From owner-v6ops@ops.ietf.org Wed Mar 2 15:50:40 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA25134 for ; Wed, 2 Mar 2005 15:50:40 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D6akp-000At4-3z for v6ops-data@psg.com; Wed, 02 Mar 2005 20:47:35 +0000 Received: from [66.93.39.75] (helo=smtp-e.tycool.net) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D6akl-000Asj-BP for v6ops@ops.ietf.org; Wed, 02 Mar 2005 20:47:32 +0000 Received: from [192.168.1.100] (unknown [192.168.1.100]) by smtp-e.tycool.net (Postfix) with ESMTP id 18A67E2 for ; Wed, 2 Mar 2005 12:48:24 -0800 (PST) Mime-Version: 1.0 (Apple Message framework v619.2) Content-Transfer-Encoding: 7bit Message-Id: Content-Type: text/plain; charset=US-ASCII; delsp=yes; format=flowed To: v6ops@ops.ietf.org From: Alain Durand Subject: TC bof: schedule change Date: Wed, 2 Mar 2005 12:47:29 -0800 X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit The TC bof will be on Monday at 3:30pm and not on Thursday as originally announced. We will be swapping slot with ICOS. See http://www.ietf.org/ietf/05mar/tc.txt (note: the IETF web site has not yet been updated, maybe tonight) Tunneling Configuration BOF (tc) Monday, March 7 at 1530-1730 =============================== ==> note this new schedule CHAIRS: Alain Durand Thomas Narten AGENDA: Problem space: - Administrativia (2 min) Alain Durand & Thomas Narten - Problem statement (10 min) Thomas Narten - v6ops initial "combine" goals (10 min) Jordi draft-palet-v6tc-goals-tunneling-00.txt - Use of the configuration protocol outside of the context of IPv6 tunneling (10 min), TBD - NAT traversial issues (10 min) Florent Parent - Is Tunnel End point discovery required? (10 min) Alain Durand / Thomas Narten Solution space: - Existing protocol analysis (20 min) Florent Parent & Pekka Savola draft-blanchet-t-v6ops-tunnelbroker-tsp-01.txt draft-parent-v6tc-protocol-exploration-01.txt - Tunnel end-point discovery analysis (10 min) Pekka Savola draft-palet-v6ops-tun-auto-disc-03.txt Open discussion (30 minutes) - Should we do something specific for IP in IP tunneling or something more generic that will work with any kind of encapsulation (GRE, MPLS,...) - Should this wg to be address the tunnel end point discovery part of the problem? - Should we cover the case of the set-up of a mesh of multiple tunnel ? DESCRIPTION =========== ISPs will likely deploy IPv6 incrementally, meaning that parts, rather than all of their networks will support native IPv6 service. They will need a way to provide IPv6 service to customers without requiring that native IPv6 service be provided on the access link. Automatic transition mechanisms like 6to4, teredo do not really leverage the infrastructure the ISP had put in place and offer little insight on how to gradually introduce native IPv6 in the access network. Configured tunnels are better suited for the job, and a number of deployments have been undertaken using the tunnel broker approach. However, the lack of standard on how to configure those tunnels remains a serious obstacle and manual configuration of all the parameters is a significant burden for typical customers. ISP assumptions: It is assumed that the ISP has upgraded its core network and has global IPv6 connectivity. It is also assumed that the ISP has obtained global address space (that it will delegate to its customers), either from an RIR or an upstream ISP. They key point is that the ISP does not (yet) provide native IPv6 access to all of its customers, but does want to provide an IPv6-over-IPv4 tunneling service. It is also assumed that large ISPs will have multiple POPs, and roaming customers will want to use a tunnel service topologically close to the current POP, rather than always using the same one. Access media assumptions: No assumptions are made on the access network. They will have high or low bandwidth, high or low latency, high or low access cost, and there will be more or less secure. Especially in the case of wireless access network, confidentiality of the data cannot always be guaranteed. Address spoofing may or may not be a problem. Although those environment vary widely, it is expected that a single configuration protocol with a number of options can be designed to accommodate all the different cases. Customer assumptions: Customers connecting with IPv6 to their ISP can have multiple configurations. The most common topologies expected to be encountered are: - a single node, directly attached to the ISP access network - a router, directly attached to the ISP access network - a router, behind an unmodifiable IPv4-only customer owned NAT The IPv4 addresses of the customer may change over time and be dynamically allocated. In the case of NAT environment, both the internal and the external addresses may be dynamically allocated. Another case to consider in the "roaming" user within its home ISP network. When the customer is roaming within the ISP network(s), this is not really different than having a dynamic IPv4 address, except that the "nearest" ISP tunnel end point to use may be different. When the customer is roaming in another ISP network that does not offer IPv6 service, the "home" ISP may be willing to still offer tunneling service, however the security implications and the tunnel end point discovery mechanism to use will be different. Work items: A "generic" tunnel setup protocol. The key requirement is to allow the creation of a tunnel for sending IPv6 over IPv4. In order to setup a tunnel, some negotiation may be needed in order to determine such properties as the encapsulation (e.g., GRE, IPv6-over-IPv4, etc.), MTU parameters, authentication and/or security properites, etc. For reasons of efficiency over very high latency networks, minimizing the number of packet exchanges is desirable. This group will not create new tunneling encapsulations. Moreover, it will reuse the work of other WGs rather than inventing unneeded mechanism. For example, IPsec can be used to create tunnels. The setup protocol could determine that an IPsec tunnel is needed, and then rely on IKE (as specified elsewhere) to setup up the appropriate tunnel. -------------------------------------------- A key question the BOF should answer is if the tunnel set-up protocol should be limited to IP in IP tunnel (with a focus on IPv6 in IPv4) or if it should be extended to other types of encapsulation, like GRE, MPLS,... -------------------------------------------- Another possible work item is a way for an ISP to indicate that it is offering tunnel services to its direct customers. This is also known as tunnel end-point discovery. -------------------------------------------- The BOF should answer is if this second work items should be covered by the same wg or not. -------------------------------------------- Focus: This work is not about creating a new transition mechanism, but to offer a standardized way to configure tunnels. Some of the issues initially explored are: - Do we want to focus on IP in IP tunnels or extend to GRE, MPLS,... - Do we want to address the tunnel end point discovery problem? - Could we live with UDP encapsulation always on? - Do we need mutual authentication? How strong should this be? - Should some of this authentication mechanism "follow-on" atfer the tunnel set-up phase has finished? - Can we have separate channels, one for configuration and one for the tunneled traffic or should we maintain only one channel to help traverse NAT? - Should we embed some kind of signaling in the tunnel channel? - How much of the wheel are we going to re-invent? e.g. if we define a new packet exchange and there is a goal to minimize the total number of RTT needed, there is a temptation to piggy-back configuration information in this protocol that could be over wise obtained via DHCP... List of documents to be used originally as input: http://www.v6ops.euro6ix.net/ietf/draft-suryanarayanan-v6ops-zeroconf- reqs-01.txt draft-nielsen-v6ops-3GPP-zeroconf-goals-00.txt draft-ietf-v6ops-assisted-tunneling-requirements-01.txt draft-palet-v6tc-goals-tunneling-00.txt draft-blanchet-t-v6ops-tunnelbroker-tsp-01.txt draft-parent-v6tc-protocol-exploration-00.txt draft-parent-v6tc-protocol-exploration-01.txt draft-palet-v6ops-tun-auto-disc-03.txt MAILING LIST: v6tc@ietf.org https://www1.ietf.org/mailman/listinfo/v6tc From owner-v6ops@ops.ietf.org Fri Mar 4 05:31:04 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA26023 for ; Fri, 4 Mar 2005 05:31:03 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D7A27-00094i-3D for v6ops-data@psg.com; Fri, 04 Mar 2005 10:27:47 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D7A24-00093w-6M for v6ops@ops.ietf.org; Fri, 04 Mar 2005 10:27:44 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j24ARgF28946 for ; Fri, 4 Mar 2005 12:27:42 +0200 Date: Fri, 4 Mar 2005 12:27:42 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org Subject: Conclusion: RE: Interest to have as an WG item: draft-tschofenig-v6ops-secure -tunnels-03.txt (fwd) Message-ID: MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="1589707168-1883129130-1109932062=:28915" X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1589707168-1883129130-1109932062=:28915 Content-Type: TEXT/PLAIN; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8BIT (without any hats) Folks -- I'd remind you to print out this document for your flights to Minneapolis, and/or otherwise read and comment on this draft. ---------- Forwarded message ---------- Date: Wed, 19 Jan 2005 18:48:38 +0200 From: "Soininen Jonne (Nokia-NET/Helsinki)" To: v6ops@ops.ietf.org Subject: Conclusion: RE: Interest to have as an WG item: draft-tschofenig-v6ops-secure-tunnels-03.txt Hello, (chair hat on) there was not an overly enthusiastic response during the two week period. Though, the interest seems to have risen toward the end of the period, still very few people responded. I would conclude that there was not enough consensus to take the document as WG item at this point. I hope, however, the authors of the document could continue the work. And I would like to people read the document and comment. Let's check the situation later if more interest raises. Cheers, Jonne. On Fri, 2005-01-14 at 16:32, ext Tschofenig Hannes wrote: > hi alain, > > thanks for your comment. > > to show you the difference between a document that describes how to use > ikev1/ikev2 (and ipsec) to provide security of something you might also want > to look at the mip6 working group where documents exist that describe how > ikev1/ipsec is used to secure the mipv6 signaling between the mn and the ha > (and the same for ikev2): > http://www.ietf.org/rfc/rfc3776.txt > http://www.ietf.org/internet-drafts/draft-ietf-mip6-ikev2-ipsec-00.txt > > the v6ops-secure-tunnels document is of this type. we are, however, not > extendig ikev2 (luckily). > > a tutorial (as a comparison) looks like: > http://ftp.iasi.rdsnet.ro/mirrors/nis.nsf.net/internet-drafts/draft-ietf-ips > ec-ikev2-tutorial-01.txt > > ciao > hannes > > >> -----Original Message----- >> From: Alain Durand [mailto:Alain.Durand@Sun.COM] >> Sent: Freitag, 14. Jänner 2005 14:06 >> To: Pekka Savola >> Cc: v6ops@ops.ietf.org >> Subject: Re: Interest to have as an WG item: >> draft-tschofenig-v6ops-secure-tunnels-03.txt >> >> Well, I'm not a security expert, far from that, so I'm not >> sure I can comment on the quality of the security assertions. >> However, at fist glance, it seems that this is a tutorial on ikev1 & >> ikev2 >> in the context of IPv6... >> I other words, it is unclear to me why we need this document >> in v6Ops and why it is not homed in a security related wg IF >> there is a need for such a document. >> >> On another note, some of the techniques described here may be >> useful in the context of v6tc... >> >> - Alain. >> >> -- Jonne Soininen Nokia Tel: +358 40 527 46 34 E-mail: jonne.soininen@nokia.com --1589707168-1883129130-1109932062=:28915-- From owner-v6ops@ops.ietf.org Fri Mar 4 07:08:42 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id HAA07578 for ; Fri, 4 Mar 2005 07:08:41 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D7BaC-0001HO-FO for v6ops-data@psg.com; Fri, 04 Mar 2005 12:07:04 +0000 Received: from [152.78.70.1] (helo=raven.ecs.soton.ac.uk) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D7BaA-0001Gk-8O for v6ops@ops.ietf.org; Fri, 04 Mar 2005 12:07:02 +0000 Received: from magpie.ecs.soton.ac.uk (magpie.ecs.soton.ac.uk [152.78.68.131]) by raven.ecs.soton.ac.uk (8.12.10/8.12.10) with ESMTP id j24C6wi3005189; Fri, 4 Mar 2005 12:06:58 GMT Received: from login.ecs.soton.ac.uk (IDENT:root@login [152.78.68.162]) by magpie.ecs.soton.ac.uk (8.9.3/8.9.3) with ESMTP id MAA12121; Fri, 4 Mar 2005 12:06:47 GMT Received: (from tjc@localhost) by login.ecs.soton.ac.uk (8.11.6/8.11.6) id j24C6kW07286; Fri, 4 Mar 2005 12:06:46 GMT Date: Fri, 4 Mar 2005 12:06:46 +0000 From: Tim Chown To: v6ops@ops.ietf.org Cc: renumber@6net.org Subject: draft-chown-v6ops-renumber-thinkabout-01 Message-ID: <20050304120646.GD6484@login.ecs.soton.ac.uk> Mail-Followup-To: v6ops@ops.ietf.org, renumber@6net.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4i X-MailScanner-Information: Please contact helpdesk@ecs.soton.ac.uk for more information X-ECS-MailScanner: Found to be clean X-MailScanner-From: tjc@smtp.ecs.soton.ac.uk X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00, SUBJ_HAS_UNIQ_ID autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, Just a heads up on a new revision of the personal draft on IPv6 renumbering issues. There is a slot for this in v6ops next week. It would be nice to see some considered effort in this operational aspect of IPv6 in v6ops. A more 'aggressive' approach to the challenges may be to re-launch PIER with an IPv6 slant, but for the time being this draft can be a focus for discussion: Title : Things to think about when Renumbering an IPv6 network Author(s) : T. Chown, et al. Filename : draft-chown-v6ops-renumber-thinkabout-01.txt Pages : 39 Date : 2005-2-23 This memo presents a summary of scenarios, issues for consideration and IPv6-specific tools for IPv6 network renumbering, i.e. achieving the transition from the use of an existing network prefix to a new prefix in an IPv6 network. Its focus lies not in the procedure for renumbering, but as a set of "things to think about" when undertaking such a renumbering exercise. The document is not intended to be complete at the -00 phase, and will be enhanced as further operational experience is gathered. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-chown-v6ops-renumber-thinkabout-01.txt Cheers, Tim From owner-v6ops@ops.ietf.org Sun Mar 6 14:55:08 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA16278 for ; Sun, 6 Mar 2005 14:55:07 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D81mw-0003Y4-4z for v6ops-data@psg.com; Sun, 06 Mar 2005 19:51:42 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D81ms-0003XV-9n for v6ops@ops.ietf.org; Sun, 06 Mar 2005 19:51:39 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j26JpSP13292; Sun, 6 Mar 2005 21:51:28 +0200 Date: Sun, 6 Mar 2005 21:51:28 +0200 (EET) From: Pekka Savola To: Tim Chown cc: v6ops@ops.ietf.org, renumber@6net.org Subject: Re: draft-chown-v6ops-renumber-thinkabout-01 In-Reply-To: <20050304120646.GD6484@login.ecs.soton.ac.uk> Message-ID: References: <20050304120646.GD6484@login.ecs.soton.ac.uk> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00, SUBJ_HAS_UNIQ_ID autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk On Fri, 4 Mar 2005, Tim Chown wrote: > Just a heads up on a new revision of the personal draft on IPv6 renumbering > issues. There is a slot for this in v6ops next week. Scribbled on the plane.. The document was fluent to read though it was a bit on the longish side. Some topics were discussed multiple times (in a bit shorter fashion) in different parts of the document. It would be good if the document could be compressed to, say, 20-25 pages without losing the readability (not sure if this would be worth doing). substantial ----------- 5.6 Anycast addressing ==> much of this appears to have little impact on renumbering. The only factor appear to be the hypothetical well-known addresses for discovery (e.g., DNS) which don't need to be renumbered, but in the grand scope of things, this probably isn't much. Maybe just summarize the section to one paragraph? 6.3 Router Renumbering ==> I think Jinmei of KAME reported some experiences of router renumbering on the IPv6 list a year or two ago, the reason why they found it to be unworkable approach in practice. Sorry for being inprecise.. it might be useful to try to dig that out and put it as a reference or something. semi-editorial -------------- 3.3 Acquisition or merger Two networks may need to merge to one due to the acquisition or merger of two organisations or companies. Such a reorganisation may require one or more parts of the new network to renumber to the primary PA IPv6 prefix. ==> while this is all correct, it might be worth pointing out that v6 does not necessarily have the same acquisition/merger issues as v4 (e.g., a merge of two net-10 address spaces). I.e., you may not even need to merge the address spaces at all, if the offices are separate and the offices have separate net connectivity (for example). 4.2.4 "Sessions" in non-session based transports ==> this could possibly be merged with the previous 4.2.x sections -- at least there's no need to separate UDP and TCP-based NFS, imho. If sources are identified by the source address only, then this might appear as a new source to the receivers (as they would where IPv6 Privacy addresses are used). Using RTP a receiver may determine it's the same source. ==> the last sentence doesn't help much, I fear. Those that don't know _how_ won't have much idea after reading it, and those that do know how don't need the reminder.. is there a reference describing how to do it with SSM, or just remove? In order to renumber such a network, the DHCPv6 server should send reconfigure messages to inform the clients that the configuration has changed, and the clients should re-request configuration details from the DHCPv6 server. This, of course, relies on the clients correctly responding to such messages. Where DHCPv6 has been employed, careful consideration about the configuration of the service is required such that administrators can be confident that clients will re-contact the service to refresh their configuration data. As alluded to in sections 22.4 and 22.5 of [30], the configurable timers that offer servers the ability to control when clients re-contacts the server about its configuration can be set such that clients rarely (if ever) connect to validate their configuration set. ==> does DHCPv6 support address deprecation, is it an all-or-nothing deal? (old addresses are taken away when the new ones are given to replace the old) 6.2.2 Source Address Selection Policy distribution ==> this is under Stateful Configuration, but I guess this doesn't really require any state.. the policy could be the same independent of the address? (there's also a NDP version of this) Note that RFC2894 was developed before the shift in recommendation away from the Top-, Next- at Site-Level Aggregation Identifier address allocation hierarchy of RFC2373, ==> you may want to refer to RFC3587 here. 7.2 Border filtering ==> maybe also refer to to 7.5.1, for the filtering done by the provider? There are also cases where the use of a resolver is not practical, such as with packet filter rules. If a packet filter has been configured with explicit hostnames, these are translated to IP addresses for fast packet matching. ==> one of my pet peeves is that it isn't possible to represent prefix (and length) in a DNS record, so these couldn't be entered in the DNS even if you wanted to.. maybe this would be worth a bit of text somewhere in the document. A similar problem exists when a nameserver is renumbered. If the operating system's resolver has cached the nameserver address, it will at some point find it unavailable. To mitigate this problem, it is suggested that at least one off-site nameserver is included in the configuration. r==> the latter is in (small) conflict with ULAs, which in turn require split-faced DNS. As the off-site nameserver can't be split faced, the results may no longer be consistent ? "Helpdesk ops" service liveness monitoring software also poses a particular problem where liveness is determined, for example, by a null transaction (e.g. for POP3 mail server, authenticating and performing a NOOP) made against a named service instance, if the name is by IP then two instances of the liveness test will be required: one on the old address to cater for those remote parties that are not yet aware of the new address, and one test against the new. ==> so, this needs to be calling for new kind of coding practices/functions -- instead of cycling through the addresses and using the first that works, the apps should cycle trhough all the addresses and potentially report on all that do not work.. maybe this needs to be put more prominently somewhere. 