkTIUY2TCy7oQTTsBXD9V96623bqjx9NNPY+wPJb9jxw4zGkeOHNmyZYsZjQcf fPC73/0ujcasWbMUO9cPMnPXgff0mqfigkgp6b3m8bmBuuOyfsXN3waCJK8kA0VkMcBeYwQ7T70e MN1VqQ1JYh/NWPe8/COxHqv0S4T4YrHAHiB55VlGsfvdx8lnan3Iyk3D+8rrdksRGcVug0pezjfP DmzTsRU25RnsurV09hXjSXxt8UpK3M5ktJJfmQoksT1032Z7x3xQE4tZVdTzPpexNL5JtgwR9Jvf 3BF8PhnFHixqDBbxjfjQ8XxUTNx7yTn2kpVnumUEs3fvXnsEY8aM+f3vf7++xpNPPnneeefBse7f vx/FVtf461//evnll/OU8ePHL1u2TG5UiGMHKO0rr7zSAuEWLlxoRuORRx6BTeDM+XvvvWdGY/Hi xTAmts+ls7NT3dg/Moo9EK4WLuLdn581tZhn83dFm0ArTiF7QWLCskhJJhVRPItuF7WYhKSKiz2+ VZWXf8RUaBA/06gICWrL78RslLzyzCv2uPfQP3Esgf+fqTzfLUWgW/COZcKEkGtXxEvFaHAQn4Kq GGiN/x1VUNieHeQuh4F2oq8NjfdPmSXjdgbE4Xl9fX3B7aDxFv4dt5mh49bm4IqMkEGB5DvD9ie7 zi7K7diZ5vkXadCHk8GNAFzdjwiK+tm6wvrHHhBP6avCe0G6lclXXtQtI5633nrrsssu4+d55pln PvHEE2trnHPOOegWfi8vvvjib37zG65of+tb33rooYe0WUyIYxMYBFtl+8lPfvLMM8/QYqxZswYy HuN6Go2//e1v11xzjfa5DBb0a0W7/+Cmg1xGg8fuz3K99gjONSUT1wZH6VUHlZiPmbF2enBK3Ibg El4PxG02FRfLnrz8S14redG6IsTIbIYdCBnlWdTPdr9e5bJ/eAqnc3kvjMqIVWVceaZbxDAn2K8h Rh7Lli0766yz6FunTp36/PPPd3V1wRcvWrTopZdeeuCBB77//e8z95e//KVWtIUQjz766Le//W3Y hOOPP37mzJnLly+H0YAZgYCH0Zg1a9aYMWO0z0WMPGzzqbpCDB84gisZwiSanYMHDz700EMnnXQS XfANN9xwwQUX3H///RdddBG1On7GK0dCiGMW6PDZs2fTPnznO9+58847odjvvfdeW3bXPhcxkoAi am1tHdw9p0IMChYaF0eFiZHKrl27brzxRnpb6HYenHzyyQxPFUKIAB9Zd9xxx2mfixipxPsKhRg+ MLpJY8ljjc7OzgsvvJCmadasWVrRFkLkWbp06bhx42AxRo8erX0uYkTCzQJaaxZCDDeg27WiLYQo CVQ6xIz2uQghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghmoh1 69ZNrFKUNX369EG5UHt7e2EeLoEGzJtXmLVuXSJrypTKILVNCFGeefPmFVkGZs1LfsuDazRgFoos A7OM3t5KS8tXifhDs5EihBBCNBWQ5aNGjSpS7MiaAmE8MHp7e1F/rh5kjRqVVuzMiv0y0wfcNiFE o0CQF1kGZg1csdc3GjBZSctQ+bpi7+n5qiT+ozY7lmgXQgjRVBwFxV6/noYUO1wwE6XYhRgKjoJi r280Sir26dP/V6yl5f9zcYwULc8JIYRoKhpV7L29vW1tbfDI61K+sqOjA1ko0ANdXaWvr2/JkiWs B6fgZ6IR5RV7a+tXnlpz7EIMEY0qdliDwCx4ewL7gFz8763Ne5cyGiUVO4/9jDpO4TS7EEII0Tw0 pNhbWlpQclQN+lMr7LMAw1zpwY15GVleRrHjJ/7a279yu1LsQhx1yit2SHQUi80CgSz3RgPHrRiS lzQaJRU7CgSnS7ELIYRoQkyxz4uA9/R+GXKdP+FnOzo6+BMnct6MnhenoEJzxG1tbSjJengJ/Ew0 grIcrhy+NfgL/LLN0UmxCzFEUFEnjQYEudfYlOtIxIcPs8CfNCmwG6wEVgJGg1tWkYL0UkaDlgEK P2k0MoKcUTE+TkYIIYQY9lCxZwjcq1+hpmiHO2aun3ODk8XPlqpbLBvHnvmLZ9Kk2IUYIoI58Bgq dkjxYFK9UtPwbVVw0OKUM87ihEClfBx70V+RYm9r085TIYQQzUjJOXb66JavT0z5iBrOj6FwHK1a VrGXmWN3lUqxCzEklJxjpzinAg/OtWE+j30Qe1mj0Y85drSEer69XQ9RCCFEc1Eyjj25oaxSFeo8 Nw5JNXlfVrGXiWN3jZNiF2JIKBnHTsUebFH31qC1tdWMBi2JWZiyir1uHLtBuY70r48ghBBCiKZg sBQ7aWtrmz59unlhnivFLsRIYiCKvaOjw5/b29vLYBgzGtx8OsiKnbHrSEyWF0IIIYY9JRV7MiSV zpfB7SjQ7taakUUxD48sxS7ESKKkYmeEDCyDL8BYu5aWlp6eHhTzEXQ0MrRFg6nYaUPwX7HrQggh mpaSih3Cmwrcz5jRI8P5xpVAw9v0e+YSXyHFLkTzUFKxL1myhMVsuzrNAoPb460xGPIHC3M5o1FS sXN2HXXW2iCEEEI0IyUVe6U2OcYAdS5k2wR7pbYCjv/cgMafdMdU+7YvNdEIKXYhmoeSit3MAj7/ 1iq0A1yqM7OAn9znzp80EfWNRhnF3tv7VTGmBH9CCCFE8wBZHsSiB1k+Egau0+8UgyDvczNXPoLd 7zyt/G+iq4VXCeJq7Mz/OdCkYmdWUrEjPVmbEOKbBAK76Ftmlt/wEmwv9VmwMD6CPcitYzSouvOK HVI/qdWl2IUQQhwD9PT0rCvewLWuinpJCGFkzAK3ushoCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ QgghhBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQ4htiXpX29vY4C4lBVk9PD8svWbIkX2dHR0fd S6MMSs6ZMwf/+/r6MmXQBh6UqVYI8c2BT5VGANYgzm1rawuyyhiN3t7ejBEIDMKcKihfVMbawIMy 1QohhBDDHLjRUaNGTZw4EU7Tp69bt25iFXO+LS0toxzIQpm4QhYL/Ckk95QpU4KSSEEl+I/y8K3J 5jGXcj2uNgkaPH369GTbhBADh994/EXjKw7SSxoNfuZBFj52fMhJowFQPjlkgB1jgaJqkyQNlBBC CDGsoFcNnCOdnU2LUTDDDyIFHpCn0C3GVcXS2nxokIjyHDIk3SU8sl0FYgBlioR93HIpdiG+OfiV +c88HuOXMRp9fX2sKvhmcZw0CzQarKq1tTVuGEcNKEBzhBqSwj6uNjZQQgghxLACTpNzVuZ/6RDp 9Qg9mnepPMVSOjo66HmDqvzpPgXlOXluVcWONeOXM0ixC/FNw+/XPmH77vyYuq7RgJJnSknFbkaD B0mNbatyDd2OFLsQQoimwDwgZHM86c3cYBIeJeFVLUaUnhcaGwLbK3YUszk0HNgoAAfmIouUOd0o w3WCOXauYrMADmwtAI1kS5BoDUYbeDmCdMXDCzFAOIVOQxGP8esaDWpyfI+oJxhl82Nnrv/qvdHg Zx58yH5VrhLNsSeNRpGBQmEaE4L0IG5QCCGEGBKotOnRAldoMeRIRDGUwf/Af5kMDgLOuVZuUazm wek0eZycMePAwcr7ai32fkoVVk637q/FCuGRmcjyVkCiXYgBwq/Pwl38Hs+6RoPjaKYEih1n+Q/Z jIk3GqzfjxEq0SYaX22R0UgaqKCwGRA9cSGEEMMBc2RBTAu8GOfAg01kNrPtSW4RDRadORXmy8TD BF40CKTnKcHCd3t7u/engfdnPX6xPrk3VgjRKDYcjofADRmNOJItjooJjIbfYRrYGRsX+GrzRiOo KojnsbhBxdoJIYQYDti+Ubgzn25KHl54XRWbVYtXissodu4O8+4vnjELTvHV0nt6EQ5HbLXF83XB RJxfzRdCDASbfw5MQUNGo4xij41GMKiP43B8tXmj4a0N9DlMRBCkF++0FUIIIYYETjrZVJhf4LaY Ul8+nrsmZRQ7A0R9gWDGjN7ZK21fLY9t2Ro//a7V5M5TeGcUw3VtjVuKXYgBwil0flBByHpDRqOM Yo+NRhA4Fwj4oNq80Yin62GRUBVj7G0dQYpdCCHE0ELBTGdqsamWG28rq9Q8YOCmK+UUuw9oN7zD ZRu8Sw2qRTHvSX3zAu+PkkFwuxS7EAPHAktwEM9gN2Q0yij2pNHwYTCx6o5NQZHRCM7FSCRpNKTY hRBCDC1Uy/RfFptq/je5ySuZWCmh2OmL43BWmzFjwGqgqJPVch7Mgnl8wKpf72Y7kULPrqgYIQaI hXbTSnBRDCk2ym7IaNRV7EVGg99+WxWGzeerLTIa3kAxuobWJoi1k2IXQggxhNCN+kgY87+UuJTQ gxUVw/mrOJbVipkXTlaLRnKizOfSn/IU76bp6IPCrF+KXYh+w8/fT3oHn1VDRqOuYi8yGja6j1fl fLV1jYY3UMkRvebYhRBCDC1wZ3RGHR0dPp2+1dyWhcr4aerAA5IixU7nCJcau06DYbHJmn21QdwO Ws766a8tF7dmssHuzsJZpdiF6B82ove7XWzW3Sa6yxuNIsXOkJuk3g7OTX7Rvtq80fAGKpivwH+b kJdiF0IIMVQUrfaa/2UW3JZtJWM6nWlcYVKxU/+DCRMm4MRg8dqgwK4bbGOjDGuM1wl0uOZzzdta Yc2xC9Fvisb4FRdPwqzyRiMZvmKf9nXXXZcxGva9xzEzwXJbxmiYgeK4wDebsEBRG4QQQohvFDjW eVVK5sI5wnPBncFzJcNa7KzYm7Oqn//8537GOwaXQLFgdTuuFlfHT66GQ4EHFbIShtBUqhHy1myW 9LlCiPLga8K3E0e2+E/Pi+cyRoNnBd8jjAC/0+uvvz5vNIqMWFBt3mjMq2HnsiRSeqtkTKUQQggh hBBCCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiEHk/wYAgu0smQoNCmVuZHN0cmVhbQ1l bmRvYmoNOTUgMCBvYmoNPDwvU3VidHlwZS9UcnVlVHlwZS9Gb250RGVzY3JpcHRvciA5NiAwIFIv TGFzdENoYXIgMTE4L1dpZHRoc1syNzggMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAw IDAgMCAwIDAgNTU2IDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDcyMiA3MjIgMCAwIDAgNzIyIDAg MCAwIDAgMCA3MjIgMCA2NjcgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCAwIDAgMCA1NTYgNTU2 IDAgNTU2IDU1NiAwIDU1NiAwIDIyMiAwIDAgMjIyIDAgNTU2IDAgMCAwIDAgMCAyNzggMCA1MDBd L0Jhc2VGb250L0FyaWFsLUl0YWxpY01UL0ZpcnN0Q2hhciAzMi9FbmNvZGluZy9XaW5BbnNpRW5j b2RpbmcvVHlwZS9Gb250Pj4NZW5kb2JqDTk2IDAgb2JqDTw8L1N0ZW1WIDg1Ljg2My9Gb250TmFt ZS9BcmlhbC1JdGFsaWNNVC9Gb250U3RyZXRjaC9Ob3JtYWwvRm9udFdlaWdodCA0MDAvRmxhZ3Mg OTYvRGVzY2VudCAtMjExL0ZvbnRCQm94Wy01MTcgLTMyNSAxMzc5IDk5OF0vQXNjZW50IDkwNS9G b250RmFtaWx5KEFyaWFsKS9DYXBIZWlnaHQgNzE4L1hIZWlnaHQgNTE1L1R5cGUvRm9udERlc2Ny aXB0b3IvSXRhbGljQW5nbGUgLTE1Pj4NZW5kb2JqDTk3IDAgb2JqDTw8L051bXNbMCA5OCAwIFJd Pj4NZW5kb2JqDTk4IDAgb2JqDTw8L1MvRD4+DWVuZG9iag05OSAwIG9iag08PC9Db3VudCAxOS9U eXBlL1BhZ2VzL0tpZHNbMTAwIDAgUiAxMDEgMCBSXT4+DWVuZG9iag0xMDAgMCBvYmoNPDwvUGFy ZW50IDk5IDAgUi9Db3VudCAxMC9UeXBlL1BhZ2VzL0tpZHNbMTA2IDAgUiAxIDAgUiA0IDAgUiA3 IDAgUiAxMCAwIFIgMTMgMCBSIDE3IDAgUiAyNSAwIFIgMjggMCBSIDM0IDAgUl0+Pg1lbmRvYmoN MTAxIDAgb2JqDTw8L1BhcmVudCA5OSAwIFIvQ291bnQgOS9UeXBlL1BhZ2VzL0tpZHNbMzcgMCBS IDQwIDAgUiA0MyAwIFIgNDYgMCBSIDQ5IDAgUiA1OSAwIFIgNjggMCBSIDc5IDAgUiA4MiAwIFJd Pj4NZW5kb2JqDTEwMiAwIG9iag08PC9TdWJ0eXBlL1hNTC9MZW5ndGggMzYxNC9UeXBlL01ldGFk YXRhPj5zdHJlYW0NCjw/eHBhY2tldCBiZWdpbj0i77u/IiBpZD0iVzVNME1wQ2VoaUh6cmVTek5U Y3prYzlkIj8+Cjx4OnhtcG1ldGEgeG1sbnM6eD0iYWRvYmU6bnM6bWV0YS8iIHg6eG1wdGs9IkFk b2JlIFhNUCBDb3JlIDQuMC1jMzE2IDQ0LjI1MzkyMSwgU3VuIE9jdCAwMSAyMDA2IDE3OjE0OjM5 Ij4KICAgPHJkZjpSREYgeG1sbnM6cmRmPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5LzAyLzIyLXJk Zi1zeW50YXgtbnMjIj4KICAgICAgPHJkZjpEZXNjcmlwdGlvbiByZGY6YWJvdXQ9IiIKICAgICAg ICAgICAgeG1sbnM6cGRmPSJodHRwOi8vbnMuYWRvYmUuY29tL3BkZi8xLjMvIj4KICAgICAgICAg PHBkZjpQcm9kdWNlcj5BY3JvYmF0IERpc3RpbGxlciA4LjEuMCAoV2luZG93cyk8L3BkZjpQcm9k dWNlcj4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgICAgIDxyZGY6RGVzY3JpcHRpb24gcmRm OmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOnhhcD0iaHR0cDovL25zLmFkb2JlLmNvbS94YXAv MS4wLyI+CiAgICAgICAgIDx4YXA6Q3JlYXRvclRvb2w+UFNjcmlwdDUuZGxsIFZlcnNpb24gNS4y LjI8L3hhcDpDcmVhdG9yVG9vbD4KICAgICAgICAgPHhhcDpNb2RpZnlEYXRlPjIwMDktMDctMjlU MDI6MDM6NTkrMDI6MDA8L3hhcDpNb2RpZnlEYXRlPgogICAgICAgICA8eGFwOkNyZWF0ZURhdGU+ MjAwOS0wNy0yOVQwMjowMzo1OSswMjowMDwveGFwOkNyZWF0ZURhdGU+CiAgICAgIDwvcmRmOkRl c2NyaXB0aW9uPgogICAgICA8cmRmOkRlc2NyaXB0aW9uIHJkZjphYm91dD0iIgogICAgICAgICAg ICB4bWxuczpkYz0iaHR0cDovL3B1cmwub3JnL2RjL2VsZW1lbnRzLzEuMS8iPgogICAgICAgICA8 ZGM6Zm9ybWF0PmFwcGxpY2F0aW9uL3BkZjwvZGM6Zm9ybWF0PgogICAgICAgICA8ZGM6dGl0bGU+ CiAgICAgICAgICAgIDxyZGY6QWx0PgogICAgICAgICAgICAgICA8cmRmOmxpIHhtbDpsYW5nPSJ4 LWRlZmF1bHQiPk1pY3Jvc29mdCBQb3dlclBvaW50IC0gU0FWSS1pZXRmNzUtQ0VSTkVUMi1kcmFm dC5wcHQ8L3JkZjpsaT4KICAgICAgICAgICAgPC9yZGY6QWx0PgogICAgICAgICA8L2RjOnRpdGxl PgogICAgICAgICA8ZGM6Y3JlYXRvcj4KICAgICAgICAgICAgPHJkZjpTZXE+CiAgICAgICAgICAg ICAgIDxyZGY6bGk+dXNlcjwvcmRmOmxpPgogICAgICAgICAgICA8L3JkZjpTZXE+CiAgICAgICAg IDwvZGM6Y3JlYXRvcj4KICAgICAgPC9yZGY6RGVzY3JpcHRpb24+CiAgICAgIDxyZGY6RGVzY3Jp cHRpb24gcmRmOmFib3V0PSIiCiAgICAgICAgICAgIHhtbG5zOnhhcE1NPSJodHRwOi8vbnMuYWRv YmUuY29tL3hhcC8xLjAvbW0vIj4KICAgICAgICAgPHhhcE1NOkRvY3VtZW50SUQ+dXVpZDphNGI4 MzlhNy1mYmExLTRkZGEtYmNiNS00YzlkODM1ZGJkMGU8L3hhcE1NOkRvY3VtZW50SUQ+CiAgICAg ICAgIDx4YXBNTTpJbnN0YW5jZUlEPnV1aWQ6MzBjM2RiMDYtYThjNy00N2MxLTkyNjQtOWU5NWEy YzU2NTk5PC94YXBNTTpJbnN0YW5jZUlEPgogICAgICA8L3JkZjpEZXNjcmlwdGlvbj4KICAgPC9y ZGY6UkRGPgo8L3g6eG1wbWV0YT4KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAK ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAKICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAogICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAKICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg IAogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgCiAgICAgICAgICAg ICAgICAgICAgICAgICAgIAo8P3hwYWNrZXQgZW5kPSJ3Ij8+DQplbmRzdHJlYW0NZW5kb2JqDTEw MyAwIG9iag08PC9DcmVhdGlvbkRhdGUoRDoyMDA5MDcyOTAyMDM1OSswMicwMCcpL0F1dGhvcih1 c2VyKS9DcmVhdG9yKFBTY3JpcHQ1LmRsbCBWZXJzaW9uIDUuMi4yKS9Qcm9kdWNlcihBY3JvYmF0 IERpc3RpbGxlciA4LjEuMCBcKFdpbmRvd3NcKSkvTW9kRGF0ZShEOjIwMDkwNzI5MDIwMzU5KzAy JzAwJykvVGl0bGUoTWljcm9zb2Z0IFBvd2VyUG9pbnQgLSBTQVZJLWlldGY3NS1DRVJORVQyLWRy YWZ0LnBwdCk+Pg1lbmRvYmoNeHJlZg0KMCAxMDQNCjAwMDAwMDAwMDAgNjU1MzUgZg0KMDAwMDAw NTA3NSAwMDAwMCBuDQowMDAwMDA1MjEwIDAwMDAwIG4NCjAwMDAwMDUzMjIgMDAwMDAgbg0KMDAw MDAwNTg1NCAwMDAwMCBuDQowMDAwMDA1OTg5IDAwMDAwIG4NCjAwMDAwMDYxMDEgMDAwMDAgbg0K MDAwMDAwNjM1MCAwMDAwMCBuDQowMDAwMDA2NDg1IDAwMDAwIG4NCjAwMDAwMDY1OTcgMDAwMDAg bg0KMDAwMDAwNjkwNSAwMDAwMCBuDQowMDAwMDA3MDQzIDAwMDAwIG4NCjAwMDAwMDcxNTYgMDAw MDAgbg0KMDAwMDAwODIwNSAwMDAwMCBuDQowMDAwMDA4MzQzIDAwMDAwIG4NCjAwMDAwMDg0ODYg MDAwMDAgbg0KMDAwMDAwODgxNiAwMDAwMCBuDQowMDAwMDU3OTY4IDAwMDAwIG4NCjAwMDAwNTgx MDYgMDAwMDAgbg0KMDAwMDA1ODI2NCAwMDAwMCBuDQowMDAwMDgzNTgzIDAwMDAwIG4NCjAwMDAw ODM4MTEgMDAwMDAgbg0KMDAwMDA4Nzk0MyAwMDAwMCBuDQowMDAwMDg4MTczIDAwMDAwIG4NCjAw MDAwODgzNzkgMDAwMDAgbg0KMDAwMDA4ODY2OCAwMDAwMCBuDQowMDAwMDg4ODA2IDAwMDAwIG4N CjAwMDAwODg5MzAgMDAwMDAgbg0KMDAwMDA4OTYzNiAwMDAwMCBuDQowMDAwMDg5Nzc0IDAwMDAw IG4NCjAwMDAwODk5MzkgMDAwMDAgbg0KMDAwMDA5MDI3OCAwMDAwMCBuDQowMDAwMTQwNTQzIDAw MDAwIG4NCjAwMDAxODQ5MTQgMDAwMDAgbg0KMDAwMDIyNzYwNCAwMDAwMCBuDQowMDAwMjI3NzQy IDAwMDAwIG4NCjAwMDAyMjc4NTUgMDAwMDAgbg0KMDAwMDIyODQyMiAwMDAwMCBuDQowMDAwMjI4 NTYwIDAwMDAwIG4NCjAwMDAyMjg2NzMgMDAwMDAgbg0KMDAwMDIyODkxMCAwMDAwMCBuDQowMDAw MjI5MDQ4IDAwMDAwIG4NCjAwMDAyMjkxNjEgMDAwMDAgbg0KMDAwMDIzMDAzNyAwMDAwMCBuDQow MDAwMjMwMTc1IDAwMDAwIG4NCjAwMDAyMzAyODggMDAwMDAgbg0KMDAwMDIzMDg4NSAwMDAwMCBu DQowMDAwMjMxMDIzIDAwMDAwIG4NCjAwMDAyMzExNjYgMDAwMDAgbg0KMDAwMDIzMTQ0NiAwMDAw MCBuDQowMDAwMjMxNTg0IDAwMDAwIG4NCjAwMDAyMzE4MjYgMDAwMDAgbg0KMDAwMDIzNDgyNCAw MDAwMCBuDQowMDAwMjM0OTg3IDAwMDAwIG4NCjAwMDAyMzUyMjcgMDAwMDAgbg0KMDAwMDIzNTQ1 NiAwMDAwMCBuDQowMDAwMjM1NzAyIDAwMDAwIG4NCjAwMDAyMzU5OTAgMDAwMDAgbg0KMDAwMDIz NjM0MiAwMDAwMCBuDQowMDAwMjM2NjMxIDAwMDAwIG4NCjAwMDAyMzY3NjkgMDAwMDAgbg0KMDAw MDIzNzAwMyAwMDAwMCBuDQowMDAwMjM5NjI2IDAwMDAwIG4NCjAwMDAyMzk5MDIgMDAwMDAgbg0K MDAwMDI0MDA2NSAwMDAwMCBuDQowMDAwMjQwMzUzIDAwMDAwIG4NCjAwMDAyNDA2MDkgMDAwMDAg bg0KMDAwMDI0MDkwMSAwMDAwMCBuDQowMDAwMjQxMTU1IDAwMDAwIG4NCjAwMDAyNDEyOTMgMDAw MDAgbg0KMDAwMDI0MTU1MSAwMDAwMCBuDQowMDAwMjQzNTk5IDAwMDAwIG4NCjAwMDAyNDM4NDUg MDAwMDAgbg0KMDAwMDI0NDAwOCAwMDAwMCBuDQowMDAwMjQ0MzQ1IDAwMDAwIG4NCjAwMDAyNDQ2 NDMgMDAwMDAgbg0KMDAwMDI0NDg3MiAwMDAwMCBuDQowMDAwMjQ1MTY1IDAwMDAwIG4NCjAwMDAy NDU0NTcgMDAwMDAgbg0KMDAwMDI0NTcwMCAwMDAwMCBuDQowMDAwMjQ1ODM4IDAwMDAwIG4NCjAw MDAyNDU5NTEgMDAwMDAgbg0KMDAwMDI0NjU5OSAwMDAwMCBuDQowMDAwMjQ2NzM3IDAwMDAwIG4N CjAwMDAyNDY4NTAgMDAwMDAgbg0KMDAwMDI0NzExNiAwMDAwMCBuDQowMDAwMjQ3NjUxIDAwMDAw IG4NCjAwMDAyNDc4NzMgMDAwMDAgbg0KMDAwMDI0ODE0NyAwMDAwMCBuDQowMDAwMjQ4NTI4IDAw MDAwIG4NCjAwMDAyNDg5MzMgMDAwMDAgbg0KMDAwMDI0OTA2NCAwMDAwMCBuDQowMDAwMjQ5MzAy IDAwMDAwIG4NCjAwMDAyNzQ0NTggMDAwMDAgbg0KMDAwMDI3NDU4NyAwMDAwMCBuDQowMDAwMzQ3 MTM2IDAwMDAwIG4NCjAwMDAzNDc0OTcgMDAwMDAgbg0KMDAwMDM0NzczMSAwMDAwMCBuDQowMDAw MzQ3NzY3IDAwMDAwIG4NCjAwMDAzNDc3OTIgMDAwMDAgbg0KMDAwMDM0Nzg1NSAwMDAwMCBuDQow MDAwMzQ3OTg1IDAwMDAwIG4NCjAwMDAzNDgxMDkgMDAwMDAgbg0KMDAwMDM1MTgwMiAwMDAwMCBu DQp0cmFpbGVyDQo8PC9TaXplIDEwND4+DQpzdGFydHhyZWYNCjExNg0KJSVFT0YNCg== ------=_NextPart_000_0208_01CA102A.8CBC9340 Content-Type: text/plain; format=flowed; name="draft-bi-savi-cps-01.txt"; reply-type=original Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="draft-bi-savi-cps-01.txt" SAVI J. Bi, J. Wu, G. Yao=0A= Internet Draft CERNET=0A= Intended status: Standard Tracks F. Baker=0A= Expires: December 2009 Cisco=0A= July 29, 2009=0A= =0A= =0A= =0A= Control Packet Snooping Based Binding=0A= draft-bi-savi-cps-01.txt=0A= =0A= =0A= Status of this Memo=0A= =0A= This Internet-Draft is submitted to IETF in full conformance with=0A= the provisions of BCP 78 and BCP 79.=0A= =0A= Internet-Drafts are working documents of the Internet Engineering=0A= Task Force (IETF), its areas, and its working groups. Note that=0A= other groups may also distribute working documents as Internet-=0A= Drafts.=0A= =0A= Internet-Drafts are draft documents valid for a maximum of six=0A= months and may be updated, replaced, or obsoleted by other documents=0A= at any time. It is inappropriate to use Internet-Drafts as=0A= reference material or to cite them other than as "work in progress."=0A= =0A= The list of current Internet-Drafts can be accessed at=0A= http://www.ietf.org/ietf/1id-abstracts.txt=0A= =0A= The list of Internet-Draft Shadow Directories can be accessed at=0A= http://www.ietf.org/shadow.html=0A= =0A= This Internet-Draft will expire on January 29, 2010.=0A= =0A= Copyright Notice=0A= =0A= Copyright (c) 2009 IETF Trust and the persons identified as the=0A= document authors. All rights reserved.=0A= =0A= This document is subject to BCP 78 and the IETF Trust's Legal=0A= Provisions Relating to IETF Documents in effect on the date of=0A= publication of this document (http://trustee.ietf.org/license-info).=0A= Please review these documents carefully, as they describe your=0A= rights and restrictions with respect to this document.=0A= =0A= Abstract=0A= =0A= =0A= =0A= =0A= Bi Expires December 29,2009 [Page 1]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= This document specifies the Control Packet Snooping (CPS) mechanism=0A= for IP version 4 and IP version 6. This mechanism is used to set up=0A= binding between "authorized" source IP address of host and=0A= corresponding anchor on the access network device, including switch=0A= and wireless access point. The bindings are used to perform source=0A= address validation on packets sent by host.=0A= =0A= Table of Contents=0A= =0A= =0A= 1. Introduction ................................................ 3=0A= 2. Conventions used in this document............................ 3=0A= 3. Terminology ................................................. 3=0A= 4. Mechanism Overview .......................................... 4=0A= 5. Related Protocols ........................................... 4=0A= 6. Definition of Anchor......................................... 5=0A= 7. Conceptual Data Structures................................... 5=0A= 8. Scenarios ................................................... 7=0A= 8.1. Switch scenario......................................... 7=0A= 8.1.1. Port Attributes.................................... 7=0A= 8.1.1.1. SAVI-Host Attribute........................... 8=0A= 8.1.1.2. SAVI-DHCP-Trust Attribute .................... 8=0A= 8.1.1.3. SAVI-RA-Trust Attribute ...................... 8=0A= 8.1.1.4. SAVI-Trunk-Default Attribute ................. 9=0A= 8.1.1.5. SAVI-Trunk-Snooping Attribute ................ 9=0A= 8.2. Wireless Scenario....................................... 9=0A= 9. Prefix Configuration......................................... 9=0A= 10. Binding Set Up ............................................ 10=0A= 10.1. DHCPv4 Snooping....................................... 10=0A= 10.1.1. Process of DHCPv4 Snooping ...................... 10=0A= 10.1.2. State Machine of DHCPv4 Snooping ................ 11=0A= 10.2. DHCPv6 Snooping....................................... 11=0A= 10.2.1. Process of DHCPv6 Snooping ...................... 11=0A= 10.2.2. State Machine of DHCPv6 Snooping ................ 12=0A= 10.3. ND Snooping .......................................... 13=0A= 10.3.1. Process of ND Snooping........................... 13=0A= 10.3.2. State Machine of ND Snooping .................... 13=0A= 10.4. ARP Snooping ......................................... 14=0A= 10.4.1. Process of ARP Snooping.......................... 14=0A= 10.4.2. State Machine of ARP Snooping ................... 14=0A= 10.5. Manually Binding...................................... 15=0A= 11. Clear Binding ............................................. 15=0A= 12. Filtering Specification.................................... 15=0A= 12.1. Filter Data Packet.................................... 15=0A= 12.2. Filter Control Packet................................. 16=0A= 13. Solution for Special Situations............................ 16=0A= 13.1. Multiple Interfaces................................... 17=0A= =0A= =0A= Bi Expires January 29, 2010 [Page 2]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= 13.2. Port Movement ........................................ 