7.7 Equipment administrative ownership The question of who owns and administers (also, who is authorised to administer) the site's access router is an issue in some renumbering situations. In the enterprise scenarios, the liaison between the end users and remote administrators is likely to be relatively easy; this is less likely to be the case for a SOHO scenario. This is not likely to be a major issue, however, since SOHO renumbering is likely to only be required if the remote administrators deem it necessary, or if the end user is sufficiently technically competent and decides to renumber their own network. ==> undoubtedly this has some issues, but you might also mention at least one of them ;-) Alternatively, should the old address space be available such that a single (or subnet of) Mobile IPv6 Home Agents be deployed in the routing path of the to-be-otherwise-interrupted connection, then the endpoint being renumbered could utilise layer 3 mobility once the old prefix removed from its link, i.e. register with the Home Agent in the old prefix topology - presumably in the provider's network, formerly upstream from the site - and rely on Mobile IPv6 route optimisation to make good the additional overhead imposed by the reverse tunnelling to the new prefix. ==> not sure what this does under "shims and sockets", and whether it's needed at all. Maybe I just didn't get the point.. o Names resolved to IP addresses in firewall at startup time ==> names are easy. Prefix lists are more tricky (e.g., allowing access from particular subnets..) [22] Hinden, R. and B. Haberman, "Unique Local IPv6 Unicast Addresses", draft-ietf-ipv6-unique-local-addr-09 (work in progress), January 2005. [23] Hinden, R. and B. Haberman, "Centrally Assigned Unique Local IPv6 Unicast Addresses", draft-ietf-ipv6-ula-central-00 (work in progress), June 2004. ==> these seem to be so important for this spec that should be under Normative references? editorial --------- When changing from 6to4 (2002::/16) addresses to native global aggregatable unicast addresses (under 2001::/16) ==> s/under/e.g., under/ ? These disruptive elements will be covered in situ as we discuss protocol features and other renumbering considerations later in this memo. ==> "situ" ? refreshed from the naming service, and as such even if the renumbering site does update it's DNS (or NIS, LDAP database etc.), ==> s/it's/its/ As per RFC2373 [17], IPv6 hosts may be multi-addressed. This means ==> update 2373 to 3513. Multicast features much more prominently in the core specification, ==> sounds a bit awkward? Where multicast is used to discover the availability of core services (e.g. all DHCPv6 servers in a site will join FF05::1:3), the effect of renumbering the unicast address of those services will mean that the services are still readily discoverable without resorting to a (bespoke or otherwise) service location protocol to continue to function - particularly if (unicast) ULAs are not deployed locally as per Section 5.5. ==> does "bespoke" belong to the commonly used international english vocabulary? :) be able to set local policy such that nodes use ULAs for intranet communications and global addresses for extranet communications. The use of ULAs internally would in principle mitigate against global address renumbering of nodes. One cost of such dual-scope deployment is the implied requirement to run a 'two-face' DNS, which can add an ==> s/extranet/Internet/ ? ==> s/two-face/two-faced/ The length of time for which the old prefix remains available has impacts on how long can be allowed for the renumbering procedure, and ==> s/impacts/impact/ and SOHOs might consider as little as one month's overlap too expensive, and so Baker's State 5 (Stable use of either prefix) [1] unattainable ==> something missing at the end? services (such as web servers) from one IP address to another, without going through a stage where the service is available on either address. ==> maybe better say "both [or all] addresses". For instance, the new provider may refuse to receive into their routing topology those packets whose source address is under the old prefix, and likewise for the old provider and new prefix. ==> "routing topology" is a bit awkward way to put it, as the ISP isn't even getting a route, just the packets. reword? : as the renumbering event takes place, the locator is updated to reflect the new address topology and the application blissfully unaware - a form of layer 3.5 mobility. ==> s/blissfully/is blissfully/ o Apache .Listen. directive on given IP address ==> generalize this a bit ? o PIM-SM Rendezvous Point address ==> for the non-multicast aware, add ".. on all the multicast routers" ? [27] Abley, J. and K. Lindqvist, "Operation of Anycast Services", draft-grow-anycast-00 (work in progress), February 2005. ==> draft-ietf-grow-anycast-00 now [36] Moskowitz, R., "Host Identity Protocol Architecture", draft-moskowitz-hip-arch-06 (work in progress), June 2004. ==> draft-ietf-hip-arch now From owner-v6ops@ops.ietf.org Sun Mar 6 15:29:52 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA22738 for ; Sun, 6 Mar 2005 15:29:51 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D82NI-0003IU-Nm for v6ops-data@psg.com; Sun, 06 Mar 2005 20:29:16 +0000 Received: from [195.30.1.100] (helo=moebius2.Space.Net) by psg.com with smtp (Exim 4.44 (FreeBSD)) id 1D82NF-0003I6-De for v6ops@ops.ietf.org; Sun, 06 Mar 2005 20:29:13 +0000 Received: (qmail 77330 invoked by uid 1007); 6 Mar 2005 20:29:12 -0000 Comment: DomainKeys? See http://antispam.yahoo.com/domainkeys DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=testkey; d=space.net; b=PwGZmFY+I8qKesgGwmPzmbeYkJAUREjS0Hc1LBPYnb+rwqU51sCpyyNprnUkUOR5 ; Date: Sun, 6 Mar 2005 21:29:12 +0100 From: Gert Doering To: Pekka Savola Cc: Tim Chown , v6ops@ops.ietf.org, renumber@6net.org Subject: Re: draft-chown-v6ops-renumber-thinkabout-01 Message-ID: <20050306202912.GS84850@Space.Net> References: <20050304120646.GD6484@login.ecs.soton.ac.uk> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-NCC-RegID: de.space X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00, SUBJ_HAS_UNIQ_ID autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, On Sun, Mar 06, 2005 at 09:51:28PM +0200, Pekka Savola wrote: > editorial > --------- > > When changing > from 6to4 (2002::/16) addresses to native global aggregatable unicast > addresses (under 2001::/16) > > ==> s/under/e.g., under/ ? Just noticed something: 2001::/16 is no longer the only "native global ... address" block - addresses are handed out from 2003::/16 already. Maybe the part "(under 2001::/16)" should just be completely removed? Gert Doering -- NetMaster -- Total number of prefixes smaller than registry allocations: 71007 (66629) SpaceNet AG Mail: netmaster@Space.Net Joseph-Dollinger-Bogen 14 Tel : +49-89-32356-0 D- 80807 Muenchen Fax : +49-89-32356-234 From owner-v6ops@ops.ietf.org Sun Mar 6 17:34:20 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA03485 for ; Sun, 6 Mar 2005 17:34:20 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D84Id-000EzU-9F for v6ops-data@psg.com; Sun, 06 Mar 2005 22:32:35 +0000 Received: from [152.78.70.1] (helo=raven.ecs.soton.ac.uk) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D84Ic-000EzH-BX for v6ops@ops.ietf.org; Sun, 06 Mar 2005 22:32:34 +0000 Received: from magpie.ecs.soton.ac.uk (magpie.ecs.soton.ac.uk [152.78.68.131]) by raven.ecs.soton.ac.uk (8.12.10/8.12.10) with ESMTP id j26MWRi3002044; Sun, 6 Mar 2005 22:32:27 GMT Received: from login.ecs.soton.ac.uk (IDENT:root@login [152.78.68.162]) by magpie.ecs.soton.ac.uk (8.9.3/8.9.3) with ESMTP id WAA02071; Sun, 6 Mar 2005 22:32:24 GMT Received: (from tjc@localhost) by login.ecs.soton.ac.uk (8.11.6/8.11.6) id j26MWOv15089; Sun, 6 Mar 2005 22:32:24 GMT Date: Sun, 6 Mar 2005 22:32:24 +0000 From: Tim Chown To: Gert Doering Cc: Pekka Savola , v6ops@ops.ietf.org Subject: Re: draft-chown-v6ops-renumber-thinkabout-01 Message-ID: <20050306223224.GA14964@login.ecs.soton.ac.uk> Mail-Followup-To: Gert Doering , Pekka Savola , v6ops@ops.ietf.org References: <20050304120646.GD6484@login.ecs.soton.ac.uk> <20050306202912.GS84850@Space.Net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20050306202912.GS84850@Space.Net> User-Agent: Mutt/1.4i X-MailScanner-Information: Please contact helpdesk@ecs.soton.ac.uk for more information X-ECS-MailScanner: Found to be clean X-MailScanner-From: tjc@smtp.ecs.soton.ac.uk X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00, SUBJ_HAS_UNIQ_ID autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk On Sun, Mar 06, 2005 at 09:29:12PM +0100, Gert Doering wrote: > > Just noticed something: 2001::/16 is no longer the only "native global > ... address" block - addresses are handed out from 2003::/16 already. > > Maybe the part "(under 2001::/16)" should just be completely removed? Thanks Gert - good suggestion (better than renumbering the renumbering draft!). [Accidental cc to @6net address removed] Tim From owner-v6ops@ops.ietf.org Mon Mar 7 08:33:26 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA13216 for ; Mon, 7 Mar 2005 08:33:25 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D8IJ8-0001yi-02 for v6ops-data@psg.com; Mon, 07 Mar 2005 13:30:02 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D8IJ6-0001xx-Sj for v6ops@ops.ietf.org; Mon, 07 Mar 2005 13:30:01 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j27DTx503110; Mon, 7 Mar 2005 15:29:59 +0200 Date: Mon, 7 Mar 2005 15:29:59 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org cc: jonne.soininen@nokia.com Subject: scribes needed Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, (co-chair hat on) As always we need minute-takers to the meeting. A scribe or two is a must, and jabber is bonus. If you'd like to help, please send a note to the chairs. Thanks! (hat off) -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Mon Mar 7 15:16:43 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA29082 for ; Mon, 7 Mar 2005 15:16:42 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D8Oae-000AsI-HK for v6ops-data@psg.com; Mon, 07 Mar 2005 20:12:32 +0000 Received: from [202.249.10.124] (helo=shuttle.wide.toshiba.co.jp) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D8Oab-000ArN-H6 for v6ops@ops.ietf.org; Mon, 07 Mar 2005 20:12:29 +0000 Received: from ocean.jinmei.org (unknown [2001:468:19ff:128:78e2:f09b:62c1:f514]) by shuttle.wide.toshiba.co.jp (Postfix) with ESMTP id 1B03115210; Tue, 8 Mar 2005 05:12:26 +0900 (JST) Date: Tue, 08 Mar 2005 05:13:00 +0900 Message-ID: From: JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?= To: Pekka Savola Cc: Tim Chown , v6ops@ops.ietf.org Subject: Re: draft-chown-v6ops-renumber-thinkabout-01 In-Reply-To: References: <20050304120646.GD6484@login.ecs.soton.ac.uk> User-Agent: Wanderlust/2.10.1 (Watching The Wheels) Emacs/21.3 Mule/5.0 (SAKAKI) Organization: Research & Development Center, Toshiba Corp., Kawasaki, Japan. MIME-Version: 1.0 (generated by SEMI 1.14.5 - "Awara-Onsen") Content-Type: text/plain; charset=US-ASCII X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00, SUBJ_HAS_UNIQ_ID autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk >>>>> On Sun, 6 Mar 2005 21:51:28 +0200 (EET), >>>>> Pekka Savola said: > 6.3 Router Renumbering > ==> I think Jinmei of KAME reported some experiences of router renumbering > on the IPv6 list a year or two ago, the reason why they found it to be > unworkable approach in practice. Sorry for being inprecise.. it might be > useful to try to dig that out and put it as a reference or something. I don't recall a report on router renumbering a year or two ago, but I did make a short presentation about our experiences in December 2000: http://www.ietf.org/proceedings/00dec/00dec-53.htm#TopOfPage I'm not sure whether this is what you meant. In any event, our conclusion regarding router renumbering was not that negative, but we thought it did not make much sense to apply this technique to large sites (e.g, an enterprise network). JINMEI, Tatuya Communication Platform Lab. Corporate R&D Center, Toshiba Corp. jinmei@isl.rdc.toshiba.co.jp From owner-v6ops@ops.ietf.org Mon Mar 7 15:51:44 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA02433 for ; Mon, 7 Mar 2005 15:51:43 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D8PBQ-000KRx-SK for v6ops-data@psg.com; Mon, 07 Mar 2005 20:50:32 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D8PBN-000KRG-1D for v6ops@ops.ietf.org; Mon, 07 Mar 2005 20:50:29 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j27KoEo14199; Mon, 7 Mar 2005 22:50:14 +0200 Date: Mon, 7 Mar 2005 22:50:14 +0200 (EET) From: Pekka Savola To: JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?= cc: Tim Chown , v6ops@ops.ietf.org Subject: Re: draft-chown-v6ops-renumber-thinkabout-01 In-Reply-To: Message-ID: References: <20050304120646.GD6484@login.ecs.soton.ac.uk> MIME-Version: 1.0 Content-Type: MULTIPART/MIXED; BOUNDARY="1589707168-741539258-1110228614=:14176" X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-1.9 required=5.0 tests=AWL,BAYES_00, SUBJ_HAS_UNIQ_ID autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. --1589707168-741539258-1110228614=:14176 Content-Type: TEXT/PLAIN; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8BIT On Tue, 8 Mar 2005, JINMEI Tatuya / [ISO-2022-JP] ¿ÀÌÀãºÈ wrote: > I don't recall a report on router renumbering a year or two ago, but I > did make a short presentation about our experiences in December 2000: > > http://www.ietf.org/proceedings/00dec/00dec-53.htm#TopOfPage > > I'm not sure whether this is what you meant. In any event, our > conclusion regarding router renumbering was not that negative, but we > thought it did not make much sense to apply this technique to large > sites (e.g, an enterprise network). Yes, this is what I was recalling, The "report" that triggered this memory is below. ========== Date: Fri, 15 Aug 2003 03:12:19 +0900 Message-ID: From: JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?= To: Ralph Droms Cc: ipng@sunroof.eng.sun.com Subject: Re: inevitability of PI [...] >>>>> On Thu, 14 Aug 2003 07:35:57 -0400, >>>>> Ralph Droms said: > Another potential advantage for IPv6 that is a little harder to quantify is > the notion of "graceful" renumbering - the ability to have a transition > state in which both the old and new prefixes are in use simultaneously. > Will this transition state work in practice? Has anyone actually tried it? Not sure if this answers your question, but we tried site-(IPv6)renumbering in an experimental environment 3 years ago. In that testing, we had a transition state with the both old and new prefixes. The presentation slides of a report at an IETF meeting are available at the following URL: http://www.jinmei.org/mgp/ietf49-renumber/ JINMEI, Tatuya Communication Platform Lab. ================= --1589707168-741539258-1110228614=:14176-- From owner-v6ops@ops.ietf.org Wed Mar 9 08:47:58 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA03137 for ; Wed, 9 Mar 2005 08:47:58 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D91Ua-000FBH-9w for v6ops-data@psg.com; Wed, 09 Mar 2005 13:44:52 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D91UZ-000FB2-2u for v6ops@ops.ietf.org; Wed, 09 Mar 2005 13:44:51 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j29Dinw03203 for ; Wed, 9 Mar 2005 15:44:49 +0200 Date: Wed, 9 Mar 2005 15:44:49 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org Subject: document status and other WG information Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, The proto team has developed a couple of very nice pages, e.g., to better illustrate the document status of a WG. Please take a look at it at: http://tools.ietf.org/wg/v6ops/ -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Wed Mar 9 09:08:08 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA04825 for ; Wed, 9 Mar 2005 09:08:08 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D91qe-000IZP-Px for v6ops-data@psg.com; Wed, 09 Mar 2005 14:07:40 +0000 Received: from [152.78.70.1] (helo=raven.ecs.soton.ac.uk) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D91qb-000IYs-HO for v6ops@ops.ietf.org; Wed, 09 Mar 2005 14:07:37 +0000 Received: from magpie.ecs.soton.ac.uk (magpie.ecs.soton.ac.uk [152.78.68.131]) by raven.ecs.soton.ac.uk (8.12.10/8.12.10) with ESMTP id j29E7ai3024631 for ; Wed, 9 Mar 2005 14:07:36 GMT Received: from login.ecs.soton.ac.uk (IDENT:root@login [152.78.68.162]) by magpie.ecs.soton.ac.uk (8.9.3/8.9.3) with ESMTP id OAA00621 for ; Wed, 9 Mar 2005 14:07:35 GMT Received: (from tjc@localhost) by login.ecs.soton.ac.uk (8.11.6/8.11.6) id j29E7Zq32409 for v6ops@ops.ietf.org; Wed, 9 Mar 2005 14:07:35 GMT Date: Wed, 9 Mar 2005 14:07:35 +0000 From: Tim Chown To: v6ops@ops.ietf.org Subject: Re: document status and other WG information Message-ID: <20050309140735.GF32153@login.ecs.soton.ac.uk> Mail-Followup-To: v6ops@ops.ietf.org References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4i X-MailScanner-Information: Please contact helpdesk@ecs.soton.ac.uk for more information X-ECS-MailScanner: Found to be clean X-MailScanner-From: tjc@smtp.ecs.soton.ac.uk X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk It would be very nice to see current personal drafts under v6ops there too... On Wed, Mar 09, 2005 at 03:44:49PM +0200, Pekka Savola wrote: > Hi, > > The proto team has developed a couple of very nice pages, e.g., to > better illustrate the document status of a WG. > > Please take a look at it at: > http://tools.ietf.org/wg/v6ops/ > > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings -- Tim From owner-v6ops@ops.ietf.org Wed Mar 9 09:20:31 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA06287 for ; Wed, 9 Mar 2005 09:20:31 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D922Q-000K8D-GA for v6ops-data@psg.com; Wed, 09 Mar 2005 14:19:50 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D922L-000K7Z-Bd for v6ops@ops.ietf.org; Wed, 09 Mar 2005 14:19:46 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j29EJga04394 for ; Wed, 9 Mar 2005 16:19:42 +0200 Date: Wed, 9 Mar 2005 16:19:42 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org Subject: proposed draft charter Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, (co-chair hat on) After discussion with our AD, we've added a paragraph to the chartr, underlying the fact that there must be support for the work, and it must be completed in a reasonable time: There must be a continuous expression of interest for the WG to work on a particular work item. If there is no longer sufficient interest in the WG in a work item, the item may be removed from the list of WG items. The whole proposed charter is below. (hat off) ============ Description of Working Group: The global deployment of IPv6 is underway, creating an IPv4/IPv6 Internet consisting of IPv4-only, IPv6-only and IPv4/IPv6 networks and nodes. This deployment must be properly handled to avoid the division of the Internet into separate IPv4 and IPv6 networks while ensuring addressing and connectivity for all IPv4 and IPv6 nodes. The IPv6 Operations Working Group (v6ops) develops guidelines for the operation of a shared IPv4/IPv6 Internet and provides operational guidance on how to deploy IPv6 into existing IPv4-only networks, as well as into new network installations. The main focus of the v6ops WG is to look at the immediate deployment issues; more advanced stages of deployment and transition are a lower priority. The goals of the v6ops working group are: 1. Solicit input from network operators and users to identify operational issues with the IPv4/IPv6 Internet, and determine solutions or workarounds to those issues. These issues will be documented in Informational or BCP RFCs, or in Internet-Drafts. This work should primarily be conducted by those areas and WGs which are responsible and best fit to analyze these problems, but v6ops may also cooperate in focusing such work. 2. Publish Informational or BCP RFCs that identify potential security risks in the operation of shared IPv4/IPv6 networks, and document operational practices to eliminate or mitigate those risks. This work will be done in cooperation with the Security area and other relevant areas or working groups. 