17=0A= 14. Considerations on Security Risks........................... 18=0A= 14.1. Operating system support.............................. 18=0A= 14.2. Malicious replier..................................... 19=0A= 14.3. Inactive node ........................................ 19=0A= 15. About Risk of Dropping Legal Packets ...................... 19=0A= 16. Compatible Mode ........................................... 21=0A= 17. Binding State Lost Problem................................. 22=0A= 18. Incremental Deployment Suggestion.......................... 22=0A= 19. Constants ................................................. 22=0A= 20. Security Considerations.................................... 23=0A= 21. IANA Considerations........................................ 23=0A= 22. References ................................................ 23=0A= 22.1. Normative References.................................. 23=0A= 22.2. Informative References................................ 23=0A= 23. Acknowledgments ........................................... 23=0A= Appendix A. Operating System Support Situation ................ 25=0A= Authors' Addresses ............................................ 26=0A= =0A= 1. Introduction=0A= =0A= This specification defines the Control Packet Snooping (CPS)=0A= mechanism for Internet Protocol version 4 (IPv4) and Internet=0A= Protocol version 6 (IPv6). Access devices (including access switches,=0A= and wireless access point/controller, etc) can use this mechanism to=0A= set up bindings between source IP addresses of hosts and=0A= corresponding anchors, in accordance with the appointed address=0A= assignment method. These bindings can be used to validate the source=0A= IP address in the packets received from directly attached hosts.=0A= =0A= 2. Conventions used in this document=0A= =0A= The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",=0A= "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this=0A= document are to be interpreted as described in [RFC2119].=0A= =0A= 3. Terminology=0A= =0A= Anchor - The entity to bind source IP address with.=0A= =0A= SAVI switch - A switch deployed this mechanism.=0A= =0A= Non-SAVI switch - A switch not deployed any SAVI mechanism.=0A= =0A= =0A= =0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 3]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= 4. Mechanism Overview=0A= =0A= This mechanism is designed to provide a host level source IP address=0A= validation granularity, as a supplement of BCP38. This mechanism is=0A= deployed on the access device (including access switch, wireless=0A= access point/controller, etc), and performs control packet snooping=0A= to set up bindings between "authorized" source IP address and=0A= corresponding anchors. It also allows manually configured binding.=0A= The bindings are then used to check the source address in the=0A= packets from the directly attached hosts.=0A= =0A= This mechanism requires no change on host, and no new protocol is=0A= designed. The deployed device can work with non-deployed device to=0A= support incrementally deployment (named non-SAVI device). Only the=0A= deployed area is protected. This mechanism can work with all the=0A= standard address allocation methods, including DHCP (RFC2131),=0A= DHCPv6 (RFC3315), SLAAC (RFC4862), and manual configuration for both=0A= IPv4 and IPv6.=0A= =0A= The binding entries generally are not permanent. Each binding has a=0A= lifetime, and some event may trigger the binding deletion. When=0A= their lifetime expires, or the event happens, this mechanism will=0A= delete the corresponding entry, or perform some process.=0A= =0A= The binding process based on DHCPv4 is inspired by the work of IP=0A= source guard. Our work is different from IP source guard on the=0A= requirement of collision detection, which is quite useful in a=0A= multiple address assignment methods environment.=0A= =0A= 5. Related Protocols=0A= =0A= All the protocols related with the IP address assignment are the in=0A= the scope of this mechanism, including:=0A= =0A= Dynamic Host Configuration Protocol version 4 (DHCPv4) - A host may=0A= use this protocol to get an IPv4 address.=0A= =0A= Dynamic Host Configuration Protocol version 6 (DHCPv6) - A host may=0A= use this protocol to get an IPv6 address.=0A= =0A= Neighbor Discovery Protocol (NDP) - Whenever a host wants to assign=0A= an IPv6 address to its interface, it must perform Duplicate Address=0A= Detection first, which is composed of NDP packets. The NDP is also=0A= used to detect whether a host is still reachable. Such NDP packets=0A= can be used to determine whether to delete a binding or not. Other=0A= kinds of NDP packets will be used in Compatible Mode to trigger=0A= bindings.=0A= =0A= =0A= Bi Expires January 29, 2010 [Page 4]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= Address Resolution Protocol (ARP) - Whenever a host wants assign an=0A= IPv4 address to its interface, it will send a gratuitous ARP to make=0A= sure this address is not being used. However, this function may not=0A= be supported by all the operating systems. ARP is also used to=0A= determine whether a host is still reachable. Such ARP packets can be=0A= used to determine whether to delete a binding or not. Other kinds of=0A= ARP packets will be used in Compatible Mode to trigger bindings.=0A= =0A= Secure Neighbor Discovery Protocol (SeND) - SeND is a special case=0A= of NDP. If a ND packet is also a SeND packet, the validity of the=0A= source address must be checked first before this packet is taken=0A= into the process of this mechanism. There is no other difference for=0A= the mechanism to process plain ND packet and SeND packet.=0A= =0A= 6. Definition of Anchor=0A= =0A= Anchor is an important concept for this mechanism. In this document,=0A= anchor is the entity to bind source address with. To make the=0A= binding secure, the anchor itself must be unspoofable. Generally,=0A= following entities can be used as anchor:=0A= =0A= Exclusive switch port - When a switch port is exclusive for a=0A= host, this port is unspoofable for other hosts.=0A= =0A= MAC address in 802.1ae/af and 802.11i - 802.1ae/af and 802.11i=0A= protect the security of MAC address. When such technology is=0A= deployed in the network, MAC address can be used as anchor.=0A= =0A= However, when strict secure anchor is not achievable in the network,=0A= loose secure anchor can be used. Generally, shared switch port and=0A= MAC address are loose secure anchors. Loose secure anchor may cause=0A= false negative, thus it is not recommended to use such anchors.=0A= =0A= This document doesn't specify which entities can be used as anchor,=0A= and how secure these anchors.=0A= =0A= 7. Conceptual Data Structures=0A= =0A= This section describes the possible conceptual data structures used=0A= in this mechanism.=0A= =0A= Two main data structures are used to record bindings and their=0A= states respectively. There are redundancy between the two structures,=0A= for the consideration of separation of data plane and control plane.=0A= =0A= Binding State Table (BST)=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 5]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= - This table contains this state of binding=0A= between source address and anchor. Entries are=0A= keyed on the anchor and source IP address. Each=0A= entry has a lifetime item which records the=0A= remaining lifetime of this entry, an item which=0A= records the state of this binding and an item=0A= record other information. Whenever the lifetime=0A= expires, the entry should be deleted, except for=0A= the entries with DHCPv4_DETECTION/=0A= DHCPv4_DETECTION/SAC_START/MANUALv4_START state.=0A= =0A= Filtering Table (FT)=0A= =0A= - This table contains the bindings between anchor=0A= and address, keyed on anchor. This table doesn't=0A= contain any state of the binding. This table is=0A= used to filter packet. Access Control List can=0A= be regarded as an instance of this table.=0A= =0A= The states of binding in Binding State Table are as follows:=0A= =0A= DHCPv4_START A DHCPv4 request is received from host, and it may=0A= trigger a new binding.=0A= =0A= DHCPv4_LIVE The DHCPv4 address is acknowledged by DHCP server.=0A= =0A= DHCPv4_DETECTION A gratuitous ARP has been sent by the host and=0A= it is waiting for the reply.=0A= =0A= DHCPv4_BOUND The address has passed duplicate detection and=0A= it is bound with the anchor.=0A= =0A= DHCPv6_START A DHCPv6 request or confirm is received from host.=0A= =0A= DHCPv6_LIVE A DCHPv6 reply is received from server, and an=0A= address is suggested.