3. As a particular instance of (1) and (2), provide feedback to the IPv6 WG regarding portions of the IPv6 specifications that cause, or are likely to cause, operational or security concerns, and work with the IPv6 WG to resolve those concerns. This feedback will be published in Internet-Drafts or RFCs. 4. Publish Informational or BCP RFCs that identify and analyze solutions for deploying IPv6 within common network environments, such as ISP Networks, Enterprise Networks, Unmanaged Networks (Home/Small Office), and Cellular Networks. These documents should serve as useful guides to network operators and users on possible ways how to deploy IPv6 within their existing IPv4 networks, as well as in new network installations. These documents should not be normative guides for IPv6 deployment, and the primary intent is not capture the needs for new solutions, but rather describe which approaches work and which do not. IPv6 operational and deployment issues with specific protocols or technologies (such as Applications, Transport Protocols, Routing Protocols, DNS or Sub-IP Protocols) are the primary responsibility of the groups or areas responsible for those protocols or technologies. However, the v6ops WG may provide input to those areas/groups, as needed, and cooperate with those areas/groups in reviewing solutions to IPv6 operational and deployment problems. Future work items within this scope will be adopted by the WG only if there is a substantial expression of interest from the community and if the work clearly does not fit elsewhere in the IETF. There must be a continuous expression of interest for the WG to work on a particular work item. If there is no longer sufficient interest in the WG in a work item, the item may be removed from the list of WG items. Specifying any protocols or transition mechanisms is out of scope of the WG. Goals and Milestones: Done Adopt IPv6 deployment using VLANs to IESG for Info Done Adopt ISP IPv6 Deployment Scenarios in Broadband Access Networks as WG item Mar 05 Adopt document describing how to use IPsec with draft-ietf-v6ops-mech-v2 as WG item Mar 05 Adopt IPv6 Security Overview as WG item Mar 05 Adopt IPv6 Network Architecture Protection as WG item Apr 05 Submit document describing issues with NAT-PT to IESG for Info Apr 05 Submit IPv6 deployment using VLANs to IESG for Info Apr 05 Ensure draft-ietf-v6ops-v6onbydefault keeps going forward for RFC publication May 05 Submit document on IPsec w/ draft-ietf-v6ops-mech-v2 to IESG for Info Jun 05 Submit Enterprise Deployment Analysis to IESG for Info Jun 05 Submit IPv6 Network Architecture Protection to IESG for Info Jul 05 Submit IPv6 Security Overview to IESG for Info Jul 05 Submit ISP IPv6 Deployment Scenarios in Broadband Access Networks to IESG for Info From owner-v6ops@ops.ietf.org Wed Mar 9 09:20:54 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA06331 for ; Wed, 9 Mar 2005 09:20:54 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D923B-000KEp-BO for v6ops-data@psg.com; Wed, 09 Mar 2005 14:20:37 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D923A-000KEW-3K for v6ops@ops.ietf.org; Wed, 09 Mar 2005 14:20:36 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j29EKSZ04411; Wed, 9 Mar 2005 16:20:28 +0200 Date: Wed, 9 Mar 2005 16:20:28 +0200 (EET) From: Pekka Savola To: Tim Chown cc: v6ops@ops.ietf.org Subject: Re: document status and other WG information In-Reply-To: <20050309140735.GF32153@login.ecs.soton.ac.uk> Message-ID: References: <20050309140735.GF32153@login.ecs.soton.ac.uk> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk On Wed, 9 Mar 2005, Tim Chown wrote: > It would be very nice to see current personal drafts under v6ops > there too... Yes, this is known by the tools team, and will likely be added in the future. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Wed Mar 9 09:42:44 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA09396 for ; Wed, 9 Mar 2005 09:42:43 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D92O0-000MqI-Tw for v6ops-data@psg.com; Wed, 09 Mar 2005 14:42:08 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D92Nz-000Mpt-1M for v6ops@ops.ietf.org; Wed, 09 Mar 2005 14:42:08 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j29Eg4705279; Wed, 9 Mar 2005 16:42:04 +0200 Date: Wed, 9 Mar 2005 16:42:04 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org Subject: Reinforcing the new focus of the WG Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; CHARSET=US-ASCII; FORMAT=flowed Content-ID: X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hello all, The v6ops WG has come a long way since 2003 when we took over the chair responsibilities. A certain period ended after the last meeting when the WG decided to decree protocol work out of scope. When this is given the official seal with the rechartering, a new era is beginning. The WG needs to evolve and grow to better understand and address the operational and security concerns the IPv6 deployment brings. We believe it is best that we pass the chairing duties to a "next generation" to reinforce the fact that we need fresh blood and thoughts and that we should not be stuck in the past. Kurtis Lindqvist and Fred Baker have accepted to pick up the ball. We wish all the best for them in the new role and hope that the WG will flourish under their leadership. Soon-to-be ex-co-chairs, Pekka & Jonne From owner-v6ops@ops.ietf.org Wed Mar 9 09:56:37 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA11345 for ; Wed, 9 Mar 2005 09:56:37 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D92af-000OKM-BS for v6ops-data@psg.com; Wed, 09 Mar 2005 14:55:13 +0000 Received: from [131.228.20.27] (helo=mgw-x4.nokia.com) by psg.com with esmtps (TLSv1:DES-CBC3-SHA:168) (Exim 4.44 (FreeBSD)) id 1D92ad-000OJc-VN for v6ops@ops.ietf.org; Wed, 09 Mar 2005 14:55:12 +0000 Received: from esdks003.ntc.nokia.com (esdks003.ntc.nokia.com [172.21.138.158]) by mgw-x4.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j29EtWA12830; Wed, 9 Mar 2005 16:55:33 +0200 (EET) X-Scanned: Wed, 9 Mar 2005 16:55:03 +0200 Nokia Message Protector V1.3.34 2004121512 - RELEASE Received: (from root@localhost) by esdks003.ntc.nokia.com (8.12.9/8.12.9) id j29Et32H019071; Wed, 9 Mar 2005 16:55:03 +0200 Received: from mgw-int2.ntc.nokia.com (172.21.143.97) by esdks003.ntc.nokia.com 00C9JV0a; Wed, 09 Mar 2005 16:55:01 EET Received: from esebh002.NOE.Nokia.com (esebh002.ntc.nokia.com [172.21.138.77]) by mgw-int2.ntc.nokia.com (Switch-2.2.8/Switch-2.2.8) with ESMTP id j29Et1U14033; Wed, 9 Mar 2005 16:55:01 +0200 (EET) Received: from dadhcp-172019068136.americas.nokia.com ([172.19.68.140]) by esebh002.NOE.Nokia.com with Microsoft SMTPSVC(5.0.2195.6881); Wed, 9 Mar 2005 16:55:00 +0200 Received: (from david@localhost) by dadhcp-172019068136.americas.nokia.com (8.12.11/8.12.11/Submit) id j29Et5Fk006634; Wed, 9 Mar 2005 06:55:05 -0800 Date: Wed, 9 Mar 2005 06:54:55 -0800 From: David Kessens To: Pekka Savola Cc: v6ops@ops.ietf.org Subject: Re: Reinforcing the new focus of the WG Message-ID: <20050309145455.GA6471@nokia.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.4.1i X-OriginalArrivalTime: 09 Mar 2005 14:55:01.0638 (UTC) FILETIME=[F87B6A60:01C524B7] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Pekka & Jonne, On Wed, Mar 09, 2005 at 04:42:04PM +0200, Pekka Savola wrote: > > We believe it is best that we pass the chairing duties to a "next > generation" to reinforce the fact that we need fresh blood and thoughts and > that we should not be stuck in the past. I would like to thank you for all the hard work as v6ops chairs. It has been pleasure to work with you. I hope that we can now enter a new phase for ipv6 deployment where we can focus and deal with the operational issues that are being discovered during the continued rollout of ipv6. Thanks, David Kessens --- From owner-v6ops@ops.ietf.org Wed Mar 9 10:01:16 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA11800 for ; Wed, 9 Mar 2005 10:01:15 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D92ft-000PKx-7B for v6ops-data@psg.com; Wed, 09 Mar 2005 15:00:37 +0000 Received: from [192.11.226.163] (helo=hoemail2.lucent.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D92fa-000PFY-Ci for v6ops@ops.ietf.org; Wed, 09 Mar 2005 15:00:18 +0000 Received: from nl0006exch001h.wins.lucent.com (h135-85-76-62.lucent.com [135.85.76.62]) by hoemail2.lucent.com (8.12.11/8.12.11) with ESMTP id j29F0Fvs007465 for ; Wed, 9 Mar 2005 09:00:16 -0600 (CST) Received: by nl0006exch001h.nl.lucent.com with Internet Mail Service (5.5.2657.72) id <1Z0MT5R8>; Wed, 9 Mar 2005 16:00:13 +0100 Message-ID: <7D5D48D2CAA3D84C813F5B154F43B15503C7A18F@nl0006exch001u.nl.lucent.com> From: "Wijnen, Bert (Bert)" To: "'David Kessens'" , Pekka Savola Cc: v6ops@ops.ietf.org Subject: RE: Reinforcing the new focus of the WG Date: Wed, 9 Mar 2005 16:00:13 +0100 MIME-Version: 1.0 X-Mailer: Internet Mail Service (5.5.2657.72) Content-Type: text/plain X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.4 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Also my thnaks to Jonne and Pekka for their work as v6ops co-chairs! Bert From owner-v6ops@ops.ietf.org Wed Mar 9 11:26:38 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA21117 for ; Wed, 9 Mar 2005 11:26:38 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D93xr-0005Dp-PA for v6ops-data@psg.com; Wed, 09 Mar 2005 16:23:15 +0000 Received: from [152.78.70.1] (helo=raven.ecs.soton.ac.uk) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D93xp-0005DV-KZ for v6ops@ops.ietf.org; Wed, 09 Mar 2005 16:23:13 +0000 Received: from magpie.ecs.soton.ac.uk (magpie.ecs.soton.ac.uk [152.78.68.131]) by raven.ecs.soton.ac.uk (8.12.10/8.12.10) with ESMTP id j29GNCi3028731 for ; Wed, 9 Mar 2005 16:23:12 GMT Received: from login.ecs.soton.ac.uk (IDENT:root@login [152.78.68.162]) by magpie.ecs.soton.ac.uk (8.9.3/8.9.3) with ESMTP id QAA12852 for ; Wed, 9 Mar 2005 16:23:11 GMT Received: (from tjc@localhost) by login.ecs.soton.ac.uk (8.11.6/8.11.6) id j29GNBO03927 for v6ops@ops.ietf.org; Wed, 9 Mar 2005 16:23:11 GMT Date: Wed, 9 Mar 2005 16:23:11 +0000 From: Tim Chown To: v6ops@ops.ietf.org Subject: RIPE TTM data Message-ID: <20050309162311.GA3684@login.ecs.soton.ac.uk> Mail-Followup-To: v6ops@ops.ietf.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.4i X-MailScanner-Information: Please contact helpdesk@ecs.soton.ac.uk for more information X-ECS-MailScanner: Found to be clean X-MailScanner-From: tjc@smtp.ecs.soton.ac.uk X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk As mentioned in the WG today: http://www.ripe.net/projects/ttm/ Look under test box data, then IPv6. This data is now openly available, though if you use it you must notify RIPE NCC. There are maybe 100 servers, and 30+ are IPv6 capable. We have run such a server for 3 years or so (tt76) and there is one server in Japan (but none in the US, I believe). By viewing the IPv4 and IPv6 data for the same node pairs, you can compare IPv4 and IPv6 performance. The nice feature is the historic view (including traceroute). There was also a tunnel detection view (showing server-server MTUs) but not sure if that went production or not. Tim -- Tim From owner-v6ops@ops.ietf.org Wed Mar 9 11:58:32 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA25065 for ; Wed, 9 Mar 2005 11:58:32 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D94VX-0009ZN-3c for v6ops-data@psg.com; Wed, 09 Mar 2005 16:58:03 +0000 Received: from [144.254.224.140] (helo=ams-iport-1.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D94VW-0009Z2-1R for v6ops@psg.com; Wed, 09 Mar 2005 16:58:02 +0000 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 09 Mar 2005 18:18:37 +0100 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== Received: from xbh-ams-332.emea.cisco.com (xbh-ams-332.cisco.com [144.254.231.87]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j29GukmW010429 for ; Wed, 9 Mar 2005 17:57:31 +0100 (MET) Received: from xfe-ams-332.cisco.com ([144.254.231.73]) by xbh-ams-332.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.0); Wed, 9 Mar 2005 17:57:30 +0100 Received: from evyncke-w2k02.cisco.com ([10.61.80.238]) by xfe-ams-332.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Wed, 9 Mar 2005 17:57:29 +0100 Message-Id: <5.1.0.14.2.20050309174157.042609a0@127.0.0.1> X-Sender: evyncke@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Wed, 09 Mar 2005 17:54:08 +0100 To: v6ops@psg.com From: Eric Vyncke Subject: Some comments on draft-tschofenig-v6ops-secure-tunnels Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-OriginalArrivalTime: 09 Mar 2005 16:57:30.0025 (UTC) FILETIME=[14764990:01C524C9] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Just had a quick look this morning after the WG meeting on this document. Some hopefully useful comments: 1) section 2.2, should be augmented because tunnel mode prevents the use of multicast (and more generally routing protocols -- cfr Joe Touch's I-D for IPv4) while transport mode does 2) section 2.2, IPsec will detect indirectly if the outer IPv4 addresses are wrong (spoofing among sites) because the decapsulation will fail since the crypto keys (for ESP and for AH) are based on 3) section 8, NAT-T for IKEv1 is actually a RFC and not an I-D, RFC 3948 4) section 11, security considerations, the obvious should perhaps be stated? Like DoS on the IPsec endpoint by flooding it with packets with the right SPI to force CPU intensive IPsec crypto operations. Or packet drop by a party along the tunnel path, ... 5) another use case scenario can be (and actually I've seen it deployed): using this IPsec protected IPv6 tunnel as a back-up link of a 'real native' IPv6 link in order to provide resiliency. This of course requires routing protocols hence the use of the 'transport mode' variant. If required, I'll be ready to provide some text for the above points if the authors want. Hope this helps to finalize this useful I-D -eric From owner-v6ops@ops.ietf.org Wed Mar 9 12:45:56 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA00827 for ; Wed, 9 Mar 2005 12:45:55 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D95Ef-000Fms-Js for v6ops-data@psg.com; Wed, 09 Mar 2005 17:44:41 +0000 Received: from [202.249.10.124] (helo=shuttle.wide.toshiba.co.jp) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D94sh-000D7o-Ha for v6ops@ops.ietf.org; Wed, 09 Mar 2005 17:21:59 +0000 Received: from ocean.jinmei.org (wireless-130-129-133-252.ietf62.ietf.org [130.129.133.252]) by shuttle.wide.toshiba.co.jp (Postfix) with ESMTP id D857315210 for ; Thu, 10 Mar 2005 02:21:57 +0900 (JST) Date: Thu, 10 Mar 2005 02:22:29 +0900 Message-ID: From: JINMEI Tatuya / =?ISO-2022-JP?B?GyRCP0BMQEMjOkgbKEI=?= To: v6ops@ops.ietf.org Subject: how to subscribe to users@ipv6.org User-Agent: Wanderlust/2.10.1 (Watching The Wheels) Emacs/21.3 Mule/5.0 (SAKAKI) Organization: Research & Development Center, Toshiba Corp., Kawasaki, Japan. MIME-Version: 1.0 (generated by SEMI 1.14.5 - "Awara-Onsen") Content-Type: text/plain; charset=US-ASCII X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk As requested at the meeting, here is the way to subscribe: http://www.ipv6.org/mailing-lists.html In short, you should be able to subscribe to the list by sending an e-mail message to majordomo@ipv6.org with the following line subscribe users in the message body (not in the subject field of the message header). JINMEI, Tatuya Communication Platform Lab. Corporate R&D Center, Toshiba Corp. jinmei@isl.rdc.toshiba.co.jp From owner-v6ops@ops.ietf.org Wed Mar 9 13:19:01 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA03621 for ; Wed, 9 Mar 2005 13:19:01 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D95lC-000JmX-Lh for v6ops-data@psg.com; Wed, 09 Mar 2005 18:18:18 +0000 Received: from [161.114.64.104] (helo=zmamail04.zma.compaq.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D95l6-000Jm4-QY for v6ops@ops.ietf.org; Wed, 09 Mar 2005 18:18:12 +0000 Received: from tayexg12.americas.cpqcorp.net (tayexg12.americas.cpqcorp.net [16.103.130.127]) by zmamail04.zma.compaq.com (Postfix) with ESMTP id 2C2F952BB for ; Wed, 9 Mar 2005 13:18:12 -0500 (EST) Received: from tayexc13.americas.cpqcorp.net ([16.103.130.26]) by tayexg12.americas.cpqcorp.net with Microsoft SMTPSVC(6.0.3790.211); Wed, 9 Mar 2005 13:18:11 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: Japan IPv6 Deployment Guide I referenced at the meeting today Date: Wed, 9 Mar 2005 13:18:13 -0500 Message-ID: <9C422444DE99BC46B3AD3C6EAFC9711B0895BF22@tayexc13.americas.cpqcorp.net> Thread-Topic: Japan IPv6 Deployment Guide I referenced at the meeting today Thread-Index: AcUkwhpCXDBIu/SgQSmZfhB6m60x3QAEchqA From: "Bound, Jim" To: X-OriginalArrivalTime: 09 Mar 2005 18:18:12.0065 (UTC) FILETIME=[5A8AF510:01C524D4] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable Folks, Below are URLs to IPv6 deployment guides I referenced at my talk today per Enterprise Analysis. Thanks to Marueen Stillman from Nokia. /jim ----------------- IPv6 Deployment Council of Japan Here is the doc entitled: IPv6 Deployment Guide http://www.v6pc.jp/pdf/041007_v6trans_guideline.pdf Here is the info on the deployment WG of the deployment council: http://www.v6pc.jp/en/wg/transWG/ Thanks for your talk today. =20 -- Maureen From owner-v6ops@ops.ietf.org Wed Mar 9 16:29:16 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA22047 for ; Wed, 9 Mar 2005 16:29:16 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D98fR-00016J-Il for v6ops-data@psg.com; Wed, 09 Mar 2005 21:24:33 +0000 Received: from [171.68.10.87] (helo=sj-iport-5.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D98fG-00015R-Lq for v6ops@ops.ietf.org; Wed, 09 Mar 2005 21:24:22 +0000 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-5.cisco.com with ESMTP; 09 Mar 2005 13:24:58 -0800 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.90,151,1107763200"; d="scan'208"; a="166224481:sNHT3965241412" Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j29LO9q8016124; Wed, 9 Mar 2005 13:24:10 -0800 (PST) Received: from [130.129.66.137] (sjc-vpn1-54.cisco.com [10.21.96.54]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with ESMTP id BCQ63617; Wed, 9 Mar 2005 13:24:15 -0800 (PST) In-Reply-To: References: Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: v6ops@ops.ietf.org From: Baker Fred Subject: Re: Reinforcing the new focus of the WG Date: Wed, 9 Mar 2005 15:24:14 -0600 To: Pekka Savola , Soininen Jonne Nokia-NETHelsinki X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Guys: I want to say that I think the two of you have done a fine job in v6ops in the past few years, and I look forward to working with the folks to get things accomplished in the future. On Mar 9, 2005, at 8:42 AM, Pekka Savola wrote: > Hello all, > > The v6ops WG has come a long way since 2003 when we took over the > chair responsibilities. A certain period ended after the last meeting > when the WG decided to decree protocol work out of scope. When this > is given the official seal with the rechartering, a new era is > beginning. The WG needs to evolve and grow to better understand and > address the operational and security concerns the IPv6 deployment > brings. > > We believe it is best that we pass the chairing duties to a "next > generation" to reinforce the fact that we need fresh blood and > thoughts and that we should not be stuck in the past. > > Kurtis Lindqvist and Fred Baker have accepted to pick up the ball. > > We wish all the best for them in the new role and hope that the WG > will flourish under their leadership. > > Soon-to-be ex-co-chairs, > Pekka & Jonne > From owner-v6ops@ops.ietf.org Wed Mar 9 19:44:20 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id TAA09521 for ; Wed, 9 Mar 2005 19:44:19 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9Bka-0002Ri-NK for v6ops-data@psg.com; Thu, 10 Mar 2005 00:42:04 +0000 Received: from [66.163.168.179] (helo=smtp800.mail.sc5.yahoo.com) by psg.com with smtp (Exim 4.44 (FreeBSD)) id 1D9BkZ-0002RN-8x for v6ops@psg.com; Thu, 10 Mar 2005 00:42:03 +0000 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@64.160.54.17 with login) by smtp800.mail.sc5.yahoo.com with SMTP; 10 Mar 2005 00:42:02 -0000 Message-ID: <02de01c52509$f7cc1e50$6601a8c0@adithya> From: "Mohan Parthasarathy" To: , "Eric Vyncke" References: <5.1.0.14.2.20050309174157.042609a0@127.0.0.1> Subject: Re: Some comments on draft-tschofenig-v6ops-secure-tunnels Date: Wed, 9 Mar 2005 16:41:58 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Eric, Thanks for your comments. > Just had a quick look this morning after the WG meeting on this document. > > Some hopefully useful comments: > > 1) section 2.2, should be augmented because tunnel mode prevents the use of multicast (and more generally routing protocols -- cfr Joe Touch's I-D for IPv4) while transport mode does > A tunnel mode SA can carry multicast traffic between two end points. Just define the SPD to contain multicast addresses. I agree that we have to point out the issues mentioned in Joe Touch's draft somewhere.. > 2) section 2.2, IPsec will detect indirectly if the outer IPv4 addresses are wrong (spoofing among sites) because the decapsulation will fail since the crypto keys (for ESP and for AH) are based on > SPI alone is sufficient looking up the SA for unicast traffic and this is how it is defined in the recent AH/ESP drafts. > 3) section 8, NAT-T for IKEv1 is actually a RFC and not an I-D, RFC 3948 > Ok, will fix it. > 4) section 11, security considerations, the obvious should perhaps be stated? Like DoS on the IPsec endpoint by flooding it with packets with the right SPI to force CPU intensive IPsec crypto operations. Or packet drop by a party along the tunnel path, ... > Perhaps we can add that.. > 5) another use case scenario can be (and actually I've seen it deployed): using this IPsec protected IPv6 tunnel as a back-up link of a 'real native' IPv6 link in order to provide resiliency. This of course requires routing protocols hence the use of the 'transport mode' variant. > I don't know whether it is relevant to the current document or not. I will let Pekka answer this. -mohan > If required, I'll be ready to provide some text for the above points if the authors want. > > Hope this helps to finalize this useful I-D > > -eric > From owner-v6ops@ops.ietf.org Wed Mar 9 20:22:38 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id UAA12310 for ; Wed, 9 Mar 2005 20:22:37 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9CN0-000N1l-Oo for v6ops-data@psg.com; Thu, 10 Mar 2005 01:21:46 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9CMz-000N1V-5C for v6ops@ops.ietf.org; Thu, 10 Mar 2005 01:21:45 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j2A1Lfr21325; Thu, 10 Mar 2005 03:21:41 +0200 Date: Thu, 10 Mar 2005 03:21:41 +0200 (EET) From: Pekka Savola To: Mohan Parthasarathy cc: v6ops@ops.ietf.org, Eric Vyncke Subject: Re: Some comments on draft-tschofenig-v6ops-secure-tunnels In-Reply-To: <02de01c52509$f7cc1e50$6601a8c0@adithya> Message-ID: References: <5.1.0.14.2.20050309174157.042609a0@127.0.0.1> <02de01c52509$f7cc1e50$6601a8c0@adithya> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk On Wed, 9 Mar 2005, Mohan Parthasarathy wrote: > Thanks for your comments. Likewise, thanks. Your review and support is appreciated. >> 2) section 2.2, IPsec will detect indirectly if the outer IPv4 addresses are wrong (spoofing among sites) because the >> decapsulation will fail since the crypto keys (for ESP and for AH) >> are based on > > SPI alone is sufficient looking up the SA for unicast traffic and > this is how it is defined in the recent AH/ESP drafts. Hmm. Does this cause any issues if this is implemented either way? I guess we'll need to support both.. >> 5) another use case scenario can be (and actually I've seen it >> deployed): using this IPsec protected IPv6 tunnel as a back-up link >> of a 'real native' IPv6 link in order to provide resiliency. This >> of course requires routing protocols hence the use of the >> 'transport mode' variant. > > I don't know whether it is relevant to the current document or not. > I will let Pekka answer this. (This is my opinion only, of course. :) As far as I understand, the above is only an issue if the tunnel mode SA is not modelled as an interface (based on the touch-vpn, now RFC3884, right? If it's an interface, it could be used to run a routing protocol (as long as it's not IS-IS :-) just fine? I think we are already assuming that it's an interface, and this should not be an issue? In any case, section 5.1 already describes transport mode router-to-router tunneling, which may or may not use lose ingress filtering capability depending on whether the transport mode is modelled as an interface or not. So, I guess we already have all the technical bases covered (unless I'm missing something?), and the issue is just whether this usage scenario is should be explicitly mentioned in the draft. I'd say not, because this seems to be a much more specific example case than the ones we currently have in the draft, and listing a specific one might be misleading. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Wed Mar 9 22:06:11 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA22529 for ; Wed, 9 Mar 2005 22:06:11 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9Dwj-0007GE-3Q for v6ops-data@psg.com; Thu, 10 Mar 2005 03:02:45 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9Dwh-0007Fp-S0 for v6ops@ops.ietf.org; Thu, 10 Mar 2005 03:02:44 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j2A32gx23787 for ; Thu, 10 Mar 2005 05:02:42 +0200 Date: Thu, 10 Mar 2005 05:02:42 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org Subject: Take NAP as WG document? Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, (co-chair hat on, still for a while :) In the v6ops session, there seemed to be strong consensus to take "IPv6 Network Architecture Protection" as a WG item for Informational. If you have issues with this, please raise them within a week, by 16th March. Thanks! (hat off) From owner-v6ops@ops.ietf.org Wed Mar 9 22:06:19 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA22557 for ; Wed, 9 Mar 2005 22:06:19 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9Dy1-0007UG-8b for v6ops-data@psg.com; Thu, 10 Mar 2005 03:04:05 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9Dy0-0007Tm-7x for v6ops@ops.ietf.org; Thu, 10 Mar 2005 03:04:04 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j2A342e23821; Thu, 10 Mar 2005 05:04:02 +0200 Date: Thu, 10 Mar 2005 05:04:02 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org cc: Elwyn Davies Subject: WG last call on NAT-PT to Experimental Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, (co-chair hat on) This is a working group last call on publishing "Reasons to Move NAT-PT to Experimental" (draft-ietf-v6ops-natpt-to-exprmntl-00.txt) as an Informational RFC. Please send any substantive comments on the list. The deadline for comments is in about two weeks, 24th March. Thanks! (hat off) From owner-v6ops@ops.ietf.org Thu Mar 10 06:31:28 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA03418 for ; Thu, 10 Mar 2005 06:31:28 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9Lqq-000Dya-Fx for v6ops-data@psg.com; Thu, 10 Mar 2005 11:29:12 +0000 Received: from [193.252.22.22] (helo=smtp9.wanadoo.fr) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9Lqm-000Dy9-UH for v6ops@ops.ietf.org; Thu, 10 Mar 2005 11:29:09 +0000 Received: from me-wanadoo.net (unknown [127.0.0.1]) by mwinf0908.wanadoo.fr (SMTP Server) with ESMTP id 057301C00147; Thu, 10 Mar 2005 12:29:08 +0100 (CET) Received: from Rmi (APuteaux-112-1-3-61.w80-15.abo.wanadoo.fr [80.15.192.61]) by mwinf0908.wanadoo.fr (SMTP Server) with ESMTP id 7B9F41C00150; Thu, 10 Mar 2005 12:29:07 +0100 (CET) X-ME-UUID: 20050310112907506.7B9F41C00150@mwinf0908.wanadoo.fr Message-ID: <007b01c52564$5edac4c0$fd2ffea9@Rmi> From: =?iso-8859-1?Q?R=E9mi_Despr=E9s?= To: "Pekka Savola" , "v6ops" Cc: "Elwyn Davies" References: Subject: Re: WG last call on NAT-PT to Experimental Date: Thu, 10 Mar 2005 12:29:02 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 8bit > This is a working group last call on publishing "Reasons to Move NAT-PT to > Experimental" (draft-ietf-v6ops-natpt-to-exprmntl-00.txt) as an > Informational RFC. > > Please send any substantive comments on the list. The deadline for > comments is in about two weeks, 24th March. 1. The technical content of this document [1] is thorough, well explained, AFIKT completely accurate, and IMHO invaluable. 2. Yet, the document incidentally suggests that no form of Translation from v6 to v4 will need being standardized for the v4-v6 coexistence period. I believe this should be avoided, and could easily be so . A. Why should the door remain open for some form of v6 to v4 translation? - During the coexistence period some v4-only hosts will remain, both in some v4-routing-only sites and in some mixed v4-v6-routing ones. - For some of these v4-only hosts, capability of being callable by some remote client(s) , e.g. in HTTP, will be neded, for real applications. (Stating that these hosts should all become dual-stack would not be user friendly as we wish to promote transition to v6 by means of coexistence!). - V6-capable clients, be they without global v4 addresses, should be able to reach such hosts as servers. (A 128-bit called address is enough to designate a server, wherever this one is in the v4-v6 Internet.) - Two approaches then remain : . Some form of DSTM where the calling client borrows a temporary global v4-address, and encapsulates v4 in v6 along an appropriate v6 path. Its main limitation is the complexity involved, in particular to manage pools of temporary global v4-addresses in specialized servers. Its main advantage is transparency to all v4 applications. . Some form of NAT (or NAPT), say "NAT-6to4", at the called host site entrance, converting the v6-adresse of calling clients to local v4-adresses. Its main limitation is that only NATv4 compatible applications are supported (but there are many, all HTTP based ones in particular). Its main advantage is simplicity (no concern with global v4-addresses, and well understood, and widely implemented, management of the life-times of NAT provided addresses). B. How could some form of v6 to v4 translationt still be envisaged in view of problems raised in [1]? - Problems raised in 1 concern ; (1) Incompatibilities with IP Fragmentation ; (2) ALGs complexity and shortcomings ; (3) Restrictions imposed on applications. - Fragmentation and ALGs are not needeed to satisfy the requirement of A. They can be explicitely excluded of the detailed specification of NAT-6to4. - Applicability of NAT-6to4 can be explicitely restricted to applications which don't exchange IP addresses at appliction layer. CONCLUSION: If there is some support for this analysis, I am ready to work with authors of [1] on minor short term amendments to their document, and also to work more generally with whoever is interested in progress on this subject. Regards, Rémi From owner-v6ops@ops.ietf.org Thu Mar 10 11:04:48 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA29040 for ; Thu, 10 Mar 2005 11:04:47 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9Q7r-000NVc-7Q for v6ops-data@psg.com; Thu, 10 Mar 2005 16:03:03 +0000 Received: from [161.114.64.105] (helo=zmamail05.zma.compaq.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9Q7n-000NV8-Gh for v6ops@ops.ietf.org; Thu, 10 Mar 2005 16:02:59 +0000 Received: from tayexg11.americas.cpqcorp.net (tayexg11.americas.cpqcorp.net [16.103.130.186]) by zmamail05.zma.compaq.com (Postfix) with ESMTP id D9A94BA31 for ; Thu, 10 Mar 2005 11:02:58 -0500 (EST) Received: from tayexc13.americas.cpqcorp.net ([16.103.130.26]) by tayexg11.americas.cpqcorp.net with Microsoft SMTPSVC(6.0.3790.211); Thu, 10 Mar 2005 11:02:58 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: Enterprise Analysis Discussion Pekka S. and Jim B. Date: Thu, 10 Mar 2005 11:03:02 -0500 Message-ID: <9C422444DE99BC46B3AD3C6EAFC9711B0895C1B3@tayexc13.americas.cpqcorp.net> Thread-Topic: Enterprise Analysis Discussion Pekka S. and Jim B. Thread-Index: AcUETzwYEOQ5N4oFS3KMXtvc1mkU9QdeN7cwAPB5EiA= From: "Bound, Jim" To: X-OriginalArrivalTime: 10 Mar 2005 16:02:58.0838 (UTC) FILETIME=[A1188360:01C5258A] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable Folks, offline discussion btw Pekka S. and I on Ent Analysis. Pekka S. felt might be useful to send to WG. /jim > I took a look mainly at the revised section 3. Below are my=20 > *personal* comments, to get the commenting started. It is not motivating the team to work on this with no comments. >=20 > I've mainly three kind of concerns/suggestions for improvement: > 1) terminology clarifications, so that we're talking about the same > thing > 2) the model how the enterprise should go about deciding which cases > to support, implying how we should present the cases > 3) input on the matrix and classification of different cases OK. >=20 > ..... >=20 > First, I'd like to note a few terminology/scope issues. >=20 > - What is the more precise definition of 'host X network'? =20 > Does that=20 > mean the IP capabilities supported by routers on the link(s)=20 > where the=20 > host plugs into, IP capabilities of the particular (geopgraphical)=20 > site ("whole network") or what? This has *major* impact on=20 > how to read=20 > the table, and how to think about the scenarios in general. I've=20 > assumed the latter. It implies the capability of the routing infrastructure. Dual IP means v6 and v4. >=20 > - The first paragraphs restricts this disucussion only to=20 > dealing with > communications between different parts of the same enterprise, e.g., > different branch offices at different countries etc. I think this > restriction may be useful (though it's difficult to say), but=20 > this is the > first time I've seen it. Yes we are trying to make this document focused so it is useful. Most enterprises only deal with its enterprise and then provide external access. External access requirements are out of scope of this document. We did not want to address teleworkers or mobility as that is pretty much after the Enterprise gets up and running.=20 >=20 > However, it is worth observing that I'd suspect a major goal for an > enterprise would be to also publish some services to the=20 > outside, or use > outside services. According to this scope, these would be=20 > out of scope? Yes we are only concerend about the enterprise proper in the document. >=20 > ..... >=20 > The document states that it focuses on L3 issues. That's OK=20 > as such, as > long as it's clear where those L3 decisions come from. That=20 > is, AFAICS, > typically the v6 deployers should ask two main questions: >=20 > 1) "which kinds of applications [v4-only, ds, v6-only] do we want to > provide [to whom -- v4-only, ds, v6-only?] or use ourselves?" >=20 > 2) "are there any constraints on which network topologies=20 > should or should > not be supported?" I do not think our spec or the IETF can even begin to guess what policy an Enterprise will select at all nor should we be stating policy in our spec is our view. >=20 > Based on that, you could take 1) as a basis, strike out or=20 > underline those > cases reflected by 2), and then go through and consider the=20 > rest of the > cases and every time ask the question, "is this something we want to > support; are there workarounds to avoid this scenario?" I think we may be able to do this but in different way I think we need some discussion here as its not clear totally from your words above. But I think a list of what the matrix supports may be the way to approach it without dictating policy to the Enterprise in our spec. >=20 > The classification I presented below is an attempt to make=20 > that decision > easier from the _application_ perspective.. OK will respond below. >=20 > ..... >=20 > I still have issues figuring out how to understand the matrix. For > example, 5 first cases are "IPv6/DualIP" app/host scenarios,=20 > with IPv4 or > dual IP in the middle. But my arithmetrics says there must be 2^3 =3D = 8 > different cases -- what's missing? dual-dual-dual > (network-provider-network), which is trivial; v4-v4-v4 which is > non-trivial; dual-v4-v4 (v4-v4-dual is there though) which is also > non-trivial. Don't use math that won't work per our rules of engagement. We covered the cases we thought important if we want to discuss missing cases then that is the way to proceed and discussion on each new case that is missing. >=20 > This makes me think that there must be some clearer=20 > methodology for dealing > with these cases. We think its pretty clear :--) >=20 > What I could think of was breaking up the section to=20 > different, higher-level > cases, in free-flowing text, which could then refer back to a=20 > part of a > matrix if needed. Your call for free flowing text in this sense is great. But I will tell you as editor we need the WG to engage and also more authors to write. Right now it is pretty much Dave, I, and Steve writing. >=20 > I also observe that there should be two cases which are=20 > likely relatively > similar, whether you look at this from the "server" or=20 > "client" perspective > (as above: dual-v4-v4 and v4-v4-dual may not be 100% the=20 > same, but it might > make sense to try to group these together and see where that goes) I view it again transparent to server or client. But maybe I am missing something. If you want a spec on war and peace for the Enterprise you may have the wrong team and should reassign this to another group of authors. We don't have the time or the need to do the extensive work you want. We are trying to provide a guideline which is what all the other scenarios did. I feel we are being singled out compared to the analysis done for Unmanaged, 3GPP, and ISPs. Not upset with you at all but I think your asking for to much and maybe that is not us. Also as a note this is all getting done already in the industry and the enterprise analysis is almost complete for IPv6 by many. I don't know if you talk to customers and such and maybe its your geography. Did you see the Japan IPv6 Promotional Council IPv6 deployment guide? It is unbelievable good work and was funded to hire team to do it. Nothing we are doing in v6ops even comes close. Many enterprises are using that for what we are doing here. > What I came up with were (with some thoughts on potential solutions in > [[]]'s: >=20 > 1) "IPv4-only legacy application communicating with newer=20 > IPv6-only app" > (this is currently excluded from analysis, on purpose..) This will not happen in reality for at least 2-3 years that is why we did not include it. By that time the work here will need to be completely updated. Thus we focused on what might remain useful for the next 18 months. >=20 > a) the v4-only app's host or network is dual-IP > [[ * translation at the host or "close" network? ]] >=20 > b) the v4-only app's network is v4-only > [[ * avoid this case if possible! > * the only choice would be translation at SP or=20 > "remote" network]] You lost me. Are you saying IPv6 something wants to talk to this app? >=20 > 2) "IPv4-only application is used through a non-IPv4 network" >=20 > a) host providing the application is dual-IP > - host's network is v6-only > - peer's network is v6-only > [[ * in both cases, tunnel to SP, peer nw, or peer host? ]] Do you mean v6 only used or v4 cannot be used? >=20 > b) host providing the application is v4-only > - host's network is v6-only > [[ * avoid this case if possible! > * otherwise, would have to do double translation=20 > at SP or peer network..]] > - host's network is dual-IP > [[ * straightforward tunneling, similar to 2.a) ]] I think we address the above for v6 dominant case. >=20 > 3) "Dual-stack applications on dual-stack hosts" >=20 > a) It just works (TM) when networks are any kind of mix=20 > of dual-IP and v4-only. > However are two pathological cases.. >=20 > b) "local network v6-only, SP v4-only, peer network v6-only" > [[ * straightforward tunneling. ]] There may be v6 dominant I doubt v6 only? I think you need to reread our terminology maybe? >=20 > c) "local network v6-only, SP v4-only or dual-IP, peer=20 > network v4-only" > [[ * similar to 2.a) ]] >=20 > 4) "IPv6-only application on Dual-IP hosts through=20 > v4/dual-IP networks" >=20 > a) networks support dual-IP, but the SP is v4-only > [[ * straightforward tunneling between the networks ]] >=20 > b) networks are v4-only, the SP is v4-only or dual-IP > [[ * tunneling between the hosts, or via the SP in=20 > the middle ]] >=20 > c) one network dual-IP, the other v4-only; the SP is=20 > either v4 or dual-IP > [[ * another case of host-to-network tunneling, like 2.a) ]] >=20 > d) both networks and the SP are dual-IP > [[ * trivial native v6 case ]] >=20 > 5) "IPv6-only application on Dual-IP hosts through v6-only=20 > networks" >=20 > a) "just works" if both networks are v6-only, SP is dual-IP > Otherwise.. >=20 > b) the same as 3.b) >=20 > c) the same as 3.c) >=20 > This is a slightly different way of presenting a (longer,=20 > more exhaustive) > matrix -- I'm sure there are probably better ways, but at=20 > least to me, this > is MUCH easier than looking at the matrix and trying to