=0A= =0A= DHCPv6_DETECTION A Duplicate Address Detection (DAD) Neighbor=0A= Solicitation has been sent by the host, and it=0A= is waiting for the reply.=0A= =0A= DHCPv6_BOUND The address has passed DAD and it is bound with=0A= the anchor.=0A= =0A= SAC_START A DAD NS has been sent by the host. The target=0A= address is neither got from DHCP nor static.=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 6]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= SAC_BOUND The address has passed DAD and it is bound with=0A= anchor.=0A= =0A= SAC_QUERY The bound address is being queried by another node.=0A= If there is no response in a time constant, the=0A= binding should be deleted.=0A= =0A= MANUALv4_START A gratuitous ARP has been sent by the host. The=0A= target address is neither got from DHCP nor=0A= static.=0A= =0A= MANUALv4_BOUND The address has passed DAD and it is bound with=0A= anchor.=0A= =0A= MANUALv4_QUERY The bound address is being queried by another=0A= node. If there is no response in a time constant,=0A= the binding should be deleted.=0A= =0A= STATIC The address is static and the binding should not=0A= be change.=0A= =0A= =0A= =0A= 8. Scenarios=0A= =0A= This section specifies the deployment scenarios. Two basic scenarios=0A= are discussed here: switch scenario and wireless scenario.=0A= =0A= 8.1. Switch scenario=0A= =0A= Switch scenario means a switched network composed by a number of=0A= switches. This mechanism is deployed on one or more of them.=0A= =0A= In a switch scenario, always port is used as anchor. This section=0A= specifies the attributes of switch port, and the process on each=0A= kind. The method of distinguishing each kind of port in management=0A= is through manual configuration. The port attribute is just=0A= conceptual.=0A= =0A= 8.1.1. Port Attributes=0A= =0A= The attribute of port depends on the role of the port.=0A= =0A= A port on a SAVI switch can be set to have none or more of all the=0A= attributes. If a port has an attribute, the corresponding snooping=0A= and filtering policy will be used on this port. If a port has=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 7]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= multiple attributes, all the corresponding policies will be used.=0A= Conflict attributes MUST not be set to the same port.=0A= =0A= 8.1.1.1. SAVI-Host Attribute=0A= =0A= If and only if a port is directly connected with a host, this port=0A= can be set to have SAVI-Host attribute. Trunk port cannot be set to=0A= have this attribute.=0A= =0A= If a port has SAVI-Host attribute, control packet snooping MUST be=0A= performed on this port to set up bindings, and then the data packets=0A= from this port MUST be verified based on these bindings.=0A= =0A= 8.1.1.2. SAVI-DHCP-Trust Attribute=0A= =0A= If and only if a port is directly connected with a trustable DHCP=0A= server, or is a trunk port from which the DHCP reply should arrive,=0A= it can be set to have this attribute.=0A= =0A= When a port is configured to have SAVI-DHCP-Trust attribute, the=0A= switch trusts the DHCP reply messages from this port to establish=0A= bindings.=0A= =0A= If DHCP is used to assign address in the network, there should be at=0A= least one port has this attribute. DHCP reply message not from such=0A= ports MUST be dropped.=0A= =0A= In the situation DHCP-PD is used to configure prefix of the network,=0A= the switch also trust the Prefix Delegation message from port with=0A= this attribute.=0A= =0A= 8.1.1.3. SAVI-RA-Trust Attribute=0A= =0A= If and only if a port is directly connected with a trustable router,=0A= or is a trunk port from which the Router Advertisement should arrive,=0A= it can be set to have this attribute.=0A= =0A= When a port is configured to have a SAVI-RA-Trust attribute, the=0A= switch trusts the Router Advertisement messages from this port to=0A= learn the prefixes used on the link.=0A= =0A= There may be no SAVI-RA-Trust port in the network, even if only=0A= SLAAC is used to configure address.=0A= =0A= Router Advertisement received not from SAVI-RA-Trust port MUST be=0A= discarded.=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 8]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= 8.1.1.4. SAVI-Trunk-Default Attribute=0A= =0A= If and only if a port is a trunk port, it can be set to have this=0A= attribute. This attribute is a conflict attribute of SAVI-Host=0A= attribute and SAVI-Trunk-Snooping attribute.=0A= =0A= No packet snooping will be performed on port with this attribute.=0A= Packet from port with such attribute will be forwarded if its source=0A= address doesn't conflict existing local bindings.=0A= =0A= 8.1.1.5. SAVI-Trunk-Snooping Attribute=0A= =0A= If and only if a port is a trunk port, it can be set to have this=0A= attribute. This attribute is a conflict attribute of SAVI-Host=0A= attribute and SAVI-Trunk-Default attribute.=0A= =0A= Control packet snooping MUST be performed on port with this=0A= attribute. The filtering policy on port with such attribute is based=0A= on "default-forwarding" principle, which means packets from this=0A= port can be forwarded if its source address doesn't conflict local=0A= bindings.=0A= =0A= It is not SUGGESTED to set a trunk port to have this attribute,=0A= unless it is found that only to set a port to have this attribute=0A= will achieve the spoofing mitigation goal. Setting a port to have=0A= this attribute will possibly result in forwarding performance=0A= problem.=0A= =0A= 8.2. Wireless Scenario=0A= =0A= In a wireless scenario, usually MAC address is used as anchor.=0A= Currently there is nothing to specify in wireless scenario.=0A= =0A= 9. Prefix Configuration=0A= =0A= Before setting up a host-level granularity binding table, it is=0A= important to configure correct prefixes on the SAVI device. At least=0A= two prefix scopes must be set: the IPv4 prefix and IPv6 prefixes.=0A= This document suggests set 3 prefix scopes:=0A= =0A= IPv4 Prefix:=0A= =0A= The allowed scope of any kind of IPv4 addresses. It can be set=0A= manually.=0A= =0A= IPv6 SLAAC Prefixes:=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 9]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= The allowed scope of SLAAC and manually configured IPv6=0A= addresses. It can be set through snooping RA message from port=0A= with SAVI-RA-Trust attribute, or manual configuration.=0A= =0A= FE80::/64 MUST be set to a feasible prefix.=0A= =0A= IPv6 DHCPv6 Prefixes:=0A= =0A= The allowed scope of DHCPv6 addresses. It can be set through=0A= DHCP-PD protocol, or manual configuration.=0A= =0A= If some of the prefix scope is set to have non prefix, it implies=0A= corresponding address assignment method is not allowed in the=0A= network.=0A= =0A= There is no need to explicitly present these prefix scopes. But=0A= these restrictions MUST be used as premier check in binding set up.=0A= =0A= 10. Binding Set Up=0A= =0A= This section specifies how to set up bindings based on control=0A= packet snooping. Control packet snooping is only performed on the=0A= ports with SAVI-Host attribute or SAVI-Trunk-Snooping attribute.=0A= =0A= 10.1. DHCPv4 Snooping=0A= =0A= 10.1.1. Process of DHCPv4 Snooping=0A= =0A= This process is designed for DHCPv4 assigned address.=0A= =0A= Whenever a DHCPv4 request is received from attaching host, and the=0A= requested IP address does not exist in the binding table, the device=0A= will generate an entry in the Binding State Table (BST), set the=0A= state field to be DHCPv4_START. The lifetime of this entry is set to=0A= be MAX_DHCP_RESPONSE_TIME. The TID field of the request packet is=0A= also recorded in the entry. If an entry is already in the BST and=0A= the state of the entry is DHCPv4_START, set the lifetime field to be=0A= MAX_DHCP_RESPONSE_TIME.=0A= =0A= Whenever a DHCPv4 acknowledgement is received from the DHCP server,=0A= if the TID is in BST, and the state of the entry is DHCPv4_START,=0A= set the state of the entry to be DHCPv4_LIVE. The lifetime of the=0A= entry is set to be MAX_ARP_PREPARE_DELAY. The lease time is also=0A= recorded in the entry.=0A= =0A= Whenever a gratuitous ARP request is received from the host, if the=0A= state of the entry is DHCPv4_LIVE, set the state of the entry to be=0A= =0A= =0A= Bi Expires January 29, 2010 [Page 10]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= DHCPv4_DETECTION. The lifetime of the entry is set to be MAX_ARP=0A= _DELAY. If an ARP response for the address is received from other=0A= nodes, delete the entry. If the lifetime expires, set the state of=0A= the entry to be DHCPv4_BOUND. The lifetime of this entry is set to=0A= the lease time of the entry. An entry is added into the Filter Table.=0A= =0A= Whenever a DHCPv4 decline is received from the host, if the state of=0A= the entry is DHCPv4_LIVE, delete the entry in BST.