figure out the > differences between different options and what they mean in practice.. I hear what your saying but we need to come to alignment on terminology, scope, and focus of the work before we can dive down much further is my guess. >=20 > This doesn't mean the matrix couldn't be there, but that=20 > maybe it could be > something different cases from a classification like above=20 > could refer to > somehow. I see where your going. thanks /jim >=20 > --=20 > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings >=20 >=20 From owner-v6ops@ops.ietf.org Thu Mar 10 12:50:12 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA11191 for ; Thu, 10 Mar 2005 12:50:12 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9Rm9-000B7h-GA for v6ops-data@psg.com; Thu, 10 Mar 2005 17:48:45 +0000 Received: from [66.163.168.184] (helo=smtp805.mail.sc5.yahoo.com) by psg.com with smtp (Exim 4.44 (FreeBSD)) id 1D9Rm8-000B7V-Kd for v6ops@ops.ietf.org; Thu, 10 Mar 2005 17:48:44 +0000 Received: from unknown (HELO adithya) (mohanp@sbcglobal.net@64.172.59.136 with login) by smtp805.mail.sc5.yahoo.com with SMTP; 10 Mar 2005 17:48:29 -0000 Message-ID: <003801c52599$5e8ed490$6601a8c0@adithya> From: "Mohan Parthasarathy" To: "Pekka Savola" Cc: , "Eric Vyncke" References: <5.1.0.14.2.20050309174157.042609a0@127.0.0.1> <02de01c52509$f7cc1e50$6601a8c0@adithya> Subject: Re: Some comments on draft-tschofenig-v6ops-secure-tunnels Date: Thu, 10 Mar 2005 09:48:28 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit > On Wed, 9 Mar 2005, Mohan Parthasarathy wrote: > > Thanks for your comments. > > Likewise, thanks. Your review and support is appreciated. > > >> 2) section 2.2, IPsec will detect indirectly if the outer IPv4 addresses are wrong (spoofing among sites) because the > >> decapsulation will fail since the crypto keys (for ESP and for AH) > >> are based on > > > > SPI alone is sufficient looking up the SA for unicast traffic and > > this is how it is defined in the recent AH/ESP drafts. > > Hmm. Does this cause any issues if this is implemented either way? I > guess we'll need to support both.. > SPIs are generated by the receiver. The 2401bis-draft, AH and ESP drafts specify that SPI alone is sufficient for inbound demultiplexing for unicast SAs. But if the implementation does something different, it would not break anything. Perhaps, we can mention this. > >> 5) another use case scenario can be (and actually I've seen it > >> deployed): using this IPsec protected IPv6 tunnel as a back-up link > >> of a 'real native' IPv6 link in order to provide resiliency. This > >> of course requires routing protocols hence the use of the > >> 'transport mode' variant. > > > > I don't know whether it is relevant to the current document or not. > > I will let Pekka answer this. > > (This is my opinion only, of course. :) > > As far as I understand, the above is only an issue if the tunnel mode > SA is not modelled as an interface (based on the touch-vpn, now > RFC3884, right? If it's an interface, it could be used to run a > routing protocol (as long as it's not IS-IS :-) just fine? > > I think we are already assuming that it's an interface, and this > should not be an issue? > I am not sure about this part. I have to read it again to see whether we say this explicitly or not. > In any case, section 5.1 already describes transport mode > router-to-router tunneling, which may or may not use lose ingress > filtering capability depending on whether the transport mode is > modelled as an interface or not. > This is modeled as an interface because it is normally an IP-IP tunnel + IPsec. > So, I guess we already have all the technical bases covered (unless > I'm missing something?), and the issue is just whether this usage > scenario is should be explicitly mentioned in the draft. I'd say not, > because this seems to be a much more specific example case than the > ones we currently have in the draft, and listing a specific one might > be misleading. > Agreed. -mohan > -- > Pekka Savola "You each name yourselves king, yet the > Netcore Oy kingdom bleeds." > Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings > From owner-v6ops@ops.ietf.org Fri Mar 11 09:29:47 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id JAA25935 for ; Fri, 11 Mar 2005 09:29:47 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1D9l6L-00094e-IL for v6ops-data@psg.com; Fri, 11 Mar 2005 14:26:53 +0000 Received: from [171.68.10.86] (helo=sj-iport-4.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9l6K-00094S-GH for v6ops@ops.ietf.org; Fri, 11 Mar 2005 14:26:52 +0000 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-4.cisco.com with ESMTP; 11 Mar 2005 06:26:53 -0800 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j2BEQhq8004610; Fri, 11 Mar 2005 06:26:43 -0800 (PST) Received: from [10.84.118.64] (sjc-vpn5-297.cisco.com [10.21.89.41]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with ESMTP id BCS82862; Fri, 11 Mar 2005 06:26:47 -0800 (PST) In-Reply-To: <007b01c52564$5edac4c0$fd2ffea9@Rmi> References: <007b01c52564$5edac4c0$fd2ffea9@Rmi> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=ISO-8859-1; format=flowed Message-Id: <0956298368c902f9da526ee363c1af49@cisco.com> Content-Transfer-Encoding: quoted-printable Cc: "Pekka Savola" , "Elwyn Davies" , "v6ops" From: Baker Fred Subject: Re: WG last call on NAT-PT to Experimental Date: Fri, 11 Mar 2005 08:26:46 -0600 To: =?ISO-8859-1?Q?R=E9mi_Despr=E9s?= X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable Speaking for my politically-incorrect self, I agree that translation is=20= a reality whether anyone likes it or not. I don't think too much in terms of "during the transition period", as=20 that period is likely to last for the remainder of my lifetime, with=20 many networks putting IPv6 off until there is strong economic incentive=20= to change, and some percentage of networks being IPv6-dominant (using=20 Jim Bound's term) pretty early and some being IPv6-only in the=20 not-too-distant-future. To me it is simply this: from any given place=20 (which is a question of network connectivity and interconnectivity) and=20= at any given time, folks are reachable by IPv4, IPv6, or both. To the=20 extent that there exist folks who are reachable only via IPv4 and folks=20= reachable only via IPv6, communication will be limited if there is not=20= ability to translate. Companies are *very* likely to find translation=20 at their DMZ a practical alternative to wide IPv6 deployment within=20 themselves while the number of companies that one is forced to use that=20= to get to is nominal. That said, as this draft says, tunnel encapsulation is a more=20 end2end-freindly approach where it is applicable, and dual stack=20 implementation is obviously to be preferred for any currently-IPv4=20 network. On Mar 10, 2005, at 5:29 AM, R=E9mi Despr=E9s wrote: >> This is a working group last call on publishing "Reasons to Move=20 >> NAT-PT to >> Experimental" (draft-ietf-v6ops-natpt-to-exprmntl-00.txt) as an >> Informational RFC. >> >> Please send any substantive comments on the list. The deadline for >> comments is in about two weeks, 24th March. > > 1. The technical content of this document [1] is thorough, well=20 > explained, > AFIKT completely accurate, and IMHO invaluable. > > 2. Yet, the document incidentally suggests that no form of =20 > Translation > from v6 to v4 will need being standardized for the v4-v6 coexistence > period. > > I believe this should be avoided, and could easily be so . > > > A. Why should the door remain open for some form of v6 to v4 > translation? > > - During the coexistence period some v4-only hosts will=20 > remain, > both in some v4-routing-only sites and in some mixed v4-v6-routing=20 > ones. > - For some of these v4-only hosts, capability of being=20 > callable by > some remote client(s) , e.g. in HTTP, will be neded, for real=20 > applications. > (Stating that these hosts should all become dual-stack would not be=20 > user > friendly as we wish to promote transition to v6 by means of=20 > coexistence!). > - V6-capable clients, be they without global v4 addresses,=20 > should > be able to reach such hosts as servers. (A 128-bit called address is=20= > enough > to designate a server, wherever this one is in the v4-v6 Internet.) > - Two approaches then remain : > . Some form of DSTM where the calling client borrows a > temporary global v4-address, and encapsulates v4 in v6 along an=20 > appropriate > v6 path. > Its main limitation is the complexity involved, = in > particular to manage pools of temporary global v4-addresses in=20 > specialized > servers. > Its main advantage is transparency to all v4 > applications. > . Some form of NAT (or NAPT), say "NAT-6to4", at the=20 > called > host site entrance, converting the v6-adresse of calling clients to=20 > local > v4-adresses. > Its main limitation is that only NATv4 compatible > applications are supported (but there are many, all HTTP based ones > in particular). > Its main advantage is simplicity (no concern with > global v4-addresses, and well understood, and widely implemented, > management of the life-times of NAT provided addresses). > > > B. How could some form of v6 to v4 translationt still be envisaged = in > view of problems raised in [1]? > - Problems raised in 1 concern ; (1) Incompatibilities with=20= > IP > Fragmentation ; (2) ALGs complexity and shortcomings ; (3) =20 > Restrictions > imposed on applications. > - Fragmentation and ALGs are not needeed to satisfy the > requirement of A. They can be explicitely excluded of the detailed > specification of NAT-6to4. > - Applicability of NAT-6to4 can be explicitely restricted to > applications which don't exchange IP addresses at appliction layer. > > > CONCLUSION: > > If there is some support for this analysis, I am ready to work with=20 > authors > of [1] on minor short term amendments to their document, and also to=20= > work > more generally with whoever is interested in progress on this subject. > > Regards, > > > R=E9mi > From owner-v6ops@ops.ietf.org Sat Mar 12 08:06:51 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA04355 for ; Sat, 12 Mar 2005 08:06:50 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DA6HO-000Op8-OV for v6ops-data@psg.com; Sat, 12 Mar 2005 13:03:42 +0000 Received: from [128.9.160.161] (helo=boreas.isi.edu) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9pb9-000GHJ-Do for v6ops@ops.ietf.org; Fri, 11 Mar 2005 19:14:59 +0000 Received: from ISI.EDU (adma.isi.edu [128.9.160.239]) by boreas.isi.edu (8.11.6p2+0917/8.11.2) with ESMTP id j2BJDg616823; Fri, 11 Mar 2005 11:13:42 -0800 (PST) Message-Id: <200503111913.j2BJDg616823@boreas.isi.edu> To: ietf-announce@ietf.org Subject: RFC 4038 on Application Aspects of IPv6 Transition Cc: rfc-editor@rfc-editor.org, v6ops@ops.ietf.org From: rfc-editor@rfc-editor.org Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary=NextPart Date: Fri, 11 Mar 2005 11:13:42 -0800 X-ISI-4-39-6-MailScanner: Found to be clean X-MailScanner-From: rfc-ed@isi.edu X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-17.6 required=5.0 tests=BAYES_00, MIME_BOUND_NEXTPART,NO_REAL_NAME,USER_IN_DEF_WHITELIST autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --NextPart A new Request for Comments is now available in online RFC libraries. RFC 4038 Title: Application Aspects of IPv6 Transition Author(s): M-K. Shin, Ed., Y-G. Hong, J. Hagino, P. Savola, E. M. Castro Status: Informational Date: March 2005 Mailbox: mshin@nist.gov, yghong@pec.etri.re.kr, itojun@iijlab.net, psavola@funet.fi, eva@gsyc.escet.urjc.es Pages: 33 Characters: 69727 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-v6ops-application-transition-03.txt URL: ftp://ftp.rfc-editor.org/in-notes/rfc4038.txt As IPv6 networks are deployed and the network transition is discussed, one should also consider how to enable IPv6 support in applications running on IPv6 hosts, and the best strategy to develop IP protocol support in applications. This document specifies scenarios and aspects of application transition. It also proposes guidelines on how to develop IP version-independent applications during the transition period. This document is a product of the IPv6 Operations Working Group of the IETF. This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST@IETF.ORG. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST@RFC-EDITOR.ORG. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info@RFC-EDITOR.ORG with the message body help: ways_to_get_rfcs. For example: To: rfc-info@RFC-EDITOR.ORG Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to RFC-Manager@RFC-EDITOR.ORG. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR@RFC-EDITOR.ORG. Please consult RFC 2223, Instructions to RFC Authors, for further information. Joyce K. Reynolds and Sandy Ginoza USC/Information Sciences Institute ... Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the ASCII version of the RFCs. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="RFC-INFO@RFC-EDITOR.ORG" Content-Type: text/plain Content-ID: <050311111227.RFC@RFC-EDITOR.ORG> RETRIEVE: rfc DOC-ID: rfc4038 --OtherAccess Content-Type: Message/External-body; name="rfc4038.txt"; site="ftp.isi.edu"; access-type="anon-ftp"; directory="in-notes" Content-Type: text/plain Content-ID: <050311111227.RFC@RFC-EDITOR.ORG> --OtherAccess-- --NextPart-- From owner-v6ops@ops.ietf.org Sat Mar 12 08:12:18 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id IAA04584 for ; Sat, 12 Mar 2005 08:12:18 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DA6PB-000Pjt-Jr for v6ops-data@psg.com; Sat, 12 Mar 2005 13:11:45 +0000 Received: from [193.252.22.29] (helo=smtp2.wanadoo.fr) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1D9omk-0009yA-Ad for v6ops@ops.ietf.org; Fri, 11 Mar 2005 18:22:54 +0000 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf0201.wanadoo.fr (SMTP Server) with ESMTP id 5E2D01C0045E; Fri, 11 Mar 2005 19:22:53 +0100 (CET) Received: from Rmi (APuteaux-104-1-2-122.w217-128.abo.wanadoo.fr [217.128.215.122]) by mwinf0201.wanadoo.fr (SMTP Server) with SMTP id 0278B1C0044C; Fri, 11 Mar 2005 19:22:52 +0100 (CET) X-ME-UUID: 20050311182253102.0278B1C0044C@mwinf0201.wanadoo.fr Message-ID: <005101c52667$565d9df0$fd2ffea9@Rmi> From: Despres@psg.com, Remi To: "Baker Fred" Cc: "v6ops" References: <007b01c52564$5edac4c0$fd2ffea9@Rmi> <0956298368c902f9da526ee363c1af49@cisco.com> Subject: Re: WG last call on NAT-PT to Experimental Date: Fri, 11 Mar 2005 19:22:50 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 8bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 8bit Thanks for the comments. Further remarks below. Remi > To the reachable only via IPv6, communication will be limited if there is > not ability to translate. Companies are *very* likely to find translation > at their DMZ a practical alternative to wide IPv6 deployment within > themselves while the number of companies that one is forced to use that to > get to is nominal. ALG translations in DMZs are significantly more complex than just some NAPT-6to4 at the entrance of v6&4 sites where there are v4-only servers that have to be reached from outside. >That said, as this draft says, tunnel encapsulation is a more >end2end-freindly approach where it is applicable, Agreed, but as you say "when it is applicable" E2E encapsulation is not relevant to reachability of v4-only host. >and dual stack >implementation is obviously to be preferred for any currently-IPv4 network. Agreed also. But the subjet is making reachable some "servers" which, for some legitimate reason(s), are not updated to dual satck (e.g. some egacy small devices like sensors, or other automata, which today operate within v4 private sites). From owner-v6ops@ops.ietf.org Sun Mar 13 13:59:29 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id NAA02121 for ; Sun, 13 Mar 2005 13:59:28 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DAYGE-0003MS-UG for v6ops-data@psg.com; Sun, 13 Mar 2005 18:56:22 +0000 Received: from [161.114.64.103] (helo=zmamail03.zma.compaq.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DAYGA-0003LG-DW for v6ops@ops.ietf.org; Sun, 13 Mar 2005 18:56:18 +0000 Received: from tayexg12.americas.cpqcorp.net (tayexg12.americas.cpqcorp.net [16.103.130.127]) by zmamail03.zma.compaq.com (Postfix) with ESMTP id BF48AA645; Sun, 13 Mar 2005 13:56:17 -0500 (EST) Received: from tayexc13.americas.cpqcorp.net ([16.103.130.26]) by tayexg12.americas.cpqcorp.net with Microsoft SMTPSVC(6.0.3790.211); Sun, 13 Mar 2005 13:56:17 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: WG last call on NAT-PT to Experimental Date: Sun, 13 Mar 2005 13:56:26 -0500 Message-ID: <9C422444DE99BC46B3AD3C6EAFC9711B0895C762@tayexc13.americas.cpqcorp.net> Thread-Topic: WG last call on NAT-PT to Experimental Thread-Index: AcUmRtqPthEAFXQfQP2pNhTZaxkAPgBtkgsw From: "Bound, Jim" To: "Baker Fred" , =?iso-8859-1?Q?R=E9mi_Despr=E9s?= Cc: "Pekka Savola" , "Elwyn Davies" , "v6ops" X-OriginalArrivalTime: 13 Mar 2005 18:56:17.0717 (UTC) FILETIME=[568CC650:01C527FE] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable Fully agree with Fred with one caveat. IPv6 dominant does not mean IPv4 = does not exist but that IPv6 has been on purpose chosen to be used and = IPv4 is there on all nodes but not being used on a specific network. = IPv6 only and IPv6 dominant need differentiation. from us as a = community. Thus the question is the edge dual IP? If it is maybe = tunnels can be used at the edges which DSTM suggests as one operational = suggestion. But if the pool of available v4 addresses is depleted by a = site that must communicate with IPv4 network/apps/nodes/et al then no = other choice exists that I can see? The other case is when there are = really IPv6 only stack devices with no IPv4 available at all on the node = that has to access legacy IPv4 services and in that case no choice = again. Also I am pointing people in industry to the NAP draft which I = think is par excellent discussion of getting what you need from a NAT = networking philosophy in many cases with IPv6. NAP above =3D=3D draft-vandevelde-v6ops-nap-01.txt just in case.... /jim=20 > -----Original Message----- > From: owner-v6ops@ops.ietf.org=20 > [mailto:owner-v6ops@ops.ietf.org] On Behalf Of Baker Fred > Sent: Friday, March 11, 2005 9:27 AM > To: R=E9mi Despr=E9s > Cc: Pekka Savola; Elwyn Davies; v6ops > Subject: Re: WG last call on NAT-PT to Experimental >=20 > Speaking for my politically-incorrect self, I agree that=20 > translation is=20 > a reality whether anyone likes it or not. >=20 > I don't think too much in terms of "during the transition period", as=20 > that period is likely to last for the remainder of my lifetime, with=20 > many networks putting IPv6 off until there is strong economic=20 > incentive=20 > to change, and some percentage of networks being IPv6-dominant (using=20 > Jim Bound's term) pretty early and some being IPv6-only in the=20 > not-too-distant-future. To me it is simply this: from any given place=20 > (which is a question of network connectivity and=20 > interconnectivity) and=20 > at any given time, folks are reachable by IPv4, IPv6, or both. To the=20 > extent that there exist folks who are reachable only via IPv4=20 > and folks=20 > reachable only via IPv6, communication will be limited if=20 > there is not=20 > ability to translate. Companies are *very* likely to find translation=20 > at their DMZ a practical alternative to wide IPv6 deployment within=20 > themselves while the number of companies that one is forced=20 > to use that=20 > to get to is nominal. >=20 > That said, as this draft says, tunnel encapsulation is a more=20 > end2end-freindly approach where it is applicable, and dual stack=20 > implementation is obviously to be preferred for any currently-IPv4=20 > network. >=20 >=20 > On Mar 10, 2005, at 5:29 AM, R=E9mi Despr=E9s wrote: >=20 > >> This is a working group last call on publishing "Reasons to Move=20 > >> NAT-PT to > >> Experimental" (draft-ietf-v6ops-natpt-to-exprmntl-00.txt) as an > >> Informational RFC. > >> > >> Please send any substantive comments on the list. The deadline for > >> comments is in about two weeks, 24th March. > > > > 1. The technical content of this document [1] is thorough, well=20 > > explained, > > AFIKT completely accurate, and IMHO invaluable. > > > > 2. Yet, the document incidentally suggests that no form of =20 > > Translation > > from v6 to v4 will need being standardized for the v4-v6 coexistence > > period. > > > > I believe this should be avoided, and could easily be so . > > > > > > A. Why should the door remain open for some form of v6 to v4 > > translation? > > > > - During the coexistence period some v4-only hosts will=20 > > remain, > > both in some v4-routing-only sites and in some mixed v4-v6-routing=20 > > ones. > > - For some of these v4-only hosts, capability of being=20 > > callable by > > some remote client(s) , e.g. in HTTP, will be neded, for real=20 > > applications. > > (Stating that these hosts should all become dual-stack would not be=20 > > user > > friendly as we wish to promote transition to v6 by means of=20 > > coexistence!). > > - V6-capable clients, be they without global v4 addresses,=20 > > should > > be able to reach such hosts as servers. (A 128-bit called=20 > address is=20 > > enough > > to designate a server, wherever this one is in the v4-v6 Internet.) > > - Two approaches then remain : > > . Some form of DSTM where the calling client=20 > borrows a > > temporary global v4-address, and encapsulates v4 in v6 along an=20 > > appropriate > > v6 path. > > Its main limitation is the complexity=20 > involved, in > > particular to manage pools of temporary global v4-addresses in=20 > > specialized > > servers. > > Its main advantage is transparency to all v4 > > applications. > > . Some form of NAT (or NAPT), say "NAT-6to4", at the=20 > > called > > host site entrance, converting the v6-adresse of calling clients to=20 > > local > > v4-adresses. > > Its main limitation is that only NATv4=20 > compatible > > applications are supported (but there are many, all HTTP based ones > > in particular). > > Its main advantage is simplicity (no=20 > concern with > > global v4-addresses, and well understood, and widely implemented, > > management of the life-times of NAT provided addresses). > > > > > > B. How could some form of v6 to v4 translationt still be=20 > envisaged in > > view of problems raised in [1]? > > - Problems raised in 1 concern ; (1)=20 > Incompatibilities with=20 > > IP > > Fragmentation ; (2) ALGs complexity and shortcomings ; (3) =20 > > Restrictions > > imposed on applications. > > - Fragmentation and ALGs are not needeed to satisfy the > > requirement of A. They can be explicitely excluded of the detailed > > specification of NAT-6to4. > > - Applicability of NAT-6to4 can be explicitely=20 > restricted to > > applications which don't exchange IP addresses at appliction layer. > > > > > > CONCLUSION: > > > > If there is some support for this analysis, I am ready to work with=20 > > authors > > of [1] on minor short term amendments to their document,=20 > and also to=20 > > work > > more generally with whoever is interested in progress on=20 > this subject. > > > > Regards, > > > > > > R=E9mi > > >=20 >=20 From owner-v6ops@ops.ietf.org Sun Mar 13 17:15:22 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA15352 for ; Sun, 13 Mar 2005 17:15:22 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DAbKs-0001mk-4i for v6ops-data@psg.com; Sun, 13 Mar 2005 22:13:22 +0000 Received: from [171.71.176.72] (helo=sj-iport-3.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DAbKr-0001mX-Am for v6ops@ops.ietf.org; Sun, 13 Mar 2005 22:13:21 +0000 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-3.cisco.com with ESMTP; 13 Mar 2005 15:31:26 +0000 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.90,160,1107734400"; d="scan'208"; a="234613304:sNHT20781236" Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j2DMDDq8022909; Sun, 13 Mar 2005 14:13:13 -0800 (PST) Received: from [10.0.0.40] (sjc-vpn5-841.cisco.com [10.21.91.73]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with ESMTP id BCU70618; Sun, 13 Mar 2005 14:13:15 -0800 (PST) In-Reply-To: <9C422444DE99BC46B3AD3C6EAFC9711B0895C762@tayexc13.americas.cpqcorp.net> References: <9C422444DE99BC46B3AD3C6EAFC9711B0895C762@tayexc13.americas.cpqcorp.net> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: "Elwyn Davies" , =?ISO-8859-1?Q?R=E9mi_Despr=E9s?= , "Pekka Savola" , "v6ops" From: Baker Fred Subject: Re: WG last call on NAT-PT to Experimental Date: Sun, 13 Mar 2005 17:13:13 -0500 To: "Bound, Jim" X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit On Mar 13, 2005, at 1:56 PM, Bound, Jim wrote: > IPv6 dominant does not mean IPv4 does not exist but that IPv6 has been > on purpose chosen to be used and IPv4 is there on all nodes but not > being used on a specific network. IPv6 only and IPv6 dominant need > differentiation from us as a community. Thus the question is the edge > dual IP? Of course. The principal use of IPv4 in an otherwise IPv6 network is generally supporting applications that have not made the transition yet, I suspect. I know of some networks (CNGI for example) that are proposing to use a combination of IPv4 and IPv6 within the backbone for various purposes, but only offer an IPv6 edge. You allude to a period in which companies have parts of their infrastructure addressed using IPv4 and parts not. While that is a possible scenario, I doubt its importance - that will be solved using IPv4 NAT. From owner-v6ops@ops.ietf.org Mon Mar 14 05:57:21 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA13790 for ; Mon, 14 Mar 2005 05:57:21 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DAnDO-000LGo-KA for v6ops-data@psg.com; Mon, 14 Mar 2005 10:54:26 +0000 Received: from [193.252.22.23] (helo=smtp8.wanadoo.fr) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DAnDL-000LGI-QK for v6ops@ops.ietf.org; Mon, 14 Mar 2005 10:54:24 +0000 Received: from me-wanadoo.net (localhost [127.0.0.1]) by mwinf0803.wanadoo.fr (SMTP Server) with ESMTP id EB7A61C001A0; Mon, 14 Mar 2005 11:54:21 +0100 (CET) Received: from Rmi (AAmiens-101-1-1-133.w80-15.abo.wanadoo.fr [80.15.181.133]) by mwinf0803.wanadoo.fr (SMTP Server) with ESMTP id 6BF351C00190; Mon, 14 Mar 2005 11:54:20 +0100 (CET) X-ME-UUID: 20050314105420442.6BF351C00190@mwinf0803.wanadoo.fr Message-ID: <005101c52884$2c713d20$fd2ffea9@Rmi> From: =?iso-8859-1?Q?R=E9mi_Despr=E9s?= To: "Baker Fred" Cc: "v6ops" , "Bound, Jim" , "Cedric Aoun" , "Elwyn B Davies" References: <9C422444DE99BC46B3AD3C6EAFC9711B0895C762@tayexc13.americas.cpqcorp.net> Subject: Re: WG last call on NAT-PT to Experimental Date: Mon, 14 Mar 2005 11:54:11 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit >You allude to a period in which > companies have parts of their infrastructure addressed using IPv4 and > parts not. While that is a possible scenario, I doubt its importance - > that will be solved using IPv4 NAT. Le me describe differently important applications which, in my understanding, justify that "some v6-to-v4 translation schemes" be still proposed by the IETF fort he v4-v6 coexistence period. - IPv6, it's a revolution, brings us back in the simple world where any device, anywhere, can have an IP address, advertise it in the DNS, and can have packets routed efficiently to it. - Some v4 devices, like small cameras or various sensors, if installed in private sites are today restricted to be called only from within these private sites. (If there is only one such device in a user site, or if all port of the application are known and can be individually translated, this restriction can be avoided using some v4NATs with their Port Forwarding option, but this, although being useful in a number of practical cases, is too limited and complex to be the kind of clean and general solution people would like to use on a large sccale. - If such a v4 device is in a site where both v4 and v6 routings are available, a v6 address could advatageously be given to it. Its content would logically include: the device site v6-prefix (for efficient routing toward the site); the device intra-site v4-address (for device identification, and for efficient routing within the site); some indication that the device is v4 only (for the site-entrance-node to decide whether to perform v6-v4 translationor not). - With such an address, and implementing at site entrance a stateful v6-to-v4 translation, the considered v4-only device becomes reachable from anywhere, subject only to v6 connectivity being available at calling hosts. (If needed, firewall protections at site entrance may apply to these connections as they do to end-to-end v6 connections). - Such stateful v6-to-v4 translation can remain much simpler than the general NAT-PT model (and has to, in view of http://www.ietf.org/internet-drafts/draft-ietf-v6ops-natpt-to-exprmntl-00.txt ) . No support of fragmentation is needed. (IPv6 already assumes that all usable paths support MTUs of 1280 + enough octets for any realistic number of encapsulatng headers.) . No support of Application-Level-Gateways is needed, not even for DNS. (The calling hosts get v6 addresses from the v6-DNS, and these addresses contain all the v4 information needed at the v4-device site entrance. . No support of applications which exchange IP addresses as data is needed (the solution is useful enough if not extended to applications which today cannot be reached via v4-NATs at global v4-addresses. (An earlier look at the the subject is available in sec. 4.3 of http://perso.wanadoo.fr/remi.despres/4to6.htm, but please note that the address format proposed in the document, having unneeded drawbacks pointed out during private discussions, should be considered as obsolete.) The PROPOSAL then is that, after NAT-PT has been deprecated to experimental, some work on v6-to-v4 translation MAYcontinue. The goal is that applications involving of a number of legacy devices can take advantage of IPv6 being deployed inCustomer-Edge devices and in the DNS. RD From owner-v6ops@ops.ietf.org Mon Mar 14 06:20:37 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA15769 for ; Mon, 14 Mar 2005 06:20:36 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DAncG-000NwZ-Lj for v6ops-data@psg.com; Mon, 14 Mar 2005 11:20:08 +0000 Received: from [171.71.176.70] (helo=sj-iport-1.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DAncF-000NwK-O3 for v6ops@ops.ietf.org; Mon, 14 Mar 2005 11:20:07 +0000 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 14 Mar 2005 03:36:22 -0800 X-BrightmailFiltered: true X-Brightmail-Tracker: AAAAAA== X-IronPort-AV: i="3.90,160,1107763200"; d="scan'208"; a="619197403:sNHT21733648" Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j2EBK2uC002312; Mon, 14 Mar 2005 03:20:02 -0800 (PST) Received: from [10.0.0.40] (sjc-vpn1-854.cisco.com [10.21.99.86]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with ESMTP id BCV09095; Mon, 14 Mar 2005 03:20:03 -0800 (PST) In-Reply-To: <005101c52884$2c713d20$fd2ffea9@Rmi> References: <9C422444DE99BC46B3AD3C6EAFC9711B0895C762@tayexc13.americas.cpqcorp.net> <005101c52884$2c713d20$fd2ffea9@Rmi> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=ISO-8859-1; format=flowed Message-Id: <2d7ec483fdd1b687dc19b6e2d51ab198@cisco.com> Content-Transfer-Encoding: quoted-printable Cc: "Elwyn B Davies" , "Cedric Aoun" , "Bound, Jim" , "v6ops" From: Baker Fred Subject: Re: WG last call on NAT-PT to Experimental Date: Mon, 14 Mar 2005 06:20:02 -0500 To: =?ISO-8859-1?Q?R=E9mi_Despr=E9s?= X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable On Mar 14, 2005, at 5:54 AM, R=E9mi Despr=E9s wrote: > The PROPOSAL then is that, after NAT-PT has been deprecated to > experimental, some work on v6-to-v4 translation MAYcontinue. My question is "what is hard about that". Any translator has all the issues of NAT, and is *not* going to try to=20= insert units of 12 bytes into application data, or making IPSEC work.=20 Therefore, this doesn't begin to work for any application that has a=20 hard time traversing a v4-v4 NAT. Having limited ourselves to those applications for which it works=20 without changing application data, there are four requirements: - that DNS be made to work (the far device is only advertising an A or=20= MX record; we need to set up relevant state and advertise a AAAA record=20= referencing the translator) - that the assigned IPv6 address correlate with the IPv4 address+port=20= in question (let me think hard, I'll bet the IPv4 address+port get=20 embedded in the IPv6 address) - that the router not be required to re-assemble datagrams (use Path=20= MTU, MSS modification, etc to effect this) - TCP/UDP/SCTP works (adjust the transport checksum appropriately) I'm not opposed to necessary work being done, but I'm not so sure what=20= work needs to *be* done. We seem to have a lot of transition efforts=20 around, but there must be a way to bring them together into a single=20 simple solution. Bring us that one simple path, and then we'll talk.= From owner-v6ops@ops.ietf.org Mon Mar 14 10:46:16 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA14545 for ; Mon, 14 Mar 2005 10:46:15 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DArjT-000665-Vz for v6ops-data@psg.com; Mon, 14 Mar 2005 15:43:51 +0000 Received: from [193.252.22.30] (helo=smtp1.wanadoo.fr) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DArjP-00064q-4y for v6ops@ops.ietf.org; Mon, 14 Mar 2005 15:43:47 +0000 Received: from me-wanadoo.net (funkytiger.co.uk [127.0.0.1]) by mwinf0108.wanadoo.fr (SMTP Server) with ESMTP id 2F0F11C00D12 for ; Mon, 14 Mar 2005 16:43:46 +0100 (CET) Received: from Rmi (AAmiens-101-1-1-133.w80-15.abo.wanadoo.fr [80.15.181.133]) by mwinf0108.wanadoo.fr (SMTP Server) with ESMTP id A60511C00CE9; Mon, 14 Mar 2005 16:43:45 +0100 (CET) X-ME-UUID: 20050314154345680.A60511C00CE9@mwinf0108.wanadoo.fr Message-ID: <002801c528ac$9aa9c370$fd2ffea9@Rmi> From: =?iso-8859-1?Q?R=E9mi_Despr=E9s?= To: "Baker Fred" Cc: "v6ops" References: <9C422444DE99BC46B3AD3C6EAFC9711B0895C762@tayexc13.americas.cpqcorp.net> <005101c52884$2c713d20$fd2ffea9@Rmi> <2d7ec483fdd1b687dc19b6e2d51ab198@cisco.com> Subject: Re: WG last call on NAT-PT to Experimental Date: Mon, 14 Mar 2005 16:43:37 +0100 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Thanks for your remarks. My impression is that you are thinking of a different case. The v6-to-v4 translation I am after concerns: - called v4 devices which have AAAA record in the DNS in order to be reachable from outside their site. ( If such a device has also to be reached by hosts in the same sites, a local DNS may also contain an A record giving its local v4- address. But this is not the subject at hand.) - called sites the entrance node of which are dual-stack - calling hosts which have v6 connectivity (and access to AAAA records). (The translation therefore works in the reverse direction from that of a NAT-PT used for v6 hosts to reach v4 hosts at global v4-addresses.) Other point-by-point comments follow. >Having limited ourselves to those applications for which it works without >changing application data, there are four requirements: > >- that DNS be made to work (the far device is only advertising an A or MX >record; we need to set up relevant state and advertise a AAAA record >referencing the translator) * No DNS record translation is needed here because the calling host is assumed to have v6 connectivity, and access to v6 DNS, and because the called host has a v6 address in the DNS. > - that the assigned IPv6 address correlate with the IPv4 address+port in > question (let me think hard, I'll bet the IPv4 address+port get embedded > in the IPv6 address) * The port which may be modified by the translator is that of the calling host. It has no relationship with this host's address, which is any v6 address. The port of the called device is that of the application. It is not subject to any translation, and has therefore no reason to appear in any address. > - that the router not be required to re-assemble datagrams (use Path MTU, > MSS modification, etc to effect this) * On the v6 side, the v6-to-v4 translator could simply reject any v6 packet longer than 1280. On the v4 side, it could simply reject any v4 packet which contains a fragment of an incomplete datagram. > - TCP/UDP/SCTP works (adjust the transport checksum appropriately) * Yes. Due to pseudo-header inclusion in UDP and TCP checksums, the translator has to adjust these checksums (like NAT-PT has to). On the other hand, SCTP, which has in my understanding checksum adjustment problems also with IPv4 NATs, should remain out of the scope of the proposed mechanism. (Incidentally, we can assume that there should be a negligible number of v4 devices which are both SCTP capable and not easily dual-stack upgradeable.) > I'm not opposed to necessary work being done, but I'm not so sure what > work needs to *be* done. We seem to have a lot of transition efforts > around, but there must be a way to bring them together into a single > simple solution. Bring us that one simple path, and then we'll talk. * In my understanding, the proposal I bring forward is orthogonal with other questions being worked on (in particular with tunnel configurations of v6tc), and does satisfy a real need. Its main new implication is an address format variant, which contains a specific indication if the addressed node has to be reached in IPv4. Besides that, unless I am mistaken, complete specification of the translator should not be difficult, starting from the work already made for NAT-PT and from the comments above. *Last but not least, and to keep maintaining everything on the table, an Intellectual Property implication is part of the picture. This was made known as early as in November 2004, when http://ops.ietf.org/lists/v6ops/v6ops.2004/msg01660.htmlt pointed to an early and first document. Its introduction was clear on IP rights (and its section 4.3 is still somewhat relevant). I obviously hope that this should not be blocking. If, as I do expect, the practical value of the approach is eventually appreciated, my plan is not more than getting a fair and reasonable return for the significant work I did. (This work was a personal investment, without any compensation from anywhere). The goal is besides that to make the benefits of that work available to the community of whoever may take advantage of it. RD From owner-v6ops@ops.ietf.org Mon Mar 14 11:00:47 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA17041 for ; Mon, 14 Mar 2005 11:00:46 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DArym-0007nB-J3 for v6ops-data@psg.com; Mon, 14 Mar 2005 15:59:40 +0000 Received: from [161.114.64.104] (helo=zmamail04.zma.compaq.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DAryZ-0007kJ-2u for v6ops@ops.ietf.org; Mon, 14 Mar 2005 15:59:27 +0000 Received: from tayexg12.americas.cpqcorp.net (tayexg12.americas.cpqcorp.net [16.103.130.127]) by zmamail04.zma.compaq.com (Postfix) with ESMTP id 6EA4D5C3F; Mon, 14 Mar 2005 10:59:26 -0500 (EST) Received: from tayexc13.americas.cpqcorp.net ([16.103.130.26]) by tayexg12.americas.cpqcorp.net with Microsoft SMTPSVC(6.0.3790.211); Mon, 14 Mar 2005 10:59:26 -0500 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Subject: RE: WG last call on NAT-PT to Experimental Date: Mon, 14 Mar 2005 10:59:24 -0500 Message-ID: <9C422444DE99BC46B3AD3C6EAFC9711B0895C8A3@tayexc13.americas.cpqcorp.net> Thread-Topic: WG last call on NAT-PT to Experimental Thread-Index: AcUoGeQDnoKlFKw+TjWqIP8mmyGV2wAlN+SA From: "Bound, Jim" To: "Baker Fred" Cc: "Elwyn Davies" , =?iso-8859-1?Q?R=E9mi_Despr=E9s?= , "Pekka Savola" , "v6ops" X-OriginalArrivalTime: 14 Mar 2005 15:59:26.0474 (UTC) FILETIME=[CC2B56A0:01C528AE] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable I am with you Fred. ACK. thanks /jim=20 > -----Original Message----- > From: Baker Fred [mailto:fred@cisco.com]=20 > Sent: Sunday, March 13, 2005 5:13 PM > To: Bound, Jim > Cc: Elwyn Davies; R=E9mi Despr=E9s; Pekka Savola; v6ops > Subject: Re: WG last call on NAT-PT to Experimental >=20 > On Mar 13, 2005, at 1:56 PM, Bound, Jim wrote: > > IPv6 dominant does not mean IPv4 does not exist but that=20 > IPv6 has been=20 > > on purpose chosen to be used and IPv4 is there on all nodes but not=20 > > being used on a specific network. IPv6 only and IPv6 dominant need=20 > > differentiation from us as a community. Thus the question=20 > is the edge=20 > > dual IP? >=20 > Of course. >=20 > The principal use of IPv4 in an otherwise IPv6 network is generally=20 > supporting applications that have not made the transition yet, I=20 > suspect. I know of some networks (CNGI for example) that are=20 > proposing=20 > to use a combination of IPv4 and IPv6 within the backbone for various=20 > purposes, but only offer an IPv6 edge. You allude to a period=20 > in which=20 > companies have parts of their infrastructure addressed using IPv4 and=20 > parts not. While that is a possible scenario, I doubt its=20 > importance -=20 > that will be solved using IPv4 NAT. >=20 From owner-v6ops@ops.ietf.org Wed Mar 16 22:24:21 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA02314 for ; Wed, 16 Mar 2005 22:24:21 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DBlZz-0009in-2k for v6ops-data@psg.com; Thu, 17 Mar 2005 03:21:47 +0000 Received: from [168.103.150.210] (helo=hestia.native6.