=0A= =0A= Whenever a DHCPv4 release is received from the host, if the state of=0A= the entry is DHCPv4_BOUND, delete the entry in BST and Filter Table.=0A= =0A= If a DHCPv4 acknowledgement with renew/rebind sign is received from=0A= the server, set lifetime of the entry in BST to be the new lease=0A= time.=0A= =0A= If the lifetime of an entry with state DHCPv4_BOUND expires, delete=0A= the entry in BST and Filter Table.=0A= =0A= 10.1.2. State Machine of DHCPv4 Snooping=0A= =0A= State Packet/Event Action Next State=0A= =0A= Start DHCPv4 REQ Set up new entry DHCPv4_START=0A= =0A= DHCPv4_START DHCPv4 ACK Record lease time DHCPv4_LIVE=0A= =0A= DHCPv4_LIVE Gra ARP REQ - DHCPv4_DETECTION=0A= =0A= DHCPv4_LIVE DHCPv4 DEC Remove entry Start=0A= =0A= DHCPv4_DETECTION Timeout Insert into FT DHCPv4_BOUND=0A= =0A= DHCPv4_DETECTION Gra ARP RPL Remove entry Start=0A= =0A= DHCPv4_DETECTION DHCPv4 DEC Remove entry Start=0A= =0A= DHCPv4_BOUND DHCPv4 REL Remove entry Start=0A= =0A= DHCPv4_BOUND DHCPv4 REN/REB Set new lifetime DHCPv4_BOUND=0A= =0A= 10.2. DHCPv6 Snooping=0A= =0A= 10.2.1. Process of DHCPv6 Snooping=0A= =0A= This process is designed for DHCPv6 assigned address.=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 11]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= Whenever a DHCPv6 request or confirm is received from attaching host,=0A= and the requested IP address does not exist in the binding table,=0A= the device will generate an entry in the BST, set the state field to=0A= be DHCPv6_START. The lifetime of this entry is set to be=0A= MAX_DHCP_RESPONSE_TIME. The source address of the request packet is=0A= also recorded in the entry. If an entry is already in the BST and=0A= the state of the entry is DHCPv6_START, set the lifetime field to be=0A= MAX_DHCP_RESPONSE_TIME.=0A= =0A= Whenever a DHCPv6 reply is received from the DHCP server, if the TID=0A= is in BST, and the state of the entry is DHCPv6_START, set the state=0A= of the entry to be DHCPv6_LIVE. The lifetime of the entry is set to=0A= be MAX_DAD_PREPARE_DELAY. The lease time is also recorded in the=0A= entry.=0A= =0A= Whenever a DAD NS is received from the host, if the state of the=0A= entry is DHCPv6_LIVE, set the state of the entry to be=0A= DHCPv6_DETECTION. The lifetime of the entry is set to be MAX_DAD=0A= _DELAY. If an NA response for the address is received from other=0A= nodes, delete the entry. If the lifetime expires, set the state of=0A= the entry to be DHCPv6_BOUND. The lifetime of this entry is set to=0A= the lease time of the entry. An entry is added into the Filter Table.=0A= =0A= Whenever a DHCPv6 decline is received from the host, if the state of=0A= the entry is DHCPv6_LIVE, delete the entry in BST.=0A= =0A= Whenever a DHCPv6 release is received from the host, if the state of=0A= the entry is DHCPv6_BOUND, delete the entry in BST and Filter Table.=0A= =0A= If a DHCPv6 reply with renew/rebind sign is received from the server,=0A= set lifetime of the entry in BST to be the new lease time.=0A= =0A= If the lifetime of an entry with state DHCPv6_BOUND expires, delete=0A= the entry in BST and Filter Table.=0A= =0A= 10.2.2. State Machine of DHCPv6 Snooping=0A= =0A= State Packet/Event Action Next State=0A= =0A= Start DHCPv6 REQ/CON Set up new entry DHCPv6_START=0A= =0A= DHCPv6_START DHCPv6 RLY Record lease time DHCPv6_LIVE=0A= =0A= DHCPv6_LIVE DAD NS - DHCPv6_DETECTION=0A= =0A= DHCPv6_DETECTION Timeout Insert into FT DHCPv6_BOUND=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 12]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= DHCPv6_DETECTION DAD NA RLY Remove entry Start=0A= =0A= DHCPv6_LIVE DHCPv6 DEC Remove entry Start=0A= =0A= DHCPv6_BOUND DHCPv6 REL Remove entry Start=0A= =0A= DHCPv6_BOUND DHCPv4 REN/REB Set new lifetime DHCPv6_BOUND=0A= =0A= 10.3. ND Snooping=0A= =0A= 10.3.1. Process of ND Snooping=0A= =0A= This process is designed for stateless auto-configuration assigned=0A= IPv6 address and manually configured IPv6 address.=0A= =0A= Whenever a DAD NS is received from the host, if the address is not=0A= in BST and has a permitted prefix, generate a new entry in BST and=0A= set the state of the entry to be SAC_START. The lifetime of the=0A= entry is set to be MAX_DAD _DELAY. If an NA response for the address=0A= is received from other nodes, delete the entry. If the lifetime=0A= expires, set the state of the entry to be SAC_BOUND. The lifetime of=0A= this entry is set to MAX_SAC_LIFETIME. An entry is added into the=0A= Filter Table.=0A= =0A= If the lifetime of an entry with state SAC_BOUND expires, set the=0A= lifetime to be MAX_DAD_PREPARE_DELAY and send a NS for the address.=0A= If there is no response before the lifetime expires, delete the=0A= entry in BST and Filter Table. Else set the lifetime to be=0A= MAX_SAC_LIFETIME.=0A= =0A= Whenever a NS with target address set to one of the addresses with=0A= state SAC_BOUND, the state of the entry is set to SAC_QUERY, and the=0A= lifetime is set to MAX_DAD_PREPARE_DELAY. If there is no response=0A= from the host before the lifetime expires, delete the entry in BST=0A= and Filter Table. If a response is received from the host, set the=0A= lifetime of the corresponding entry to be MAX_SAC_LIFETIME.=0A= =0A= 10.3.2. State Machine of ND Snooping=0A= =0A= State Packet/Event Action Next State=0A= =0A= Start DAD NS Set up new entry SAC_START=0A= =0A= SAC_START Timeout Insert into FT SAC_BOUND=0A= =0A= SAC_START DAD NA RLY Remove entry Start=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 13]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= *SAC_BOUND NS for bound addr - SAC_QUERY=0A= =0A= *SAC_QUERY NA Set lifetime to maximum SAC_BOUND=0A= =0A= *SAC_QUERY Timeout Remove binding Start=0A= =0A= (* denotes optional process.)=0A= =0A= 10.4. ARP Snooping=0A= =0A= 10.4.1. Process of ARP Snooping=0A= =0A= This process is designed for manually configured IPv4 address.=0A= =0A= Whenever a gratuitous ARP is received from the host, if the address=0A= is not in BST and has a permitted prefix, generate a new entry in=0A= BST and set the state of the entry to be MANUALv4_START. The=0A= lifetime of the entry is set to be MAX_ARP_DELAY. If an ARP response=0A= for the address is received from other nodes, delete the entry. If=0A= the lifetime expires, set the state of the entry to be=0A= MANUALv4_BOUND. The lifetime of this entry is set to=0A= MAX_MANUAL_LIFETIME. An entry is added into the Filter Table.=0A= =0A= If the lifetime of an entry with state MANUALv4_BOUND expires, set=0A= the lifetime to be MAX_ARP_PREPARE_DELAY and send an ARP request for=0A= the address. If there is no response before the lifetime expires,=0A= delete the entry in BST and Filter Table. Else set the lifetime to=0A= be MAX_MANUAL_LIFETIME.=0A= =0A= Whenever an ARP response with target address set to one of the=0A= addresses with state ARP_BOUND, the state of the entry is set to=0A= MANUALv4_QUERY, and the lifetime is set to MAX_ARP_PREPARE_DELAY. If=0A= there is no response from the host before the lifetime expires,=0A= delete the entry in BST and Filter Table. If a response is received=0A= from the host, set the lifetime of the corresponding entry to be=0A= MAX_MANUAL_LIFETIME.=0A= =0A= 10.4.2. State Machine of ARP Snooping=0A= =0A= State Packet/Event Action Next State=0A= =0A= Start Gra ARP REQ Set up new entry MANUALv4_START=0A= =0A= MANUALv4_START Timeout Insert into FT MANUALv4_BOUND=0A= =0A= MANUALv4_START Gra ARP RLY Remove entry Start=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 14]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= *MANUALv4_BOUND ARP for bound addr MANUALv4_QUERY=0A= =0A= *MANUALv4_QUERY ARP RLY Set lifetime to maximum MANUALv4_BOUND=0A= =0A= *MANUALv4_QUERY Timeout Remove binding Start=0A= =0A= (* denotes optional process.)=0A= =0A= 10.5. Manually Binding=0A= =0A= To be compatible with manually configured static address, the BST is=0A= allowed to be configured manually. The configured binding has state=0A= STATIC and has an infinite lifetime.=0A= =0A= 11. Clear Binding=0A= =0A= Whenever the lifetime of DHCP assigned entry in the BST expires, it=0A= MUST be removed from the BST. If this binding has been inserted in=0A= to Filtering Table, this binding also MUST be removed.=0A= =0A= Whenever the lifetime of an address not assigned by DHCP expires,=0A= the switch MUST send a NS or NUD or ARP request to detect whether=0A= this address is still in use. If there is no response from the=0A= corresponding node, this binding MUST be deleted; or else, set to=0A= lifetime of this entry to be the corresponding maximum value.