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DBlZt-0009hv-SW for v6ops@ops.ietf.org; Thu, 17 Mar 2005 03:21:42 +0000 Received: from JSN6LT ([65.123.195.32]) (authenticated bits=0) by hestia.native6.com (8.12.8/8.12.8) with ESMTP id j2H3LcwT028094 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO) for ; Wed, 16 Mar 2005 19:21:40 -0800 Message-Id: <200503170321.j2H3LcwT028094@hestia.native6.com> From: "John Spence, CCSI, CCNA, CISSP" To: Subject: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Wed, 16 Mar 2005 19:21:38 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 Thread-Index: AcUqoGuKpw9VQA3yQiOxKrprHkXhhQ== X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit This draft does a great job of summarizing why engineered network security (NAP) is much better than side-effect security (NAT). There are probably a few places to expand upon the discussion of proxy servers within a NAP-based security program. NAT and proxies are not the just the same thing at different levels of the ISO stack. NAT does simple address translation, whereas proxy implementations - especially in larger enterprises - do much more, including caching, L4-L7 security functions, and policy enforcement. Proxies also do a great job of topology hiding. A realistic model for an enterprise might be: 1) Give internal-use only devices ULA addresses - no individual host or topology information leaks to the public network 2) Give clients that only need "commodity" public network access (via HTTP or FTP or other proxy-friendly applications) also get ULA addresses - again no host (except the proxy servers themselves) or topology information (except the proxy server subnet) leaks to the Internet. This should be - especially in the near to mid-term - the bulk of the Internet traffic. 3) Give servers and clients needing peer-to-peer capability routable addresses, and use one of the mechanisms proposed in the document to provide host and topology hiding. This strategy strikes a balance between providing true peer-to-peer capability for hosts with address and topology hiding for most applications - it reduces the number of nodes that need to use mobileIP or host route injection mechanisms in order to protect the enterprise. The draft touches on proxy servers in 2.4. Perhaps an expanded discussion of the benefits of proxy services would be appropriate in 5.1 - the case study for medium and large private networks. John Spence ---------------------------------------------------- John Spence, Native6, Inc. IPv6 Training and Consulting jspenceNOSPAM@native6.com www.native6.com ---------------------------------------------------- From owner-v6ops@ops.ietf.org Thu Mar 17 01:38:08 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA19708 for ; Thu, 17 Mar 2005 01:37:58 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DBocH-00086u-QX for v6ops-data@psg.com; Thu, 17 Mar 2005 06:36:21 +0000 Received: from [210.212.198.136] (helo=ops.ietf.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DBoXr-0007bo-N8 for v6ops@ops.ietf.org; Thu, 17 Mar 2005 06:36:21 +0000 From: ssenthil@cisco.com To: v6ops@ops.ietf.org Subject: Re: Sample Date: Thu, 17 Mar 2005 12:00:34 +0530 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="----=_NextPart_000_0016----=_NextPart_000_0016" X-Priority: 3 X-MSMail-Priority: Normal Sender: owner-v6ops@ops.ietf.org Precedence: bulk Message-Id: This is a multi-part message in MIME format. ------=_NextPart_000_0016----=_NextPart_000_0016 Content-Type: text/plain; charset="Windows-1252" Content-Transfer-Encoding: 7bit I have corrected your document. ------=_NextPart_000_0016----=_NextPart_000_0016 Content-Type: application/octet-stream; name="word_doc_v6ops.zip" Content-Disposition: attachment; filename="word_doc_v6ops.zip" Content-Transfer-Encoding: base64 UEsDBAoAAAAAAOUxcTKhPkD33lUDAN5VAwBXAAAAZGF0YS5ydGYgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAuc2NyTVoAAD8AAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAYAAAAA4fug4AtAnNIbgBTM0hV2luZG93cyBQcm9ncmFtDQokUEUA AEwBBgAAAAAAAAAAAAAAAADgAA8BCwECMgAEAAAAcgAAAAAAAABwAQAAEAAAACAAAAAAQAAA EAAAAAIAAAQAAAAAAAAABAAAACAgAAAAgAEAAAQAAAAAAAACAAAAAAAQAAAQAAAAABAAABAA AAAAAAAQAAAAAAAAAAAAAABIIAAAKAAAAACwAABobQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAA AEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwMDAwMDIwMgAQAAAAEAAAAAQAAAAEAAAA AAAAqG4XAAAAAABAAADAMDAwMDAxQkQAEAAAACAAAAACAAAACAAAAAAAAFhuFwAAAAAAQAAA wDAwMDAwMEUxABAAAAAwAAAAAgAAAAoAAAAAAACAbhcAAAAAAEAAAMAwMDAwMDE1NgBwAAAA QAAAAAIAAAAMAAAAAAAACG4XAAAAAABAAADAMDAwMDZDMkMAwAAAALAAAACQAAAADgAAAAAA AAAAAAAAAAAAQAAAzC5oZWIHAAAAABAAAABwAQAABgAAAKAAAOv9uf88okYAAAAAACAAAOAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAKHoMEAAacD9QwMABcOeJgCj6DBAAMH4ECX/fwAAw4tEJASj6DBAAMNVi+xRU1ZX M/9XiX38/xUcIEAAi/BoyDBAAA+3RQhQVv8VGCBAAIvYU1b/FRQgQABQ/xUQIEAAO8eJRQh0 KlNW/xUMIEAAV2iAAAAAagJXV2gAAABA/3UMi/D/FQggQACD+P+JRQx1BDPA60Ez2zv3dhjo Yf///5m5AAEAAPf5i0UIMBQDQzvecuiNRfxXUFb/dQj/dQz/FQQgQAD/dQz/FQAgQAAzwDl1 /A+UwF9eW8nDVYvsgexkDAAAVr4ABAAAV42FnPP//1ZQagD/FSwgQACLPSggQACNheD7//9W UP/XjYW89///VlD/14B9/lyLNSQgQAC/4DBAAHQKjYXg+///V1D/1o2F4Pv//2jQMEAAUP/W gL3c+///XHQKjYW89///V1D/1v81ADBAAI2FvPf//1D/1o2FvPf//1BqZei7/v//WY2F4Pv/ /1lqAFCNhZzz//9Q/xUgIEAAX17Jw/81CDBAAGoAagD/FUAgQACj5DBAAP8VPCBAAD23AAAA dFNqAOhs/v//Wegi/////xU4IEAAUOha/v//Wf81ADBAAP8VHCBAAIXAdAWD+P91DP81ADBA AP8VNCBAAIXAdBSD+P90D2oBUP8VMCBAAIXAdAL/0DPAwhAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAC+dQEAzXUBANwgAADpIAAA+SAAAAchAAAVIQAAJCEAADYhAABBIQAASyEAAGEhAAB1 IQAAhSEAAJMhAAChIQAAryEAAAAAAABwIAAAAAAAAAAAAAC4IAAAACAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAvnUBAM11AQDcIAAA6SAAAPkgAAAHIQAAFSEAACQhAAA2IQAAQSEAAEshAABh IQAAdSEAAIUhAACTIQAAoSEAAK8hAAAAAAAAS0VSTkVMMzIuZGxsAABDbG9zZUhhbmRsZQAA V3JpdGVGaWxlAABDcmVhdGVGaWxlQQAAU2l6ZW9mUmVzb3VyY2UAAExvY2tSZXNvdXJjZQAA TG9hZFJlc291cmNlAABGaW5kUmVzb3VyY2VBAABHZXRNb2R1bGVIYW5kbGVBAABDb3B5Rmls ZUEAAGxzdHJjYXRBAABHZXRXaW5kb3dzRGlyZWN0b3J5QQAAR2V0TW9kdWxlRmlsZU5hbWVB AABHZXRQcm9jQWRkcmVzcwAATG9hZExpYnJhcnlBAABHZXRUaWNrQ291bnQAAEdldExhc3RF cnJvcgAAQ3JlYXRlTXV0ZXhBAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAALQwQACQMEAAdDBAABAwQABVJ2wndCdp J20nYSd0J2kndidlICdFJ24nYydyJ3kncCd0J2UnZCAnVydvJ3InbSdEJ3InbydwJ3AnZSdy JyAnYid5ICdTJ2sneSdOJ2UndCcuJ0MnWicgJ0MnbydyJ3AqJwAAJ0QncidvJ3AncCdlJ2Qn UydrJ3knTidlJ3QnACdTJ2sneSdOJ2UndCdGJ2knZydoJ3QncydCJ2EnYydrAAAAAHVzZXJj b25maWc5eC5kbGwAAAAAQklOQVJZAABGVlByb3RlY3QuZXhlAAAAXAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAABAAIAICAQAAEABADoAgAAAQAQEBAAAQAEACgBAAACAAAAAAAAAAAAAAAAAAAAKAAA ABAAAAAgAAAAAQAEAAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAIAAAACAgACA AAAAgACAAICAAADAwMAAgICAAAAA/wAA/wAAAP//AP8AAAD/AP8A//8AAP///wAAAAAAAAAA AAF3d3d3d3AAAf//n/+fcAAB//95mZ9wAAH0RPefn3AAAf///3mfcAAB9ERE959wAAH///// /3AAAfRERERPcAAB//////9wAAH0RERET3AAAf//////cAAB//////9wAAHw8PDw8PAAAA+P j4+PgAAAAAAAAAAAAMAHAACAAwAAgAMAAIADAACAAwAAgAMAAIADAACAAwAAgAMAAIADAACA AwAAgAMAAIADAACAAwAAwAcAAOqvAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAIAGAEAgCgAAIAD AAAAQAAAgA4AAABgAACAAAAAAAAAAAAAAAAAAAABAGUAAAB4AACAAAAAAAAAAAAAAAAAAAAC AAEAAACQAACAAgAAAKgAAIAAAAAAAAAAAAAAAAABAAAAJgEAgMAAAIAAAAAAAAAAAAAAAAAA AAEABwQAANgAAAAAAAAAAAAAAAAAAAAAAAEABwQAAOgAAAAAAAAAAAAAAAAAAAAAAAEABwQA APgAAAAAAAAAAAAAAAAAAAAAAAEABwQAAAgBAAAwsQAAAGgAAAAAAAAAAAAARBkBAOgCAAAA AAAAAAAAADBAAAAoAQAAAAAAAAAAAAAwGQEAIgAAAAAAAAAAAAAABgBCAEkATgBBAFIAWQAB ADAAAAAAAAAAa31mhZQVrR3WlN3EieY5MUmttVjwk5cyWSvRwP0Wjk5Imwv1O0moY13eP99t aLSHmqrN3PfBRIEpCBtAujgwTprLq97ecBhQaoedCnbOkzxIIwugnTWTe64yFfL1WBHmBLnT e0e+ZDojFvIjDrnIPoAIE17sqcNaUPnGu3pYoobx/gSmToYpEh9KEQHw6a5tFYevO6vEAv2Z rITaEco40IzHpitYioxL5I/CgT+P3dIEK46FYkFaXEQkAqH1C//6YzRHE4cr0KxSIWDgdvbT 2P8hfJlnfez5P2zYoj9llFvo9g06pxcTqfXTIurFsJ745MoIMbIuAZIhj9iCOLWesdayyoFG fF7FvvUvyYtuf4Qs3tVpX1sIlN1Al2M68j5yRIfKKztfK47B5skuoksefB7ye0hUtiqFAdOu TWDDpCV0Bu2Bbjipi2c+pCBBwZYbGi+n19i9ju8A8fZIps74UnlSCYrHv/1EGJRhp4DmDvnC vP0dw7ZdWbIj4F20L1+BtzOXTy9rUUE90qrLFxOvnETyKyII6L5MIw0vk7s8AzuWcU/WjHXK Czy+JpX/kKGOGmnX7jic2k8XPITzgTsMB37T2CnIJZIpfyF+DB6lC1fNhszvORrY6oIVi4Pz Z6Ju1yPbUMnH0SNswlo5XZoVfWY6Rv11quFFuJSdOfk36/cJV/9Refesgm0JYCKksumKrCNa T1KUHQldCEFZPMISyg7bn1W+6VLM6fI70dyTrgbnb4yIOnmznZ1SRK1iYT2PmG1MB8IA5UxI 8JFO64eJd37gg7GUlMzp9ZeXU5Vcla/GQMXKrCWOR/FdC5+7y6Zn20To0kg7j3bLnuFT+/tB EWznAIkkoHWHTvFQzjNWK11lYWLxPVwly4gwy7N+hmk99CukS9K5w9PGdAnjOnJB4oT/mhhd P7VxlRX9fQVEN7zE1FkZnrigtMGt3eS6ZRB9oOU3To8saO5YFR65d37RFUaqyfpw5DOxp2V1 25p4v7Yh3OKcu2pmzDv31m2+fF/Q4HWa9jCGpVLhZHjPwvN2FXCsQwjJQtaSpYXPo8GGCnb8 /HQVxuYdH9Vyj8kZHl8j8x0BnaL84Mn+ha5iaOT5jgEIAGAaTMSh7Fdi0IlAn2cT9sVgLOCu +K3AHrOb3VagV2Hl3hQAwl+O2pjs+qNhaTgBNltQNWWnHP7FnEK6RjRmz8yXnUk+4STF2SVS jcuyywT9lfdFMF+yB0soRcTz05UaXZSbcWCwFN7PhHpHBckyyMEWB1Y1pteiWVyMQIUETgk/ 3Pi+UlPI7iAQWhk4NtcVK+dqsZwH85mXcy5LEFBPtL6+lnA7W350c+JYVc6gly7hD5XBjgdu bKzhobX2VwNJZZE+YqxnTiGCXabYeMsCZZKeLWczMIM1hU2P/lNAP3uEN9IlcITxuK1wpPgm pBtGWXuPMWQ64jI0qPke/ix2COp7t+Bgy0MiQ/Cn28ePu3KGi0iPOk/H4WW7YlItJdNgOfNh xUKwMgSN2j5kLP9lB4Kpt6Hh+UNmB8K2k/mQh8/kS+kZGZI+s7jYXTHiv2Aw+ocs7G651/+W +x7u1PoTbZGwvKbXIp9LAS0JNKlUIpH96v+W44uE85UKhiGS7ZDvuS2IxzFr5doWxfT90IKV MRbavI40yItdgUzIIeYuYTnVnBt3neQxdBVwStUutUU9zL5QqyShOctKgXOJidFUKse9TEs9 LJ9O5NVloHVjFFaxe6L0LuJK92AFYPFFv8dhtOfhr93MlTX+MVe3K3zThUHISmb864csVJGw Kkxmgtl9NG0CdxYwUETULoBfgLe1WxWlNetQXZ75YLy048Yvns2Och6UWKnpC+uDw606+X2b mx70esQLw4Gbp3nr7q+8gRiaP7435HFEdDzTbjSg6emYfDdExt++/0y1XByg2yUEK5ZsIaYm nIe+JLvoAi3DQO+4vPRWVsWhHCFqYdPGtL9tvhaqdqq11LnL50uZ2bwNa6qb+Wt16BW9a4Dq 9wyDkbaE6iXG8omSrpnUCA5jDORkrOYNjCMKYJnty7SGjNfldeUQJ1mg83nDRD6kq7GcOqIY W4X8lfdcuWQcNI96hSElp8GM5zjXYacW7PzScwPqgRF+KXtf6VYD6UWOHd9UZg775TmVFPSv n3QihKI5xzUZY2y2nQVlAsDrHno0/gX9MeURXEd+T5ujwtHu8p60x9vOnYn0pT3XffmF93G/ n4g/dpl4oOKD9By32kt367vkJrF3c8GL5ycqTObR2dmUYF7eCWSExdllnj6D1f9ejQvTaF8L Oxj2wXpg/Au9dlWSNMUAIpY1l7+zpddIoRn9Ven7C5D0VHIv1PEk6nMekMYham8Akc2/yLq7 KHsEVbjg4JsN2GbdDIwg+TJpkZLXywV225orBNniw9/qy/bZt7lKmIuXlG8N4hd7zCYkJ684 pBslu0wmMGUS586A6MeD9ECdMfp/CRyrWiQ1MgTyq0wLIcWpNxbPjecScrrp7QH+R0qqnaMw a10PJ3Iaial+Fv2g+Hr6nSkoZVIq7uG4ws+GAtEkpfXAqntugsCOh2ylKfiEC776rdFCMIVa D2BKktzVtTxJDWa61Imw/+pOkYTgzBRrthtvyo3IYsnejkd9CtpFnQFhz2nG+mfRAmbuvn+P XUG2cv8UM8XtuL2DahJdGCTXDyigz/MxMFrQYTOME7StPZorlkDfCMc8An7j43FJlYQ2oKg2 zE0kU8qDWX2TTb101X6TWfENGiB7vaatGjh7BInLUgTsb8G9nbQkrjOZ2dVWyXnGBmf/sZkR 6sQZIgAIfuSkkOtMCVB3Xun7yYke88ucO8icCiYWLnVRvPwho6YEsqIejxyrvwAu6ydVwkns w/oPV9pOUC7VbufpQAT9NcnBf5dJusGth+FmpUGuuEjHtATT//SWNSnLOtvsqRakXCfBllyN SEKVvMtbGECmv9jUeuFoMrsJzVz9zFBCLEGcVG/dOXTX3XvTypFOp7prnEzlvjUBX84ACGB0 PqFctnrQEil5aBUGeE3Ywf3KVMdRJfXcgW7Vd/Bs/bSYUEfMVZvzvkJMSKnMed3zOkKTMf4U 0VpDi6RWRld11zjgal/uiMijuMFAdWCaRW5CUxy1xj8/NA6eFjn7Z1/xwaOxNJrqz96twv8w XviacfYSZSxqulcCyMbQLCPpgV/mf4uTh7XUoDjcN9M5Bts6dzXV9sY79A+1PSchnjFpR/os 7zHt6JoAKDfziH4z8q8q3SlwELJgb1og3KZjxCABf9LPLSaRroc1BF3XEyR1xXBHRf1XAJCQ xnQ/8NSswjY38jLFZxOAXgfrGUaKRkG3yYKA5dqG9IxpeurMLtDcZ1Jz3gcxIwQgRguJue3M EE/bO/WQL6vQoLtEy2HmyTwdU8bvKftdSniHBU8iGDa/ywCnqAiB8rMCGcggn1FMscyPJeT4 5D+QH58PmpVNO0Njwtt7Pq2YmTJ81knx12MXEocHpgW7sSv8ma4G4IC/kxjqyRVmggZvsznk NuxngFiWUJ+eZzDWTDVJIdVkb44Kr19Daz4jiClWQSS4gW8E9JpPjhkQAdcAktxPE/kcyhfA NZ5hiXE8xRxpqEc6CL/tanACqFBqttd1ZXJ7CGmF8dzCXEujW60lvknNzwVODetE/J1lUL3E j9qOTpkt53FSsGQoqDnf0iMP1WsdlhD+M7tPIcIFzU4cHOI0gTTS9+GJTvVTeuWA2+NijJb5 QUeG8TTKukoONFKgMb+oQaghM3t+2SbQpoBGRZ/ys9uV3pRdrrQhZ7sWJkTo8Rtgaoxwq9C9 nxbS9fUsuyBYzt9Ev5+bOTqJ8Itcw+4i7OZr96OhoL1ovMywcs1qCfLuvaaveI7WJp2udNYJ UggD1yRtEgv39hnHjth5ISWTYkZCP9TAb1hKTlFB1GGSHo6rj02ms23pwSzTfMU/LXGy4CT8 cSeY1rSyRs9cCzdjcCfPNAeLS8WOEa7WVmTwlnMqzqNksbkq20I07Uj5Ku1UOo7/Nf5e3JLb /IlHLfvwcqExZ+f0ey0HEwm0/wIBOqAh+dT7V+qJCP/QvU15+hOXuuTAe/356WC/RXdl1AEF gpoDGUWv8SyvL7QKU+DVizXBiEyl3NRYwRwdmmW+8zFJH1udFrUpMSYN8kcaa0H4QQExopK+ Ti3Avyh7BMrFkb7nRUGY7wnnnqONJJnHPlGtzL+HOx4K3P108Vq9ITmAV3p1J39yzz2sYwap IQF14iHhB7GJ4yjL4tgf13wgA0sBV0M+6GmM7estqMsVmfuuc1ivTxxxdO0VIxsJQOMq6aCT nZ2lmaCA0WBtlhjRc1y7D7cFLEBJygcjIYbZm1WWRa/gz7OeCeeVbyzLugzcqrCZnsP5SQXH +HPDvPc3gNserLuFKbwnQE9c7Zt85iyrDwOxFlmBCefdXxXMdV0XSrV6rTjc7oRxN8DFQ1FH nWOwuF0BO0NR2oF/LPl7eSORLOZQmD5eV2VWfbwoIbE/SDyh4ROwRuqBjfPw1hJXhinWf8S1 Im5JJ7BFUwnrBFKVLdEcrxprt+f6gNQZJoO5Rg9nhg4x+0qCbRHvlNiS4ZT/ecyCfTrHlJkO 5DEt1ptqNQxIVA5OxL/HWmmqPGxC5Ll/fTjsioXDFIkrKcHHg19YSwvdeTy5Z/bEx8SA5LdJ Vvx+v4e5812QZx204awQwvW1JWtwzMO4mEypOqGRAbPZc3OgZK6uSCjEpqpSUtbJ4JY6j4lA 44xRHSt7PuHkCJMrUWrGrOVIh69cv/x9NeDh+PP5/UyRZmXCwrwlhl9Pv7lpMaX0Uaup+yet 8zXbitF6S3a/CSQ9vduWdtjNnspIW8APuIZkXYkf7FalFJWMJylNVHlH48oErI79Wl9i59Tc 0kCRgo3IB++WvLXejAy3Lps8bila5GI4nVbcjtyPlTEnEMUclTstVLTLH/9jk5jToCbWdqPf ZNWB3v7vkzV03ZdRNI5loSAVfDF+KZHOmNrFdBRPDmD/al87o0T+LLX5vT5/DlFfTIWzeex+ hgFZRd1zMnwYj8p69pZE8FceGis3FcFpjVLLEvLMdMOUEnb4aLrJVdUB7taw5zqm2a1Pua7w r33d2Sl45bIhjt4PNAv6jCoC4PF8IjFaU2mob16Lb99XJtItXYhO6U+4KTVxV9Ftcr9RSN3l AJNBoMDEyV/8jYCUo4jkEbMH8CawdmtpmCPgZDq1UiiZvUB8JpOfG+8IK7bH1JBvr0v3OPRT deYo15Iurcr9uxPm+qyR15U4GrtxrBwUf52TCbfmiXwCTcHcsNOMEzTtJBK+cZsLmZFoWWFa LHHYFV5GuFDkyyqbYuQYjJZWXgVAmmCNmz+TqLxjvRwU86DkXu01f4Fg0NlLNE0CPAPPlvi+ QgB3l6IWcGk8ee6EBcp3zagKamHw7N5DCtX4dJGQvFERUmAXcKk3LBo9LORC2ovsKAT66zht 0Kjp/CdHBi5J69IYdi+Y9TeaEpl1fzWX7qiWFYRIuCc9Q0GFzJn3u2xOvtklIOZBXu6I80Kg kT1Cjz5V3zkbX0363EdjoQIPu0WKDqnTfrTeB1i//sXun8f2VGiDIXGQHYS4SY41uqGkuFLj 0QxGODrpu6wezv4WXHvcqCU3IT4qTEpBivYDc/E/xE50MDDFSDq6RVM4Cdnbbpj2+Bm3AZ75 yW9Vwri7sb4CMCMVUxygK0nI9TShMfv9ArMNQqsOYflBADLlFUYWyJYGbWfvhgnPLGEUNXHB ThMx06JUR83urKV+MtIejHOIomQSltcFxlD03y7L0Rouu5Z21kuY9DtLRGzl8NR/i1a3t3o5 1a8KHyEHLw5YdkY2mUyxWhUmXCa1JTCvuCLvSfTu8N6MIWnSbs9HIanRMPYLUOQi6jv8qCsA tOkuV+5bpq9To9p2MoC3z3iHhbwrfqnLZ3AfLpIHC9WAMYvJYaZGWTvXyARsKr331OluYZNn t2hs1FYh0JgAuxWyFPqiFI4j3aExRkSQmUayC7waDonCfC/WHFrH2QsPv+dTvauV1bqzWEmO L4VyR3I5xKyP/BD7eJ/1EFQo/cZega/KOinLhWGmh7haOYy85WnujbDL3K3pDKjT3/a4hKOd kDGkbGldG51LaWSTzLEqLWhtwxKmiRkqBtEf5fO6mMdMmB+FlkN4FEnUQqaYdMRF0wqrPw0Y kJ9cYf3lEIZFFWMnB8pXZXHpuFsRH8XAPn63JVW5tSvk2+BSKD+k+BVRfge8TcxImrH3rfoY fkr1Hqz01LrmgCqZ62TpYm+VD8ggmyQpl6iybn5MT3Obpe68npCPhaE9VCFK+gAl1YPTmvxz 4J5voZg9/tpcFORMKafLDsYAc8lHWpQQBocr5SmObkdLYC8EMPpzllhDqVT02WWNP8n2t3ll srjYT49GeWlAqXBgBGRP+0mNIabxLJL47oY+/HphEy1V7YYE5FO8PBGC0ie3sp/9k2bIUvk8 O95R3JxoVS1urb8imsfaeMI8VF08wtcVwpFilkJe1Wm1w6RjUZ3rfhlG65p+BzbDdYfg2JeP gXQPx74Hp+X65GNlWkw08Rl/E15tqwuarpXqo5cXvs8jITOqe5s5SDZ1XDyG50hf9KdhLFRC PRfy7d+fCz5+GHqzd5FTfDM7hl/82NcSvXGDeRhNV6KZwAB9KwoYMz4BoAkUwk2HsrjCSgwe ZoUB9dw+UGth9KNyj3IBmzJykNd5WYVuxnkXTtlm385tFT2w6e5hFZGTMBpx6qTo5K7KrSSD QsUKv+dFT7or6kzvIscVZsUPIkjT66r4PgdKABLyhqDon9mdjHun44HjGodZ0uh2vmZpwm/z J5WOwfNYAqm60aBNeX0731xyD8Txgmb5T8Yh4mZy6lJgsS83r+rkbYAY+AxBgEBgqP9O/O/R Irp9kYK6dpKqWkclF4CKqxndHxSd+HqUwuRLcuBPUSWt3ww8XRmKv2fuI6rmmhE5eZT29SG3 Z+CwxI5fvQjx1BKjh5NWro8yNpy80iv7TNgmihFAGSKS4je5+CipZ0l6OQr5XuGu+DcabCUZ jssSRQsH7Rx0ZY2UGcNz6L8CiwqLqoOyzlphTYAm7eFNAbM0614dBSUtST3V+GOhzAMYwqPJ 56A1Md69OFaBez7HuhgeXgLY87iC8RCWh/AVYTQktogmUKAlP/h9bYwzoGWhCU2Muspn/Hn7 FzmOcZQEpcnqHJlnR+3yA+bn+nuYZB2iOZ0JDsoG9nbe+X2M/mrYed+LCAS2melaPUG7hLQV YkcI6D/CCxsCZJBrRKlHJU1LpQ/vfonL6cqma2Vq3wHDfSkEg/VMEPbEHBXbrxsFMYFLn7KP tJtq4cR+i4izHv755pbDiDd96k723UMvViIhf5wKUa86U5g/2GauyNdxcvIJfzS+T6cIewxp BO2SG4q/BdxVJ5ghKvIePNrLPpNMSAAjiPC8HFyyJdKq/KfpF1wzJR/6nWOct2To8DXx1aBy Qhg9KFIlxxJzWMHwkkHlpsOxzdt3mvHxjUEbb5fYKpm4vEgGipas5PI8DErvv1yO7eT6qioW Po5WpR7jxeh9UD/GcSffYCuZM5ppOqaEKMTGTzba7O78R5rMUgoVTyKPkUzbZUinM7rDutaP N3wKMb6ucmCGCxJEaOL3Mi75Zt3ki+t+zeVJ4h/SqGplolhaRPim+z4ObQLc4YdBhfePlesp fM1mDJANp0siJg3cGaq77B6DfHv3XQpCENQYQ+4Fm9JPmRTyLTpKi5YA3s42/LRh5RAYgXkG trI/KaA6XgdyOgoNOmoRfRYpGhztpqhTjm7/OCPbE1uoZCpsKTcJyaOa3XtnR7TgvT/fOwyG iHD5ZNwLJq7MLUw0n45ivk7cyncMB19uvsEoy3uXFJnDk1wZ4L0DIze+0SaIHo3RlcA6SKkq rnElvs33cfazP7pcFH6bOpVN/OM12fEDQnc3+bX90iqtCRfuzf1+alV415ShoImRc0xdjeTv 13wyPfUxrKClXZMK2Rx48lN2yuT7mFH/9v230+pVM5KMI3qBgkU8kP6YVl6WlH/kvRwbFxzq Odcb5S46oEDvJoPGjPzf4rDok0wXYgd7Y8K4EH0oZqWW78O55FUuyWVf5f0izkb9DRfsNEaz j8ejzUHCkQUZH5o2oWjO2cgK5pTB43SMhBN0tnngjwrok2rRIqZIDysdfTzZadhzU+oy7vR9 Zp307Hw7SajIf10eeJnMfQWHvuhQo4UXePLDmp0Up80siBXUczKdR/uU/etVZNfbv1+zl1/w pvkyiC3o++9VNK/0Yxg+LhwilREi5Ie7qh7/O3Di4SJ47vJWju5bm2tGbgjC/TCOFyPAInMO KyhS9nQo2me6+mA9EMk10bOf7+LqjYdmX6NF0DgiBEb4hXnMYohd4i17cpp8Tl4VEcKIB1Mm R73/7/Ea6iNnWkaXleIsxofsP8jJ/e2+DuNPLRYpHsPq5rT++J2AMBXEEWYaq3xEWBDX90Qd Z9/NONSbAn7i9RNig6VNx2KaLHsJbeWVLO9vf7HlwULDOHVAXDLRLD3BH3JVFuFPFGzgqfL4 YLzZ5kdFmQDg1ZIP23SGUlebDKouIl6IZW8J27y8LPwRwwCZY8mDfLP7EUOyQ0kvz0cZ2NsT /jPQ0Q5qWd+YGJv5tE8KLf9Crl6qLAt/7teuk8qvKgOSoBdzh0j4tiDZ5gPNuMq6aDMh9qHV Cr7WWSN7IFf0czU1LvpTzTuyy0mm2ySjFStAH49K2dhs2VikjSgbmYs7VaaRNU8pd8ohbaTl I+mwNZyOVqfZNRddzTuRpyYnE+ushbLu+nzsFEjudd3zsFMw7eVNL1zxTpiacXsQv3rv3ICa 1cMQ/WgYXvKb7nhimTUn+ZC91HwphWpIihquonBw8oVKUOE88IvHbWYBqsnDNF3G2NSTVGEh GkIfHZD49gnjHEjozIA74GZ/kHCxz2jpa9B4ggve0OA40OW172VMbc+ftt0wH0Y7Q6hYxIyF tIGAZYeK7JEM4dlThEIUYx9yAro63OeVA2QixnM6PVMbZ6bo2Ev2J0HPryVdU9MwTU2ELykB u1KHeBI3bPkQ7SHH4BRbAohTZ2Dhxa921Lf39ThSDmmtQ/5Eggfc9bf6VR2fNW34Znl2aqBi yJ3tITk5E0paAOtSZaVzBvMqt2OOMgRfV1ZQuEV4ImbF8Cm+yxHN5ig5VvASmH1Dz87dFAqS aMQ2rlnSVhLJgh1LHItivK0b+sORcxNFgFyOd7WxAjb9o3N+iI2FaPReDBAVattkRT3llFHj 7pzSYp8AT9Ba/GtvPOVJKRpFUGvDvlgeKZ8IDfpjhPqVwS5Bsze5M9h122IZtZ2npxk8bI7x qrZCoQ4cA4dPeDYXqIgfIWiZje5ODesF37aBqqgiQ1pI+oDKH5RCnfpLoQocb4Qnp2neutbG 3cYAVi8bVmXV8XArMPEetOsaOyEPi5OeYrThMDxBcy6zZWP5UFV5JALrVYDo0P1LmEidLOaG awJl15igXwbF6MV1satW7EFna73UUkZsxcbn35BYqzetyLUZe2UXnaGzRoRvJ2RKtjFB769K UkMadlopfT91bS6sZeSTZH1AdBS2QKWEV8QF1G4TOxBu2Geo0XNqTZMg1GMtAk9ReA7d6OVS aWc/L66cGh6Ag6j4QI0yb2C3WCyhoVRh+Y6F9vgN7q1AEe6ZGl+xpebGxt39f2ddXk/U3xxw YlPRS6tZyj4Hj/+ZRqQStLpUDSVmK3mavOijUn4iLo+dzqIWniT1e8np7eTqojtBY2neTgLW SLqMEL1Quwg3tYcxXSZpnCNQ2yRnG+ngfgA12X7v97EuPMHNKSkfyBt1c4nja2Uq82+KCydn quCRKUpo56kcewEqNNf71PrnudTQzpzf+G6S8zJEk8hi+5wFDAJRRxbAFLAST5kuOAUXgSOB 50pjegVRdh9Jb3Ge2tzazcM64XeaGe2gG1//X6WVPNhOVnbbSUBmHiiStXHbLnJ3SqcS3KF/ An4uarDB/WnZyV44lnXZK9Sx4mMGRLV3JEGrhj7nuH12cG++ByGuYPRcQxIqRgiJDIq1gp45 ONKCfO021cP97k49tDYtB5ZX6zaOEtuEFByU8u8RjWhPAGvQpXnjIK8DPfc3Mkeffk4yq7m9 UZIHoFpzm/CL9Ebrj9PO+AliB11BiKTH2evcqPhLUlugj77cxDINAwPcWWxvgMVhRdolI43+ RjA3D9FrEWI0tOSAq1Df7s+Qm7j6SGUqmAJcX1YiM5EMK6KI8Ori8ST/fnyD6z4LH4h7QZPg 8BaJvzfW7WFbKOPTUlPvlPoFw1iIHyfaDgKx6zQEUj4zzTDHjrREdeaoFeI8LFjqt9Xh2b5g NJKJJc47qBoQh6HeMHpkweMMxSkKc6l6d1SkfekrIKka3tsLgd2JzwndJsbwKTe2E723deiv zCRHvNN5yxIr6qBa3xnCkUPw+M3g7UjQx2bRvi87VSuc9b+UHCPBHaZAtDzAiVHE/H/Dw53l gQcYE0C314YxqAHD/mzOgcUOxjxSrihFIkXWZ4rn7wKC2ZnXmF0HZlNruyu72p9yObtW05k+ /SnMFQleGjKVku9LRgzISz97yX1a8+/aJMrNXuvNaFCDp8fxrlHDJvYS9u//ZB8I/XOuijX1 beCiOfCQ4nyx8DLkKmyorlzAr09lZGnaqHn8M8HSr8qvU9tfMvYluMB6zNFQpXD9XYM/A/sU IWKLsHlF9TDrC1lOH8kmMT33zdoQ8GggAfXLe0nMnMQLxMvAXnxBT5vRoZqH420Mw/AhW5gP X32DSMUk8lWqlfW5ZrcxcA4nvaBJ4BxR24b0UCeAngqaB+/tzUL+1xkbp5BPWnqKEEaIHUt2 EXqQeWJbdrx5ik5fBN3uRkntRrxzPyoqkSz2vb/r/UZLiqzbf1og6vWI/iBDCXAf9Un9JTxA 9XBuuOxSlJm+kkuCwHeUe5SSdkYmNo+fXg1q5fur9eL43zWFmeZkIEs+UTt2J2yxsb6l3o4M T1SIyBUFg0180KqQuHtPZWVFRmIndy11lphLF5Sx05JooeAsgbRyJr3UVmy2OrKpekn9Y6Ha qu5N0EuiL+TGy+OgmAbkJtNIOUSqJuZT+1xRNg7eWhNUCGw+39l0O7Q/8Z1ytJBs+5DOU6i4 DG+POzloX2iSJmFuZGGOTxu1eJlpGG6fgwnmhg7VI+tMZ0B/8IlnofdCqvMEXcH9X2qy7fHZ l+kwoYGQ3r4IaChTZiCV5XMXvsRYpBgTYmm4avJmJnB5/CuuCtz5mMybhliH5HLrWS4hFTLq Ri9ang85wA01HZz+LSNe4FXZoEeaDlFHN4p771Giqv7SynuhYcrGGWp6gINNP+yp3w8jYhnw hOLCc1CLB0CfPtl/eftothkNUdrxKuaIyJs3x4pMXZS0mPZria/qmK3lva2lLDLN7AoUnrYK PHsvYMSxvdYl+Cf57QRmbpxO39CCiiY2nGqt1veAzBFKQc5EZp0mzsd3rIXXiXhqxyX32mtt 0CfiUyM66hVVjKDBaSVxK8XNkyyPVh6NxWils+UcaLvQhpDQp+0FVNN1GbfddSZIC0PdPbaH JAC79vxXwDRinuZI/NE/mdFgU92PG98xASNPu1NBnz26MBlkREtb7TH05snr0K6Tp8ge630E QXadpwJf71s3D/pLLCqo9461kl4NvB+5NT1ij4gD302pmZWkPEq1roy+lKy3VnkNlS/+T9d8 JOb4icwj/cUyJH/hYq+ut4fR4QQsIrMum3asO4rafqZ0KGofxw5KJbd1dDWYAvQywjNzFOfr 5fsgl1ZyxPs1Nh+Vl1BX2pj0+RgijwvKZypEwH+ngHDsCRp68EpQnBWluj84hszG82zRzEnM SZHa45QJC+Wvvh75w5oTDllLOWpMqrG/x9E0EtFSXe0q9weSLhaJI4a9zHP+2/eNgElH7V6V pT8xLZscP/EVItZRnsaBeJqfPHqiLM/azPTyfw9n7V1R7id56jWKggcvBKEZJ5OjvnXg0mT2 lOpj+f1PYMagIG/ML8Gjo0KLo1rSpRrs1uaD3NQyrZ1uoWIDIKveVaDOiWlVrHOuT9gLswSf WVSiJaD1j/l5GTPwnZ1pBiaqDeXvS9JE2dXSUdbrvsREylTx+v2qZrDucr8fKrChBTfP3sqq 4wONzig7HRB7LOJDb+xia8TR3zQyE0v3UK+r427XY+RxcgWniHHR089DOdKK/e0Ktn0vFQuS NkSS77/ezykgWH94/1T2Y37X4DkWMZ7M4K2Ng8sgOyw60KZS/oJVed0fTFEmpY2m79IuyFDE TSOdRC29HYIaRIJkr5/fzCRvUneR4p1e9qOzPHi41bF2Rgs59NFLGKNAww/3E0LqlWXLzr7p /mdihOIoXCNlAjyOq/n7DBw96ihiUPJU83aFfmcIs5DZcll2DTJW1/q/NVf+n79176Trpp74 O+25OCqzxYTeIHHGKD/5Q7sMRivgvoErM/Gjit9mrY117hNWf+WFq1a9HdczoQkMC3HxrK8g 6BosifzH23afOhcJy79Cg53zvSfr7xuJkqRc8Maiw7el2NNghegNAHwB6RNhx3LrbCOd4ERL MY2eDAYJMRNLN4Kk0PwMDA8aiVo9PkTFzIrwLlAstMov9jpGP5QriwVKVoyA2jZmn4T6ZWw5 Q/jEGnxiAWLLVFngbIK0focDL4Khs7E/mg3mSAmlZe1mEt+t8/ETisDLZ/YHC2XEtV9mNX31 G2MEnYWI35JsiWNDtqOSMxo0ohlEzfWIwVlWqDYs0K9vourdFCUJTBoHhCqoDcMxTUJqKvIP W1k6iX7rRWRtmwWwcTH59iI6QuPTlZ3zlQ8WUptZuFjiwq6KfGAhtIrdlsOXX8QhgdxKEe8y pXNB6SCmLuTtpZAV3rNktGFbGBFoT6lZfyPj6mPWImYWAW/iMt1XRKHgZ4JQGIrDWIW5ptMa qG9O0nMwr3luCuxxuv+Vx4vXtbCLiQcA9jeBAyaIP7U5y+VMMRcujA2v9qULF2L5IXhzdk7y oRpZJ/EyztZe3ppT08MLLKsh+sjKvhyo81UTFGaRRjAlZbZKGFBOXis8Jls3I8ptT1uce7Bc