=0A= =0A= Whenever a node is disconnected at link layer, the corresponding=0A= bindings in BST and Filtering Table MUST be removed unless the state=0A= of the entry is STATIC.=0A= =0A= 12. Filtering Specification=0A= =0A= This section specifies how to use bindings to filtering packets.=0A= =0A= 12.1. Filter Data Packet=0A= =0A= In a switch scenario, data packets are filtered only on port with=0A= SAVI-Host attribute, SAVI-Trunk-Default attribute, or SAVI-Trunk-=0A= Snooping attribute. There can be port with none of these attributes.=0A= =0A= Filtering on port with SAVI-Host attribute strictly complies with=0A= the Filtering Table set up on the port. If the source of the packet=0A= is in the binding table of the port, this packet will be forwarded;=0A= or else the packet MUST be discarded.=0A= =0A= Filtering on port with SAVI-Trunk-Default attribute is based on=0A= checking whether the source is in the Filtering Table. If it is not=0A= =0A= =0A= Bi Expires January 29, 2010 [Page 15]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= in the filtering table, the packet can be forwarded; or else, the=0A= packet MUST be discarded.=0A= =0A= Filtering on port with SAVI-Trunk-Snooping attribute is based on=0A= checking whether the source is bound on this port or conflicted with=0A= bindings on the other ports. If the address has been bound with the=0A= port, the packet can be forwarded; if the address is not bound with=0A= the port, but neither bound with any other port, the packet can be=0A= forwarded; if the address is bound with another port, the packet=0A= MUST be discarded.=0A= =0A= In a wireless scenario, all the filtering MUST be strictly complying=0A= with Filtering Table.=0A= =0A= 12.2. Filter Control Packet=0A= =0A= The source address of the control packet is always all zero (DHCPv4,=0A= IPv6 Stateless auto-configuration for link-local address) or unbound=0A= address (gratuitous ARP). Such packets don't have to pass the check=0A= on Filter Table. However, the source address of DHCPv6 request and=0A= IPv6 DAD NS for global address must pass the check on Filter Table,=0A= for always a unique link-local address is used.=0A= =0A= All Router Advertisement packets MUST be from port with SAVI-RA-=0A= Trust attribute. All DHCP Reply packets MUST be from port with SAVI-=0A= DHCP-Trust attribute.=0A= =0A= The target address in all the Neighbor Advertisement packets and the=0A= sender's address in all ARP relies should also pass the checks on=0A= Filter Table.=0A= =0A= The Target address in Neighbor Advertisement packet and DHCP Reply=0A= packet MUST be in the corresponding prefix scope.=0A= =0A= For control packet from port with SAVI-Trunk-Default attribute, the=0A= field in the packet is checked whether there is a local conflict.=0A= For control packet from port with SAVI-Trunk-Snooping attribute,=0A= checking whether the source is bound on this port or conflicted with=0A= bindings on the other ports.=0A= =0A= 13. Solution for Special Situations=0A= =0A= Two situations described in the charter of SAVI working group may=0A= cause this mechanism filter packets improperly: multiple interfaces=0A= and port movement. The following is the proper solution for each=0A= situation.=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 16]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= 13.1. Multiple Interfaces=0A= =0A= If a host has multiple interfaces to the same LAN, generally this=0A= situation can be treated as multiple hosts with single interface=0A= because each interface will only use the address assigned to itself=0A= as source IP address. However, a host may configure the same address=0A= on multiple interfaces for the purpose of load balance. In this=0A= situation, the SAVI device may find an address bound with an anchor=0A= appears with another anchor, just as spoofing. This is the only=0A= multiple interfaces situation that troubles this mechanism.=0A= =0A= When this situation happens, the corresponding binding is seldom=0A= changed. Thus, manual configuration is enough for this situation.=0A= All the anchors with the host can be configured to be used by the=0A= same host and share the same entries in BST and Filtering Table.=0A= =0A= Other mechanisms can also be used to handle this situation, such as=0A= [SAVI-SeND] and [SAVI-HIP]. These mechanisms can be used to test=0A= whether two anchors are belonging to the same host and thus=0A= distinguish multiple interfaces from spoofing. However, all the=0A= mentioned mechanisms bring overhead to data packet process, and are=0A= not recommended. Currently, the only recommended mechanism is manual=0A= configuration.=0A= =0A= However, for the consideration that in the future, a host with=0A= multiple interfaces to the same network may become very common (for=0A= example, a host has a wired network interface and a wireless network=0A= interface attached to the same network, and they are configured to=0A= use the same address), an extension mechanism is still needed. The=0A= design of such mechanism is temporarily out of the scope of this=0A= document.=0A= =0A= 13.2. Port Movement=0A= =0A= DHCP assigned address and stateless address don't have the problem=0A= of port movement. If an address is assigned through DHCP, the=0A= address must be confirmed by DHCP server after port movement, and=0A= the control packets will used to set up new binding. For a stateless=0A= address, a duplicate detection must be performed when the interface=0A= is re-initialized, just as the process of address assignment.=0A= However, if an interface configured a static address changes port,=0A= because the corresponding is manually configured, this movement will=0A= conflict previous binding.=0A= =0A= The situation that a host with static address changes from one port=0A= to another can be handled through one of the following ways:=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 17]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= - Manual configuration. If the host configured with static address=0A= seldom changes its port, the administrator can manually change the=0A= binding after each movement.=0A= =0A= - Changing anchor. If the anchor is not switch port, port movement=0A= will not cause any trouble. Thus an alternate way is choosing=0A= another entity as anchor, for example, the secure MAC address.=0A= =0A= - Access control mechanisms based on user account. Static address is=0A= always associated with specified user, thus the access control=0A= mechanism based on user account can be used to handle frequent port=0A= movements. 802.1x, PPPoE, and Portal are optional mechanisms.=0A= Whenever the user account is authenticated by there mechanisms, the=0A= corresponding address can be bound on the switch. The related=0A= protocol must be extended to enable such function.=0A= =0A= - Host identifier related mechanisms. [SAVI-SeND] and [SAVI-HIP]=0A= have a secure host identifier associated with the host, and this=0A= identifier can be used to handle port movement. The problem of such=0A= solutions is that they are based on immature techniques.=0A= =0A= 14. Considerations on Security Risks=0A= =0A= This mechanism has some potential risks. Some operating systems=0A= assign an address to interface without any duplicate detection.=0A= Other risks are due to the sync problem between host and SAVI device.=0A= =0A= 14.1. Operating system support=0A= =0A= The duplicate detection for IPv4 address has been prescribed in=0A= [RFC5227], but currently not all the operating systems perform=0A= duplicate detection on IPv4 address. Because the number of available=0A= IPv4 addresses in a LAN is small, a simplest solution is that=0A= whenever a new IPv4 address appears, the deployed device can perform=0A= duplicate detection instead of the host. However, this function will=0A= take data packet into control panel and would bring additional cost.=0A= A suggestion for the network administrator is IPv4 address should be=0A= assigned through DHCP or static. The supported operating systems are=0A= listed in Appendix A. For the operating system that cannot be=0A= updated, it is suggested to only use static address and set up=0A= binding manually, or only DHCPv4 is allowed to assign address.=0A= =0A= The duplicate detection for IPv6 address has been prescribed in=0A= [RFC4862]. However, some operating systems not supporting IPv6 well=0A= will not perform DAD when assigning IPv6 address.=0A= =0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 18]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= It is suggested that the operating systems should be able to update=0A= to support [RFC5227] and [RFC4862]. For the operating system that=0A= cannot be updated, it is suggested to only use static address and=0A= set up binding manually, or only DHCPv6 is allowed to assign address.=0A= =0A= An optional mode, named Compatible Mode, is designed to handle these=0A= situations.=0A= =0A= 14.2. Malicious replier=0A= =0A= Another risk is that the detection packet can be replied by a=0A= malicious attacker, and the host will be prevented from getting a=0A= proper address. This problem cannot be easily handled for it is=0A= caused by non-deployed nodes. The deployed device must filter=0A= Neighbor Advertisement packets, not only by source address, but also=0A= by target address. The sender's address in ARP replies should also=0A= be checked.=0A= =0A= A practical solution for this problem is as follows:=0A= =0A= 1. Divide the address space of SAVI nodes and non-SAVI nodes;=0A= =0A= 2. Partition SAVI nodes and non-SAVI nodes to different VLANs.=0A= =0A= Then the SAVI nodes don't have to ask the non-SAVI nodes whether an=0A= address has been used by some of them.=0A= =0A= 14.3. Inactive node=0A= =0A= The false negative may be caused by the situation that the detection=0A= packet is not replied by the assigned node. This is a troublesome=0A= situation. It is reasonable for a node to get such address because=0A= it is in accordance with the standard, unless the address is a=0A= static address. A simple process is removing the previous binding=0A= and setting up new binding for the requesting node. A more tolerant=0A= process is the SAVI device can perform ARP/ND proxy for the inactive=0A= node, and reduce the lifetime of binding to 1/4.=0A= =0A= 15. About Risk of Dropping Legal Packets=0A= =0A= If an address is used without binding set up on the switch, the=0A= packets with that address will be discarded by the switch.=0A= =0A= There are two situations when this happens:=0A= =0A= 1. No DAD is ever performed.=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 19]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= In this situation, the packet cannot be regarded as "legal packet",=0A= because without previous DAD, neither the host nor the switch has=0A= the ability to determine whether it is a duplicated address. The=0A= conflict of this solution and some other solutions is whether to=0A= discard the packets without previous DAD, or forward them.=0A= =0A= Forwarding the packets has some secure problems. In case the=0A= address has been used by another host, the behavior of using=0A= duplicated address will harm the legitimate user and forwarding=0A= such packet is spoiling spoofing. Actually, it is very suspect=0A= that a host may use addresses without previous DAD to launch some=0A= kind of DoS attack.=0A= =0A= Discarding the suspect packets will possibly block a suspect host=0A= from the network, however, will never block a host whose behaviors=0A= comply with the standards. A mechanism should be designed on=0A= existing standards, and give benefit to those who comply with=0A= standards.=0A= =0A= The auxiliary mechanism that let the switch perform DAD instead of=0A= the host is a feasible solution but not suggested. This mechanism=0A= is more complex and with heavy overhead.=0A= =0A= 2. DAD is performed, but the DAD NS packet is lost before it is=0A= received by the switch.=0A= =0A= The DAD NS message may get lost before snooped by the switch=0A= because of link error. When this happens, there will be a sync=0A= problem between the host and the switch. The host will configure=0A= that address because it doesn't receive a NA for the tentative=0A= address. However, the switch would set up a binding for that=0A= address. As a result, the packets with the address will be=0A= discarded by the switch.=0A= =0A= Although today the link quality has been quite good, the packet=0A= lost problem still exists. The best solution is to configure the=0A= re-transmit time of DAD NS to be more than 1. 3 is a reasonable=0A= number.=0A= =0A= =0A= =0A= An optional mode, named Compatible Mode, is designed to handle these=0A= situations.=0A= =0A= =0A= =0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 20]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= 16. Compatible Mode=0A= =0A= This mode is designed to let this mechanism be more tolerant to=0A= possible duplication detection packet lost, and non-standard-=0A= compliance operating system. This is an optional mode. When this=0A= mode is enabled, the switch will set up bindings based on NDP or ARP=0A= packets other than DAD packets and Gratuitous ARP packets.=0A= =0A= This section specifies how to use other kinds of control packets to=0A= set up bindings. If the address in these packets are not bound with=0A= other anchor and are in allowed prefix scope, the switch will=0A= perform duplicate detection instead of the sender of the packet to=0A= make sure the source address in the packet is unique in the local=0A= link. If the address is found to be not duplicated, it will be added=0A= into the Binding State Table and Filtering Table. If duplicate is=0A= found, the address SHOULD not be added into the Binding State Table=0A= and Filtering Table.=0A= =0A= Following packets will trigger the switch to set up bindings:=0A= =0A= ARP request: Source IPv4 address;=0A= =0A= ARP reply: Source IPv4 address;=0A= =0A= NA: Source address and target address;=0A= =0A= NS: Source address.=0A= =0A= The prefix of all the address MUST be in the scope of IPv4 Prefix or=0A= IPv6 SLAAC Prefixes.=0A= =0A= This mode can reduce the risk of dropping legitimate packets,=0A= because host will always use NDP or ARP to find other nodes on the=0A= link before sending any data traffic.=0A= =0A= The cost of the mode is still reasonable, because only control=0A= packets are used to trigger bindings. The data packets are still=0A= filtered based on Filtering Table.=0A= =0A= If duplicate is found after detection, the host would still send=0A= packet using the duplicated address because of sync problem. In this=0A= case, it is reasonable to filter the traffic from the host.=0A= =0A= This mode may be disturbed by a malicious node in non-SAVI area=0A= which sends NA on each DAD NS. Currently the best solution is=0A= dividing the non-SAVI area to different VLANs.=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 21]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= 17. DHCP-only Mode=0A= =0A= If only DHCP is used to assign address, the duplicate detection=0A= phase in binding set up can be omitted. However, if this mode is=0A= enabled, there must be confidence that the DHCP server wouldn't lose=0A= state. Or else, the duplicate detection phase still cannot be=0A= omitted.=0A= =0A= 18. Binding State Lost Problem=0A= =0A= When the SAVI switch reboots, the bindings on the switch will get=0A= lost for generally they are kept in volatile memory.=0A= =0A= Whenever the switch reboots, the interfaces of all the directly=0A= connected hosts will also be re-initialized. Then, if an address is=0A= assigned through DHCPv6, a CONFIRM message will be sent to the DHCP=0A= server. This message can be used to trigger re-binding of the=0A= previous address. For SLAAC address, the DAD procedure will be=0A= performed again, and a new binding will be set up.=0A= =0A= The bindings set up on port with SAVI-Trunk-Snooping attribute,=0A= cannot be recovered immediately. However, because "default-=0A= forwarding" policy is used on such ports, there is no risk of=0A= dropping legitimate traffic. The bindings on such ports can be=0A= recovered through snooping NDP and ARP packets using Compatible Mode.=0A= =0A= 19. Incremental Deployment Suggestion=0A= =0A= Because by default this mechanism doesn't set up bindings on trunk=0A= port, it may happen that a host connected to a downstream non-SAVI=0A= device can forge an address bound in SAVI area.=0A= =0A= To avoid this situation, it is suggested to separate SAVI area and=0A= non-SAVI areas into different VLANs, and assign different prefixes=0A= in these VLANs. Then the spoofing from non-SAVI area can be blocked=0A= through prefix check.=0A= =0A= And another way is to set the trunk ports to have SAVI-TRUNK-=0A= Snooping attribute. Then bindings can be set up on trunk port, and=0A= the bindings can be used to prevent spoofing from another trunk port.=0A= Because of the cost of this solution, it's better to carefully=0A= choose the trunk ports to be set this attribute.=0A= =0A= 20. Constants=0A= =0A= MAX_DHCP_RESPONSE_TIME 10s=0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 22]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= MAX_ARP_PREPARE_DELAY 1s=0A= =0A= MAX_ARP_DELAY 1s=0A= =0A= MAX_DAD_PREPARE_DELAY 1s=0A= =0A= MAX_DAD_DELAY 1s=0A= =0A= MAX_SAC_LIFETIME 2h=0A= =0A= MAX_MANUAL_LIFETIME 4h=0A= =0A= 21. Security Considerations=0A= =0A= There are no security considerations currently.=0A= =0A= 22. IANA Considerations=0A= =0A= There is no IANA consideration currently.=0A= =0A= 23. References=0A= =0A= 23.1. Normative References=0A= =0A= [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate=0A= Requirement Levels", BCP 14, RFC 2119, March 1997.=0A= =0A= [RFC4862] Thomson, S., Narten, T. and Jinmei, T., "IPv6 Stateless=0A= Autoconfiguration", RFC4862, September, 2007.=0A= =0A= [RFC5227] S. Cheshire, "IPv4 Address Conflict Detection", RFC5227,=0A= July 2008.=0A= =0A= [SAVI-SeND] M. Bagnulo, draft-ietf-savi-send-00.txt.=0A= =0A= [SAVI-HIP] D. Kuptsov, A. Gurtov and J. Bi, draft-kuptsov-sava-hip-=0A= 01.txt.=0A= =0A= 23.2. Informative References=0A= =0A= 24. Acknowledgments=0A= =0A= Thanks to Christian Vogt, Eric Nordmark, Marcelo Bagnulo Braun, Jari=0A= Arkko, David Harrington, Pekka Savola, Xing Li, Lixia Zhang, Robert=0A= Raszuk, Greg Daley, Joel M. Halpern and Tao Lin for their valuable=0A= contributions. In particular the usage of unsolicited NA and NS=0A= prior to sending data packets to create binding table (in addtional=0A= =0A= =0A= Bi Expires January 29, 2010 [Page 23]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= to DAD packet) was suggested by Eric Levy-Abegnoli in response to an=0A= attack described by Marcelo Bagnulo Braun.=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 24]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= Appendix A. Operating System Support Situation=0A= =0A= Supported systems: Windows XP SP2, Windows XP SP3, Windows Vista,=0A= Windows 7, Sun Solaris.=0A= =0A= Not supported systems: Ubuntu 8.10, Fedora 10.=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 25]=0A= =0C=0A= Internet-Draft Control Packet Snooping Based Binding July 2009=0A= =0A= =0A= Authors' Addresses=0A= =0A= Jun Bi=0A= CERNET=0A= Network Research Center, Tsinghua University=0A= Beijing 100084=0A= China=0A= Email: junbi@cernet.edu.cn=0A= =0A= =0A= Jianping Wu=0A= CERNET=0A= Computer Science, Tsinghua University=0A= Beijing 100084=0A= China=0A= Email: jianping@cernet.edu.cn=0A= =0A= =0A= Guang Yao=0A= CERNET=0A= Network Research Center, Tsinghua University=0A= Beijing 100084=0A= China=0A= Email: yaog@netarchlab.tsinghua.edu.cn=0A= =0A= =0A= Fred Baker=0A= Cisco Systems=0A= Email: fred@cisco.com=0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= =0A= Bi Expires January 29, 2010 [Page 26]=0A= =0C=0A= ------=_NextPart_000_0208_01CA102A.8CBC9340-- From junbi@cernet.edu.cn Fri Jul 31 15:13:21 2009 Return-Path: X-Original-To: savi@core3.amsl.com Delivered-To: savi@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C7733A6ABC for ; Fri, 31 Jul 2009 15:13:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 3.112 X-Spam-Level: *** X-Spam-Status: No, score=3.112 tagged_above=-999 required=5 tests=[BAYES_40=-0.185, FH_HAS_XAIMC=2.696, HTML_MESSAGE=0.001, J_CHICKENPOX_24=0.6] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GqEHmRUweAI7 for ; Fri, 31 Jul 2009 15:13:20 -0700 (PDT) Received: from cernet.edu.cn (sea.net.edu.cn [202.112.3.66]) by core3.amsl.com (Postfix) with SMTP id 8AC203A6ACD for ; Fri, 31 Jul 2009 15:13:19 -0700 (PDT) Received: from userPC([77.241.96.146]) by cernet.edu.cn(AIMC 3.2.0.0) with SMTP id jm04a7379b3; Sat, 01 Aug 2009 06:13:19 +0800 Message-ID: <0309AB34890846EFB26E1A4605A98F66@userPC> From: "Jun Bi" To: "SAVI Mailing List" Date: Sat, 1 Aug 2009 00:12:52 +0200 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_0488_01CA123C.CF84B900" X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Windows Mail 6.0.6000.16480 X-MimeOLE: Produced By Microsoft MimeOLE V6.0.6000.16669 X-AIMC-AUTH: junbi X-AIMC-MAILFROM: junbi@cernet.edu.cn X-AIMC-Msg-ID: 7enVA7WB Subject: [savi] Fw: Re:Re: Consensus call on "unregistered" source addresses X-BeenThere: savi@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: Mailing list for the SAVI WG List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 31 Jul 2009 22:13:21 -0000 ÕâÊÇ MIME ¸ñʽµÄ¶à·½Óʼþ¡£ ------=_NextPart_000_0488_01CA123C.CF84B900 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Forwad a message to the list. thanks, Jun ----- Original Message -----=20 From: Huan Huan=20 To: erik.nordmark@sun.com=20 Cc: junbi@cernet.edu.cn ; savi ; christian.vogt@ericsson.com ; = gdaley@netstarnetworks.com ; marcelo@it.uc3m.es ; fred@cisco.com ; = elevyabe@cisco.com=20 Sent: Wednesday, July 29, 2009 7:07 AM Subject: Re:Re: [savi] Consensus call on "unregistered" source addresses Hi Folk, This is Huan from IPv6 Ready Logo techincal group. The IPv6 Forum = (http://www.ipv6forum.com) IPv6 Ready Logo Program is a conformance and = interoperability testing program intended to increase user confidence by = demonstrating that IPv6 is available now and is ready to be use. For the = detail information, you can check: http://www.ipv6ready.org/. I saw the following information in the mailing list and had done some = test on DHCPv6 implementors, so maybe I can answer this question. >> Jun Bi wrote: >> During our real test on CPS, host did send CONFIRM when it change to=20 >> another port or switch reboot > > Did you test all implementations that exist? We had several test cases about "Confirm". For example, in the = interoperability test case 1.2 and 1.8(DHCPv6 Interoperability Test = Suite v1.0.4). We assume a DHCPv6 client disconnect into the link0 and = then connect into it(test case 1.2) or move into a new link1(test case = 1.8). The topologys as following: Test case1.2: ----------+------------------+ ----------------link0 | | DHCPv6_Client DHCPv6_Server Test case1.8: ----------+-------------+-----+----------------link0 | | | DHCPv6_Client | DHCPv6_Server1 | Router | -------------------------+-----+-----------------link1 DHCPv6_Server2 We also had some other test cases on commference test, in order to exam = the confirm packet format. During our test, we found the "Vista" and some open source softwares = (Wide or TRAC) are supporting the=20 "confirm" message. Another open source dhcpv6 client "dibbler" didn't = support it and I had modify some source code to make it support "confirm" now. Best Regards, Huan=20 ------=_NextPart_000_0488_01CA123C.CF84B900 Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable
Forwad a message to the list.
 
thanks,
Jun
----- Original Message -----=20
From: Huan = Huan=20
Cc: junbi@cernet.edu.cn ; savi ; christian.vogt@ericsson.com ; gdaley@netstarnetworks.com= ; marcelo@it.uc3m.es=20 ; fred@cisco.com ; elevyabe@cisco.com=20
Sent: Wednesday, July 29, 2009 7:07 AM
Subject: Re:Re: [savi] Consensus call on "unregistered" = source=20 addresses

Hi Folk,

This is Huan from IPv6 Ready Logo = techincal=20 group. The IPv6 Forum (http://www.ipv6forum.com) IPv6 Ready Logo Program is = a=20 conformance and interoperability testing program intended to increase = user=20 confidence by demonstrating that IPv6 is available now and is ready to = be use.=20 For the detail information, you can check: http://www.ipv6ready.org/.

I saw the = following=20 information in the mailing list and had done some test on DHCPv6 = implementors,=20 so maybe I can answer this=20 question.
>> Jun Bi wrote:
>> Du= ring our real test on CPS, host did&nb= sp;send CONFIRM when it change to 
>&= gt; another port or switch reboot
>
>= ; Did you test all implementations that&nbs= p;exist?
We=20 had several test cases about "Confirm". For example, in the = interoperability=20 test case 1.2 and 1.8(DHCPv6 Interoperability Test Suite v1.0.4). We = assume a=20 DHCPv6 client disconnect into the link0 and then connect into it(test = case 1.2)=20 or move into a new link1(test case 1.8). The topologys as = following:

Test=20 case1.2:
----------+------------------+
----------------link0
    =    =20   |       =  =20           |
   DHCPv6_Client  = DHCPv6_Server
Test=20 case1.8:
----------+-------------+-----+----------------link0
 = ;        =20 |        &nb= sp;     =20 |      |
   DHCPv6_Client |  =20 DHCPv6_Server1
         &= nbsp;           &n= bsp;  =20 |
           &n= bsp;           &nb= sp;=20 Router
          &nb= sp;           &nbs= p;  =20 |
-------------------------+-----+-----------------link1
 &nbs= p;            = ;            =    =20 DHCPv6_Server2

We also had some other test cases on commference = test, in=20 order to exam the confirm packet format.
During our test, we found = the=20 "Vista" and some open source softwares (Wide or TRAC) are supporting the =
"confirm" message. Another open source dhcpv6 client "dibbler" = didn't=20 support it and I had modify some
source code to make it support = "confirm"=20 now.

Best Regards,

Huan=20

------=_NextPart_000_0488_01CA123C.CF84B900--