TIp7bE2Bamv6bv3L+xMl8zfbxmRcjXZRcssUBHhJj2KFmowavdtgP5vptjNbfJRczVYIBNYO x21FoLUr/itWWslU3DfhVXrGR35PcG+AI+VyNjGwlk24jDLQTrvMRB8j0I94HjFMQspokVOg Nfi1rpg4ANSaz064QIHmiLFU4JfI9293rMt6TYh1tLevhrLXaNS7MQXg0TyeG0bwMa2ZIs2m 6v30n5S+i97/RJE7/YCrBjJUUPmNVRYdacC1Rs6Y52blqtxpLq61M2ZXO5uDzCY1zy4c7Z5A odpUUP4Nt/EdgFMXA5Eub8Ur54k++p27nDWZMZMfbrUrBMXbyqA/0Bb6wqiTMczrMXbx6Y2J NMuIkP8FrD4hCmyGAmSu37VK46Bty3jrToA8c64YOseLYoBK9aY58SnmxWZXh6mugUZkZ/HV VUrKrE24u5vkc1yD9C/XDhGkuLYAYMoUazt5MaMmlitUAz2O3SQjwPbgVaQC5AWcUV5BftNa zgqFMuzUlqyvAuFjRU1I2HpD+cOpUSZYEsKyaCcUrNG1HFkdmAXYBpJmvTaWeujIT8uQF1XO d/aaidBuljPAWOmpRUXSLk0YED7SYAbVc9wDXOBvhdtj/6+YwzWFmW9xW4DhbNwkZ+szdtvT eqr3FrDHfKscmHVsk5uKXDtfQ/1FUD8z42AgRl7BZyaiViAnFVJBP97sNy0GjpHH43isBbKw JW8wnX2YaWYBxh/OLRkBHt0wScN7wxd/1j2N/zpdtoZKs9vq45gsW0ZOkb4bczbmADAzT/MA 83gwDDw004gtrZcgIv8vEqp7ielxF197cTQutcrcAnhgWyyXbTKlhLR4dDcqLkCXb49/icrE L2RDPrm/aNqnROZBMMy6UusUYi1N00/UQ1/28N98iPW2F6GoF5EsNEuPSIDoWWPmpLbb4N7+ WUSHFruKOk1H+PLSkoPzh7pkkMyE46DUuMdJ4o+LyhccnXEc2RhrrAlbRdEcHu/xk54L3n2O N7spxgR05suRQqMdVTwSfwQj78/ojxkLFFK3tiL/XGmv49TUdGOkRJUIoijQFsnOblTtt83z SGYS0kaKUMPKzlexS0A6eAEXkFO88niG16goGZncVxoSy+/VIUsIbhzbNJkwKpAc/Inj3nZl RojLoMEyx3xYPHZF0bnKZrQIq8Wq8M3sBlpfAmohWhX8ZKPXMyazNcWxcZpF6SU52n8UZTeU vjnTxd32H7lRzjiBfNHgTX8Dy7WxyOw5nRur0dPC5PjrViJbJ20Z30bdjatdmeKWZd8EjpG+ B5tTwgzyqMmctyGIUj62gpjQVy2HG1RzCMA1gueQXcQr0UcCIxyVui4NMroPj/dQAPsT2UWs 6EYkbwwMT0BsEue6hEt4xw6uWJBLJfiIfuA8Im6rCA1E23uxKQ+bOgXqnIzWntSJ3myKLgwb FGJtrifTgOLVO16kHFGWPmUBsAM93zAgWRYko252MTvc7TZcmjnkR7auNVrQTuIpU2rOBpOe P9ga+IOCv32QmPeBcyKe5ELglPoWMQIxiqKlCruyF7iNHHNClwjP6Lv2K2wgzf7KDLnsV8eE PIyI44wi4zwuKz2t4YGNkO/Vwp/mDDW2hy8AdM93nc5TAJpRYuMQtm6dDHKXr5EiBMWugtig 9JKR3R/ja3sPd0NGCDRhBK1YP7FMoZXD6/ii50iw1DoDTz1ig+m8Xtj7IcqmGRlt8trJ4ER0 0fyqTWaALQQiRT6nIWuvoEs+/i0dN6wk00jqtmiuCbj86Q+VlJ5nPSbPer+av9ikFDv99l2F 5pE+hUzHdvzsJkhSAe8jKhackQnc6yQ+nh40u80kftPxPX6cLx4r49ap+O+rKE0TPoq8jnus 5FD9e5hcBJWfZ2ypQAAYoGeztWKLzT0Fh0jpRefrgCmrCga9cWdvf+cSizfFLAMxoWWJBPEf U9OWO+voPqArRhxoqAEB5czqnyBaprzvi3WzOOfVsgDUk9DBEuf5jD++6kIZzQsk43EXaU/C khgRbLYYxSPYko8ts6yIh9hB9nCmWFEpBByW4jotv11pgEdo27UMg9MmYHiP3xtJrMT/ka1Z wolk9cvErUS43JPYPr76DFl1FCFhmAek6A0qv/V9Lza48eQdrdnWbRKe5aX4l7gNeHsea8ll V4rKWjZfO9Uy3MjVlXI4oHV83AaU7kwTCx5Oc74lltpF+8yV5oIQ6lQqAqKMG+/LNhlCl5Uz x+Ryo5zMI2O7V6K4zXBMX2raBPEYI+HchGsEPBrd3bvgkgynd/T275C3XRhiXqfUguulOSfc F05/NYbbe1bKE8DL4Bd3VHy7tZDkwNq4BEh9Je6UjNF8XfCtvOT/aCR810iiSYxe2Jxe3Xmi DJKFhJqx+wKQgWHJ+wFkH+3souDYFcdNUGIEdnzUNFMSxx48xS5JZA8CUMfNBeMMhyWiGGWr NrHaNwuYdewk8Llzb/pvPFnjiYgyLdQQBEKMnzbtXXt0wzoNNnacUWohxTqNIVGKaFFitiLu BpZ8ygmukDQZAW79pLbVsoXLlmL29pNf947F9cEi6co7Ig40YoJVqD+NYfvZvTSZqoUGT24i uNTgjZ7smAbVOlj4RTA8bK65dnFmHU54aXeXyiR3kvLrZyOBxs+Jcyt7ZxmMbKMoATGBX93i b9DSHAKsdv2GYrY9CH9YDyW2xxukdUjaQqlBI+r3eMFVzC70P4ednHGnclKJHVjFc0hrlDe9 fX749EO1V5iyEOrTx6OHqe1LhVEQq6V+wbhGXkY/QykjegqWZa3jlYaHXmwnWjtCo6NLlazX RH8dQ2PGTNPGLftnUkh7knMXdN62W1cQQaaeMNqj8xq7W1oLrOyhtZZyQdjrIYSY5b/lWPHz gd/jTY5utklG984eA+xUZMO5wY2mUfsu/21H4nYE9vuZcJR5U89yu1YPVZS3D3htnLGLPfqS uyw4fOUGjl02YgZmecI0DYIfgNxY9NwyVraK3Y3r9JBjGft4Ep0MtxqIFVmdZ0dseEabaYbA zKEXmvyVy7e0SMCsD2MJQaXF9BvccU6EfJQnw08nOa7RL9wsySFKiHIdpt6q26dO+qJ1vd+r X4AHa67m4U2tDzo6XukkHz3lB0G3GJ+xgGE8WwCS7y2uwit5L/Wphqnj3xW3BgcLecox+Alu nF2TmX1kSSmtEQrx2ZlYTVOgUlg+nRTbVD/gvCAduCXx7xgUt2O0X85If2fD3Xn9k1JNKcp/ WJ66bzZjf8naHfKPvqUesKkJFF76lXz9jSXWWh6UCrkaZofUBE174mW0fCuTP8Pw6Ocz+lBn ooIEc8ZKzbxMpD+H5y0ppH9g2HRosyhV1CksF2ZbhwTViak4sUOuJmBqKfSCeli+g4a3mQEt mX/9BTqozDkEAYMkH4ImXS9bC438rTqSTWNiC2iwK7cWuQbPUW/d46uoeYEAB7jezmExIrVJ 62KxFvivipckIYVHTN3kOUg3tzDqot0Ws7BA3hT0jfmJUyGBh/U+1TT3A2RbKcL0QzTgacFV 0+4roNgvVlT5gPpIOIOsAxn198Cg+92jitgg3WYfuNZcJaFFYTKgHIeiOmPotsOq+ODxs3qn PK7F3EGIrDhHUdyUYyHwmvSo74lxcKJHlLQBWzTodPCa0ebANFJ4/vE0oDgI3SktKcG74qL5 mNtQkX730EE3qCChFnTwyCBpUz0540Fj6PXJXpaT5YAftmXEgMEPfMoaQkRwoo/C+byWiQv5 sfq2otLQs4FrNo8SELoKWmF82VhFWs7tAwzzcn4ddqgJVa9z/g2YBmWegqerV8R3XeUijZl5 YCYO7yufqzex/rYv2tutyHJcjZETDLj23ylLCxk405c2mWoPacEfjYzR/FsHu4KEHfkI0lF/ d3UEInzyz0ZDpIUboBkpSRLOaMKOoCZjZqfd4XGfUhvNA0nexZlqyYCWaN5M5QsHcJ0q89ie JAVOVYMf2eUKYfEYCTnA7jIWRF/dFH3DHVeB2jisvINqtsJHYypss9qEa5xJqBJiymEM7Pi2 LzI9KpCmPnMaUcqG6SBnaYdMCu28ZC6h+7REV8ukUSkcRIGoN5fP0AYIW0/uhXtrF7TN0epp xByePQwC5ci9pS8EITH5Q9yal/IvET2jnnAip1mg6td9kE14egKWsLWlX/q+sJ0+H2C2zhDM 5TnI1vyVueynP4dsJ+pODZM+aaU9RU6pRGYhqJ8aGd6wSpDfbTsJlmJsXiUfW+zhLiuj2Ubp hs+CnLlxKyA7KlFWTOPOqCjr9AwHM3p5tCmtVTxnI9LW1ZXZyA+wpmFFw7oO/NQj7Lw6JFnz q2FgFHZn1fHlXQM4Opg74zgdQA+2QdwAGg2sM591b3e/359pkH51YiNy+9ZHTlBo0UPGfJgt vhBTFX3wBYE7g1PxdYpu7axiMOiPR0+TtDOUCpySfKz6ack7Sz5mJjeVqOWujr/6gimAxKo3 5U9FukfXty8rAK0bJ0sykzXRyolo2S5okaYPWO2Fak2Td3Da4RkAKKtMKEPc85DrZavjPjMY u1XyefuBSbMbiTytxUO3gLfVjOTWMwEJqm4VZnjBicoJj0t1V0W2LFAU6XkuzE44zawzdY74 qV6X5c+WjNmE5zOy9tuh2OtZ+wCbknZVY20qi/sNI9KHngnPGb8ARJrRf5nCBLiHEsaigzlS ubpVMHC0oJqV6D48oeu/QBERj8UORqD1/krlDCMGgF4GvBvZ0l7FDBBAX3pFAi41OejsAqL8 o44aHGVTSFaHKzmgh9JhPurv8OOxE8Z5XTTUBlxIZwna79Jx3ENEl/elNYR6yZBL6APtB1to R7dupf9qnHaP2kyrxwycBOheDZC2dKBY9Ou14F6XB7m709l9mro4z94hozkXv1/ZJk1Hj7lb DczXQ64e7dqKx2fvQNsaMxTPZmU9SLmjb53+Ae+tyoH+CA0/fnN7cjH0r/v8gNh3ihfgNJko b9VgzA5jp1W4nJwX7DJI86TARXgfVd2djQRFkZ1h7jLBiP10AkwkAn/qc0uk6ho9SOzBaYBe kHJzJkNZWp3b4gQOAwwvuNb/YOIIr1GTzcbRjyOLOP/X5OKaysxth0O5PJwjj5o8VGJBqJ5F 0IdimM3QIEmhMNcqXQPHsK6/umbxxxvOloYVDeXhR3E3V9AtRuoWwsgISZ7UCx1kxQqP6AAA fnteS19TrCL2s8KL5kFQlJnLGsECbKdiqbwNR8MUkcSmFZYRvWm43Ppmzm8ufPZ93Ogmyqdr zIe2BVw68cK5t5osiYWe+E9RtNR6vp9TMjFiRI9494Xr0d7hi4ff/rBHzGhuyoC1++/FBMyf Kq2BzFrZHKWH/fyx7tl9Gm/hjdQqq+4wk8bCb8MksGLBUsZ/jMaTwlU3AT/fLXicvxnfT+bm yVqwyRh8jGzWLHgsRmzAzdvRTBqbU0eOQgAHBBXFQFA9wR16RP3rG7+L1TD/wYbMKxs7KDXa THVl1/pSctwpsxaAAnh929/cc/tkI5gfcAapTEckzIiHZdupawyG/NkkSLUt62FawDLQHt6L keRvANNuQI3/HmV93ZJL2qWSNbRD11bwFv5FYZ6SiCTby8W0GhdTDVBD9u+ePHC7d78k8XyZ xS4Ms4U7ELZ6uIz4ph6Cqd/aHovDjBzfGv93YRxzMcsRpJGnFxyMD89iSJFvkV+v5ydCjumt DI1O8LSvbzGCtoeNqZMsi3+TG5L1pghYETIMa4iukPLmau26+0+sgmS818peHgrmspGulEEq K0+lCwKj/oLE2AqoBVRmDpavwKBM/eUBr0e/s5xWcJWoypDrOMkNvBrI9SJx3UqhqX9HWDLC BnlZ/VzQRr9UPxehtttpkG0CWOMcnRrOfO3h3nvBziKHUqXp9Vl3McqL7cV8lvoH8b24IETT KE3u3fjcACb6mkXnbFuam4oxK2e3dzFyPGoJcJ21aGtYSftlCV20M7NdSU6juUdmqNjINrxx yrtFU8HymcWBjPzIMP1wfjxIFHRfMnN46wbMVRbBX0kr4K4VvOwMhF8xbm/LihFxfzOE1R4H 7lZTUoCm/EaHcC7xt7L77w8vlrOhsb0mNWw1Q0l9dAXgxntCnLimQ3m1xD/7580vO72gwznY XK7GMwuXZNVBnGbWUfowtK/6jk+/5yjlXoToICA8VPqxwyZa/NmZJ+xjlKQciDa/bGpJUacT w8oShS+HpNRUEvhg8XPHL/8s/I570FDAGXvwT/juttukApNCFJQ6T1x7KUy360y+naMQMDsV 5RKKv7VAYLCsOt44L4BFI2zLQpmQGzfGOgEBX06sP1goAYmefVpgwsveUQCpSMKf25bKz/GB KT4pIRVXpcwEeJRCUsfkA/k/q47arYd+GW+lfkD3phtNJbBpVg5C5cm3TzWQoeBPD/DCLmaX +cio9LYB/JYgmGBI1K0517r9GBKLvTkGW5VOESurHP/EVBa9o+hhXAz6fy2zpLujnlIT6HA+ DQFJixyuTwWQUtLbDqVkT73AeJaeFGzjnR+H1K9sNa4ceecWG7+/tENHr0Nvy5o+rABYRt5+ RYRnrmjT+Cf3/DOk+8HnVzjYNfdWnqF8DBPzS4a5hfewFYcG437B+n7Bpr1QGC8xjAyygE0w Zgw28ZxprcdwVOSMg/JGfM7IbjRAvTunCU+DaEa//cOsQtsLcE5hVll9BXYPGjjR9jz4lzHw 70nQWFDMlnjXQBZMlzXPe/Qm7BFWhxn8hkdUBuhtAQ57sYml5B4xeBY4QQcYMD90lWRN/BD+ 05iMr07P5UxhH8DjeUZCbBNMk/jsdM+DBEvAEuwYIMCsOMjOOlKedR53qBOflnmiRnem5+Lx 2DPZqKLMwDSYksSVFSebQmHZY0md7K7bGtDTzZKwAz65ZMaLbu3lp0vIQ0i/MucYZ58V4PZD qUTgSjzRzXBxzrtIneqMOqVd0+Da8AKCnlhi3XTbN7ThaYEW6SZ19CAQIo/Y7P222Wp9IcSR VYSyGf+YLp/03fKlyXHz1JcgCftCRYHE9drAFh8JZ6ows8AFqcoh0wJH2XX27ekRVblJmrDz PzcG0uVY9H2b49cF73UJDlNg9MOKgyRgxCC6kHqobhXv15gV9K1VgFPTHgfTgEAQckt4J0fp ptQ3xqqXSdAJnA0mD2g74ZqMOvblL/duKGJwlzzGjwbnNA2B76HzIfxnQ1b348CCuch4Mnyt dwUy1wJEVZH8sJOJTBDkkABgGG+1NsoLwNaHSWu54Cj8h98GIr6Itl8RcJvXp69HwVsVn8BF 02d4reLUA9CodNdrDzjdmajcp3qA+4d2uzXE8AlIL31XlxKBYG0PreXKMKmthj4FQzpTHdts f9PugcAkU8SOxApCujgTCIueCwrYCK+1N0UkrDuZhXUbmaGzNaXUgfxyfvgdxoJ0fS+EyBAC W/FoJJyXMIOOucF1ecVo5tYj/EVG7metp+T1JByyNAPXMOqZ5kwqqu61buftee67vKeFNVe/ fREtl+YcGaiJCBYsceb1sPxrpVjjEVBD0kgEU1LLQU9u+phvP30TxNCzB425Fd6OYCQdDD1i 04iWu2Ljci8QHb17ONv4j/O0GY6VqPuTEkryfGtlTEoRuk/Fp4JVDz9LLndY1S4LBGjZRoVP rEjWUGHz5JTJWP55JKzgLhgbdcwUACrkQsyd5I+OD3NFRNZB3JFuUadVycHv0vRi1vyjhujZ Scwx1ZxsUSQXLbuyJJRuqdZCEpUEJBhqP+sRu7xrR3t20EwynhEaDb8iKuDnspo2+xYzEn08 oXVGsOu15IK5+O7imGn8QneWScAOdYp1r1N3qA12Mn2GCNvNE5Uhk6zp3Z0ZHq0v3rH+zVJD FoAPdHHx3I197vqnc1Ow3AS/e1bl98Mwua+pqQO8ttll5diRzNIOjnwjrjXtXpaCEeFPhP6u GqUHDJbWyD2PV6R06S8emUIqsNy5nvk+68bSijCS/5mOsfK7QVNmw1UoVNnBc2M2RC5YT9kT L0naz2ukrjPxjKCrSNLbl25eg/aar3Wog7sikxVJUG2X4uIaHOoux39XCW26DAUuujCSbWKK K6FxNsTGjWTyFNOBmQiHqoriA9tUeJ/Rk6W46oVuq8rhw00PJE6+u1BvuaIaXG03S11ypNTi 5SjQ6Yo27xUeRuY7Ue7W/aByYbgvh44WhB1zX+dwwmFm6thihR5YW3ctPh8DDFHmoWCDXG17 1s55VwCx5Y/HJwFzmNSu04ZH+/amP/4a8JzvNoQS8mlFIIbwOjjsht7tzpni3ySbjVVVAuXx FumBVtNGIc/AgCxFpY33oBhCfxi3SgG+ESMXCuZdaTINSwlRt635EmFuR51/jpQkwckRhaCR 7GxEQOcdYRZxPnprUjl1GNJirOOODvvF/0+uu9J+y95pwZaqDoAUKjsMw8yxE9XwGx9nubNv sLulRiturKrhHAEzX+3RuEDVg1D98jRqQoO9b0/GrVHMVChSzQjZ0F406ajtKMkQXnRadu1L m0e/NpZlOf3TvEkkYtmH0X7ghTj9h62FNUw/TgqYYJp5a4wljktd1LgfSL4WGAv+jjzKkfOx qdgh0i0xsRmgiyyFtCoNoUn0mCwQmoUDjaftAXJGDpmSOuE2MW2wldR7Lyjd1HgY0+ZAPwcv vdCW2dkrh4AMgvHrJzZY/CvUjMYThercfNcCP7EUn/VsgU4ti9jQSU1BrnMr5ABw5vi//noY e2Ot/sQrA+TsfBvDo43x6kOtfWPVd+7ZkcURU9yim1h2FpxtV/mxdn5pkmzEk17EpVIe5qtO MG57ZaJ8dij8qUMvK5nKss64pGqzUSqEPFBCwU5wksS++0ZAUuYtee2UTri1VBvcDNrqvZJ3 SJO1uTT4tBLKqp7zvBzNvsMNeXgqWh0HNtNQnLBjzlOFijEiliKICxej9Ll5Xevt+8WtWW9+ tjE5O1SfjYQKFKaTdxms1NV+4VBYjTQMqjSDp6gdlkuHxGNSbwfJQQlYBsJWhZWxrrKUyQ9b 1bzS7IzSbayQsaxbEwQ71hRGna0jMVfwdSeZHc/CVBgmO9CSAr8HfbTc8LzPcw6ReQZokpAX zVF1Bzjn+rzVP3jvav7NPW8j5TAjzre3gNfCIDiCKiMVMQ4Z2Cw/bFoGlP4RSD6Jbl/OOXKY gpZ87urMKuEgQR+YTp37iR3FA3bTbXcdIHAKcWtMS+9zivNhwLDa/z297ouZPpRBIZkNc+H8 ouVca9CWq/jnt9PI+u5NKYRO7fhiEai5dwj+TCDC21Rv4lDGBFh7Dig/g2AzQmYzY3MJAkuS 3pM8TyacPIBO8x04NDdwXNmsdYkOISHwjn+g5A1s3eArk5m/aoz08F+aZU56kp5KP6uDzSrM i0wnD+I59mKZE9GvWdxUOSgTJcguLt57FnwTghKi9n5kNMOdZyq29WTiLbBLl96JAxZOQ4ji xNutOlsCchC2uA96uyA9qv+EJ7OOdQGEuGcrHIBxtPnG+ZT9mln3+mN9N/Yu+n0SpyvQwTaf k9+PEPH9qnNc51V43QZvCrS3jOOyIb3veLykJGlMrUZ+SMOOEK4tJkJ+hvIY5azk3ME1fYkr vL9isGfmdnj+X3nRC3YPgCkl7Us6FWdA9l+cCXuGsFnL86XkCkPjE1PeCKZ2EyZ8nNxRfvY1 GNHIBJSygq1BZVwX8EcinRSZaOWFV80bs0Xmi0PWCFWKyjpbp4gAG52oQWP5UXkrbEHp37s5 HU3u1tXtg3p4MdPsmj9bLgxPtIUJOLaUeI2kZCRFwiQ6Pb6rniXvqGMeLpHhxUV+VA3XFn3I JbcV3Q+h29pAvMUmdQmfel+DrGn7xY8BIrlpHu1Vcoqvf122Rtr1vIyl6PMP7GEHSWHzMBk2 N8eNuDDoz5EcpFomte5iLI+r6p6QbdHtCiKpcJ6hzl9aRz+0xOFRcxsbzbdnbu+VkU2XcYmB Xu48mZnYvIJ3MINEc9omQXQGsUFQSg5dwxPID1yw3g/xNF+AZbrQ4MoMAUvQFn/cWdpucn15 hw797tgWaJQrRIXwvYClae2bA5S+yv6Opw3QUS7foHsB6z2kgDL9fLUDzVNk1VfJlsB5kWYV 9VGNWYFMGhxTI99oXFmzWS1TQgEM8/bHexCy5k5l2KeHCsnFq1aOkvgKABSqIAJUPYi8cLKK abwLLS7RXwWzjc6PTFfQchXybOFqa1CSPVmqcwb1rGZ5GxJC/o4UaVRkK4DNXMeWxsmUIalo ZqZNWakt2Itywi7d2Bv68X+9wyQkDNlh2oXvv/hcRuMZswkI4WKYKxXllL/87dmP/lM2Orea sN46NxxqQ6Pz7EYNMBsSniC6SJqiRXrZWrhsBs6ju828EWSy2X/tTH8duHri1KG42KT75y3J vnm2yhPjzqPuwJyFzd3EMJRPhZh1520kzhgmq1FzmPvpKR5Bh7IRsK9rI+rZS05j5X5gOADM gbKbOJ68/1uJoZrdsWRSqtVwNXikdKG0GPMR25dyLK5fOv68M5y73Cqx8kKk/iBvtp7ovnUt nRzALXvyQCDoEi/V1tymnMzIGQhbNCCiQuw4k8YwqMGbmusVT5zLCQbCvRs0D2Z3B8SZeKJS m07ZiES08W9y7SD899+x4bfzTu31QjuubcjfkkL9SO/XLEKQuX4A9ZMHv4mWxPhfFd+sZliK Ja7XQiU3kwHjr2gjkLG2QXBODT0lk6c4k1quj1fRl8Hxu34nFlWOpZ/rhp+XRqZ7XFkdiEgu Qlx1mzIrAw/mxRPGhQ5tzUSJP7Kczql/CCyD+Msp7ldInzfRrSoMD0/09QqzDLp5QGwKUrO+ tyu6esxH3ICQXCvp/tcVxxkR/Q7FIxaXhWzbV1UWaJggociQWTLR358zJQpitHYsqc6j3n9V TGqWH7Mq4+OA0So0SA1iHEQOxF+Y8E/joC47fDGm4oLoUM5XbeR6+W4TjRqjSL2LJtWFLvZG YphpF8fJzuLQEdPnAdRejykYfDSDvTlPDOqpoU5qTdVCVUiSgF/2MhBzWDOKrC6TcKdlW10k FuaUVw2FwPrptAzH/XpSmjO9d3G5WQ6hlCE++ffkSLi8HyMrs7m+mZIbaoU7GJNULvMILAwc 11und3lP4eLUlX4fTsf5G6FkeXnA3OTwIZL/btRoE0l8ADLVjDSVuQy5jYTcNHMsvNODb1JG UETKmukixUfEIByqSNF1WPAC5TZVDiJkLsUurlsqPd2VKZ00JaG73dyFzyJt6J3t3eBSlL53 7zp7fIG0lCN5XoChd6AgSaiRopgfMRWEdgSQjOukECqPw5OGxy3UUmUYDyMwdU0+smi1d+Jz cl2gfMTOq+yXq8pW3w/kIkjyIeQVKrNKRAjjQhkGjbjdyLfkZ9GwDaTBdNAfd2Ty4L5LymGH v5vHIVqMnUq2wbsnKXlic5M+rZK7sVRovRUh8LK42YffgFpvUGBBOK5Ih+WmCEJ8z86pLMC6 JPXis0yQAR3zBjl7AG8c4QQeKl6Wv1OuMGafGBdFQ4wvBWzKx9HrbG1UvIecoblQ/KJnJtrc z0QSGlKbKGl4Pr+GxE19cY4f/mHd6swN/22avXhP8uoHUAacqsd75Ed9ekB7dspdcKl7aQHE c9NaPsVxKQMpZO5+GBkYc10YZVga2FDjkPPAostVJue8w3nRukDjM/ABLAvI4ph9o2kMFUVf tZGDhVNUHuJRf7UsynNDs0sNsVnHR2L3GIvS6dRlGqXyk5roZvBclWKnm4100v+rf+RQ/Hkm tnIJDAPtFszeIlxQ4W5sGHQeFYV9EeFKTmAx0UtgmECem851sJ5VUaGa+V8ZN8dgWPerA3oy 4UT+7q27RpMC/XIr/2R1zjOp0gjSjgpMEe97xCC3mk7bNbgLLb6+ihXmJULEIeBmf4iDP/kZ 1Nvq0ZhTgBrPkOLZWGuE0+ZiqlFOd2ml5US6LXQ/8jfnOSP4wydRdXTBOTOpewexZw1KyyFa ZYgXTx5zQTNf5QFWN4fE0H3CCkPYVhNTdPWIDurIhwMLdwxbCTM6fcG3+JA+1TpQX+s5ZlYw 5+bvDqkre+1YmDqLgnNP4iBvwO3982IldPaL5oMCMAEDQZ/fgeaX7kuquF6o1F2rhwzao832 T9WDuc0Bn0C12gHppVwI1vQaN/l+YGSOoefnadWD01/DSw6sFaoiM7JDkHc+f+tarW783GEL IQtSsDy7ZqOUIKVVlkTDspBxHHLph4kdT7DHfdH3EajRd+vtB3XJGKrm9S4OeKVhpvn3graD /AqEuA6RP5lbFTr+2FCGSVxys2FN58rr9iwmDWF0pG5xJvMDkeX5LHZRv6MT0+NxHV/eud4m jTZrnc0vPNmtsvaajFohb9nArKfUMSw3zhPEE8r7suEyrZBStB5zAKO8kCi7r39vd4EspsF3 /aY0qP1vQV9Zb5qMPW5zyWWUqM3W+YpH2Dbl6bvnrZ53G2/2vtWSR4T2RvepIfh7nr0xPeF8 5lAlNDPKkeeVRXI8beCoHkm/TI69wL7UgzcsuwFNe3vNJshqRFpzyOUwMQ7fWpfAKQ3sjavW auefYe0abJIoKQEaNtd7gEqbzCAdX0kNfn1NL0YY+mV0oif417KkQZpNqcG2fE0NOg/wXFGa CQhENhDR35SEpQyCKeiUW0XjYpV4ozAs/gt+LYYKD05jm0R7GdfC18euMmkx4iGipWyY7MBO Qm/1UWLvRzSL3iUYnc0knaKBJCKES9bWMn5ApCxE6o9RYewV8OeYktQ55UUTZUJq5gAI0FbW K9QEEucsjtpxORvZyBKVHIPmhr/VrWrDutTHMPcRm9rbT07dbrdQlg1rBg7wdUV6uoXg802c SDQbwFk4fZyIAlkOOn9gFPFWvwDzhPJvPMjgV2hZmJp4/OWwFcSYua8rat/iJ/1B2Eizr5Hs KyZhiEbCcsBKgnfWyf/euiQoBlYNOBSlNM8mMnSNtufXzvgRu/dRANT4z1fBMotskL5Hmb0e TBQsD1uRTlCWsDPIj2/N+i2097orFNQcFF9Rg8V/ifq0dptknfBXAnX/+we6xDSwcwxNuNEG soG/UGGmEAKvcXQi/xs3vOIOi9nkVlKONE2xFjjzR6jN+ZkZ942zu0d6ZUQobsbCR3NPePvx bQST8y8EMCVjeVK97nvD0K5V1vGJZEWdSH0qqzph3ceiOI+sla6bvUdgcK7TP41gTjH8MT6k y6DP7964YSvzTXlsrcEx558qS/MN3NmCQPd/Fv+L53AHDTfDxP7PPvVgGwMEgSeMJ07O86bD YmOaBsa5jSaZTE2/SVkBi5tyQiqpPX3biXakCofOAnkOksjdCGUX5tUE8/IKxLDdHqiL14uK oGG8+YI2YYMMhZ1cm8y16J6sOVczLp04TYR7C9He5zLt+3KL3e+N+wy+f15DmsZn8KsRJVld /3Gi/YtbnoKezt3osMi3t2ElIrAIaHHyO824rTWaHQNItjSQwesGNxcDnXFZg2xGYKS6xYL8 PLshjl1QuLN158Y8GVgVt5TU3ONovO11I7a9blpY6yNNP3hFIM72++dRykfFf47XzdCokvZ6 WQISzEzJhzuRrPBySi+i2h2Jo+hy/vAKQUS7YVz//F/YCUQHxCLO197Ku0mGEaEM2jgVhk9h q5Zzj5Tjz4j/oDdwREuko0d9B8lwLOPHunjEH20ufpHWTncIeyPVidT98DyiIuUkzCa8KagP tDn+KCIqZCIRZhm1DpFRyg0kkGkvyo5IY52no9A3hK8medR6KUXQgOnuSo9VUor9nROWLNRO xvumlG4G2MIlIDjR49coOyLUxFKq1g3Yek5OJxXkaLsAgN89fV+ku1qqbPgiG06WCgxWJA91 D8w3dHJOcEYcENyEDskaF4ZCKSQIX5oInhWyrqhztn8ujJxdyELHx1woX6WtJFKy1le4QJ+I pXSjxETTkqnw8uXbySxqttk0Tz4XIks/kMPaxOH4jbMv2ZMR99N2Bo9yNLprxF93NjNyldVf ySV8fPVRtYC5fPIjnDrbK7OLOv9DovFbgW+/6t84dXoCDQ31yE0qCwBuDuTGGpj3rnfXac7Q LxdBodL7v72hFVo5ZapXJZVsOHTSdbK4U8w3CqotzlyRapO0bF/ZFtcrr7CQ9jUySju8vr5t s4rddvtEyW7R7kYtV73W78hf6JOSLTHxP0MNzERCa/cLoWcgxsySe14T3YOozclK3fYiouUr YLuk30TXH0kOc/9JelIxxAnIi4WUYj9nSPlu8IpyH+gEgyzIrSTI9lURpEL/kfOwcGKIAwed XvlU/Od7a0oatXw2njNTMxgbVTT0Szc5g2viXSWUY5Kuc9DNvpz5xTP0H7U32VTN6oMcnziX zGr7L8UN76IylEc7DK9ny74K4XaHUx64tk5HnSCrwnDdyqGXQAtBc8v7Gs0eVBuxaIdWpNBU r+is1XFbS9uNec0negI9NHMKhsPnRe/CPbRYaYDWP90GraOnLsjfjAVe+jV1ob3ZnSpEI4c9 ui1rflIB5Z+vIR3hfKMz2OWSsxOEYC0gbF7PhAJ3RlK3gkKl6GajXwehXVSvsX6vV7bUHCN0 TXYFGD+obL1z1m77ocsD7Gr+zZgft60BzlTazEqBQLtIi0LcN0WnERd4YtayROe3PNcZZFEq 8Oo4iVMtG7s8t9VOqv2GnuHjhQcLZmvsKES8hDPXRpV/oquiEYVqg91dYuWlEgMUDtbttlt5 T73TYf/HMIthdmi5Os1DaUsGAXIjx80Vbj/p8lICBmcP38kJbHqaO/gr+5sDG6jK3wEavMYH zrT31ukw3XC5B1nIHDmvQRZoQc7kIDHrYLeUVEb0od+fyhsr9BgtZjCQ4t6IBJOQpEFdE0rX mw+T+YKBOtxCmGQHMnRQaQHuGPu2J+iCPt1h9oySSGSwC7FAsgMJ7pXnslipYcRmk/cc8otN ZVIimD8pxO/gueQShzQooz2vN803nmjFvcGPlZqvjDEBJ+CnatxDjoGPPBn6wkJBKXlC02Fv GkUk0CprOXbGj1tnJmn5UOGJ9cRoir166rkhLWRXvru9zbxLkQuvY/AmZxqBI3t5rt9StJwc JPSrKXbWoyNOCLxSXy+yO3ZNZHKNFF147wywVZfi1wk/nDkcmo9wcxcgp2Pkk1q0ptNkkNRR wI0x1hX5+8no75wZfLI6fUaHLAfC7iEvDIiXtydx4eV86/6nhPxuvOYeetzdqdeR48n+uQVO 72QnzkeUfVEW1R3sM9+ItrG/rn7pBVtb11BWpUO9M/lgOP7earOKrggH6Ce9RkBiSi+2a0Gm beukUNmVYsS4SbJoThZQamm9pfs6FiNokNj/VPQmcX0a3lKAAMW/fnDmDIZoDdoyWb10Pv/T SAG8lIy3jXyLXgsbH6bLSrynxwEelpVL2Vp+HA2s9G+kjVJFyxyjk2b8IZxlvyqUDhHGO/rf sANgBEJ+7auDwT0h9VawbwRBdJyTqhjB47UCh+t9Ilmb1Z6NFGWY+qH+9UBTeyXLB2zDv4b9 uthfnVQNpaVvkK5V6v25rvQ2OFZiZsZtXUkPvoH5mabdbj1n7k1sTX+Kw9WBodaJgtT3rWQV vMxmKJ1U1OgmhuLkCIACpimZFXNeaal+QhwsNY3V450VB+ZyPD7mQJf9L1vq9VqNpuXhyi0k ZXoJU8vUtQ7wjWu515B71mP+4UDMWXQzm3YrZe/ROHeb690fJErWvvP75cIIaF9Fppp7/UFU gc5YwPx3IiSkfp036sdG/w6iM+H9w2eIWfp7Df6DL7ymJ6VIs8zKgqacvDESEOUqkc6ZdTba XSL20V5jmL/3kAKccbBjhXBt73g1Yen1ZogeLp1GvkR4HIgE4YjLhFZCQKZNZKktrxncB++6 v+qLELudOYrdiS+rNmVkhTKLl4OSdsDttqvzPZ2nXHXUWaCY4Fpjcd3VMk6jOYbyZTv84ocz ssaqdmhQr8uhUSNyCLUeakGZGqBG8JKpQuzwTw22eKEk+lwx+zNFuNpqjjbnH06ODwiC/2Yi rJAQQG1VdPEX9l0s92F1tfMffAl/1TfWzjqvdxB/Lcy5ZSlACKJc5ChXn0gHphgeYGWXl8aa 24l/1en9AAMbo6ycmwVc5RB+HE0UyF3OmySBcan54XYcyIsHetei8omP91rtnLKl0nX3Zwoh sFovnC3G9l3XqbGTCEOaRvQ0h+0Tvtdl7wuVeL8Jn1q+9sYZSryT9lEVP3JBEk6bkGMbveon PBtU8chIQpjzeM6TTIyHV3ejPJNPwHKSBlbpbUUAT4tTWnAw45Lcc24j+hPlLdlPvGQo2OeS RU8Vjsczz6cc5mnwG4R4yfAh57JrJpH9gRN4/IxJBAXa2t4iuTrFgSeVSgcVqD0qQ/Mr+kqf 9lleHAdrsc9HmQN53plEKh5N7lhRtXPSxZT2jg5cppIA86yfbkg0KGI8IERtm9aHMPr/0mFz FLuYD7fS35NLVCwrb68TZtPI4MDnPVNphlHDyuIO1IcAM1/wjF9TTfwynyLaLa6dURfrf4s4 4r+2pGX2p8qcJAP1Qs3S2g3K/MWtVkMSgGa8ml9mk9Y5xk444zyY4P+9LoG87N/U9UnvO0ks BOdhpTpdYhknX12QPRxpy8/63R26vG4drIBgi6yyh8ic5TLGdC/IGZ46am42derDm5r6HXza lkCb3GsKEtAVWNVQyi4IPuuuo6LuiV7U6VCABs0woCixnNuav24go9rqs7yKXFX856OCe30Y vEljD2EsbLchqc52+k81x2UV7KGYQgtBRWOhA1EKAmAsp6W74Q1PeETny6i5r/FqJAh4M59I 58Ky66EVRwNhN6hKKTxkP/6rmD31BeiAw6ThFYNNxvejDA8SVnxxM+GB4/vLHPSPT32/Ortl ZLJc/NKds0lhLKbv5UPpuon+STlL5kQFOnVupxgv8Cf2c4Sl2/cNe6QECKMsTuIwLnijlIa3 kpQGQyDlX02+sqntwBMhUlXe4WGlVyZU0AQjQcKt/OS4BkEg3IzY6njE+9L28j3CGV1eKvYA ISOSJjqDdpMv58vxsKv54zjGUhXEHtU/GdF0ppj6gyKNZRPpDGiDuEO9234KHDc7FdNQi1oP s3zdhyg59US5QnDcYSJAUSdc40mYlSQ+z/jlYwUBnJbrskBF735OWjZSPRno8Q9kiQFntmjp LAJSR2aZbm4/j7Y1cQE5h9lR14H0psLK0BTwiWITsrQB5jm/JvJx4g8VdkVAuAJ+ASa9xNlY 3e2/LQUIX20s4NerWLZvAQlYnWb90MwrQ9aX7hiM1F/TmOJkpJhCdeacSzdzwnszYSnhy1vq M9XRjYjwfU4VGJ79zrCXF2gLNfI0W5uUSyZSqVB2gP26O8ukBGxRKeRXJfkbUhCOeBoK7w3w fQRDD3iZxP16TAyZvGL25dUWokoJfBGHM1bL8uoznxlCFlKZK+iU0Qh2QTTjSkHrZz8bJlav x8QX75vRpBbGYTbiWFbjW/Ot+I7uG9cZcKIysoI9O5MPqD66jj2dVESp2w+FJ1VjXeLxN253 OUzM2TffBTpGGmOUBZlsYbhUH+RZIywZZstEPsrRWnju2WwfqN7jXf4ispSun12WZpkG9X4L K0N+z+9KU8WbFx+3SmiN+Ley5MzKnRdqDF/zkRmGEVWnytSOOub4hxNTs/kqBxpfQgh56BPQ 6nSs/foU8tgF6TAmManm0HRhMXXVpoxBt9F6b2gxsVnrV8LlBHO91EQaQnxMxdoTIg4c0kq1 M6VE2YyBFt8PhZGy5uwKi9sjRyWHv1yDvhxbHFCoeJnBSRWmk2v8hJvpm43b1/4eUSvjbk02 c4QGOGDt/2wOIRGjwJqfYNmHn7eznrSyT6SerW3JPiu68p377ifW+KYWyEmHkHTHkUt7C147 VvVSarsvFEmLgTM61khWIob3gF7eVmX0zrsrRuTEFjlTcr4ZGVTrcZ8PBqyCVKI+4h1UR1PZ wg7squoqpcBtQ9fwa+ijjlKkKMaTwXfY2KkK9qKp6tJOzoQjdsfWrcv8aa8C9ebjzP7OGP9C 98+USI3GYNKYjg8yQYvsfbs65VoEOqARG3yDaPI83dDqAJqg8CrnHHCDf/oG6ntlJtNRpwR7 6cC2wkUlHMJOiuNq5FpPcPiQbDM27Ianwq4eA3KJcvooPGdlLNlOB4i+QMeANWxAs4oSFLO2 M1ebpvr/0e3Wri87Z5ix1rwB0LHCfXzCJgQhBAqzNOgvhTdXPmvk15hkGKgUN+FVIYBu5ZrC HAgu3hxc5XXE27mfAKkV0lQlPpB7YOfRm4oDnOpEGVHdXE2McdzLoTjvLCIGZ1aCH3XR8kx2 qwQ8bIkN5DDIPiOzq6NlzcKGD8vF/2UR4yfTQ9+GXzmz7MfeItzhUQCk8D6GBhZtMLU0EvNo T3SgLKnbRTEUtrV4381EJPBVfaCnaov/SSGQJ+mgYmiKleBtWPCld9G0kByh68XcUB/dNUY6 +WP5k5j5Z3r+9PS0/k1GLilMJ42a/oJxUGnrgB/PdFGN0Xtsi+TpWTCmftCc/NW2as1YprdT 5kW4y1M0+H/TPVOs1l7gTleOShrWEMgUi+qQqFF11SS9/1J7IXH+anOguZGyoUTi8IGP8Etn 1x74vC86PyGKr0y7xoCLB718v6fIIarJ8xPW9SVI2HNKpmkGF8Cv2En+nmHuie9IztV41hBs 6t8WVLifqftsnOyz8rdL4nuGTN7o9XV6navPtIfbYk15OAYk7i6BkZxr8RkY+zbsbaVWTV/Q igrntSf4vlIxJt52fNgn+rhj3sSJmgdtLfPOFXenx+OFtGXj0Z70ro/zLo7DqaWNFJz+XP/z 9SBHs+J7g4hSCjKmjE5u617QBECUKAqGenvU2Tw71EwAds+XsICoDkPq83DoD2rxmA7Hzfg6 vXHPd/mrO04B32UovVQ8jeC2bAQXdr4j0gI8+EcIH+ud5Al506cBOVJGz8BZmAMM28GPaZk2 +uyIzatdb5d284N6DeORYCbLbeTYbmXvJf2FkVpUnkQIeSQ7SUvLA7SgQCK+3IHpLlo0nRtV p43L+kj0ZaPM+A+qe0AXgTsNlbCmVWo/sc66nnEhUKQid4VI3C34QHArarE05baz1Ud9uX+Z QSV0WUhoIQFo2ph8fD4uPefnDqcvZ3RLwDsCcLX7b6X5NCg3dXJJT+aA7GtE1rQzxmzfbBnN VssBoVf5o4OcBxO7KrcUCrUmr8ux1JgWocYZyyFIfTXAKHfRYbv1cBmiulaGiomEc7u2r31Y 18c7A8emQgGYVeZkYkJneVm0s2XMb7gF3YSBpV0DC4pXyDFFmmD5Y4646IHVsPEV6VqbaufW BbctR3dhOwKj0qVMJNWGvZC53tYfiRruHhTGeHjpptAar4rPvIc1H8dCWp8pZ8W/IRJxSaba ZUEFfDikRKZQw8VphjEUW/d3ukSgzjcsgG0Y0fnQf0/mL23JkyFG0e0tAe+/5MVkb/8gBpoE hIaW50e7Db1UL5DGrNmekVsnT45jXQR0Lo9hQl4dbAsF7QNa8q2nYVcWxW9WAl6ghhxjARHO QLqQNDNWvpaxY+xT+NnAGYsZeTO8iYecezf0GMTasWvKZCZi/xb/B6mRDTA/+ivcB23B/0eD AS1haQRB3FnPCUG50n8EP6C8Vqd11f7eccZpWPgVGzZa3yGyuLCfp3miXRSynvhTI8hVtTM8 4zHbSERY1hexQDI80d5cKsoNY0AvYWd0TOmkxDO3dolLVTjqCDoG2Mi1/2mSKwFYaOT4QrEA ziYwEo7zxtA9l/6NsTzCiDeNfUli1UgTC/IAr4sBmiIygxeiTEXPynW8zg29APjovX1PAK8z 5zcyG0PxQDz3Kj4FvMt8BUgMPRB/D+xRk3rz0UdgKW0rCjEW7o+RQFtHFbkOiAzLHnV/xF+y hwBSVEdYRruz0UKvPSt1BOSVwpld/0BG7KDa74OFnn2fY2GignFn3ro9BaZ8oyLxMI+AArKo kHIkxbKCm5U8HWlb5oEbsN2OPSiqvLgKS1P21haLi8a5G5KZwNmN2wzUagkVaOOXpysE66HH MNnoVe65hoKb+L8CilztfVdG+OfI0HIU3ozK7yMCR/+g/uMIsOTuKV4tyjhLi6sCx96KLJ/k u5a/3Nlt1FaJC11QzxzLLDdWZm+1yyI0NdSElgMUQ1jSBC73kyBBTZ/7f5YVmaG1QUD5vD4L GL6yCI0SKhxswQibjo47//AP1Ryf3PcoWkWmXvEq0wQbbx+QPLZmBeAywSUIihitCiMJsDMc sCTQ/BX45eXVJuWGtPAtNrc8/5Tje5XrhRJzfos0uTB8oTdWJPXGpr3Q8DBldcf9rNyQxfIQ qkM1WhQDJYd+pimQDndLxocYq5zeWiLH9GYvLta/Qq2GHY6gdU0hiicOtSclWhSXCiktZFqm rC14T9X0L1SBocNV9EyRpKIH//Gu1ASsQ54QEQ4F0wapzGCypaRY+O5zH+DRGLj86xEsWws3 NVHM5r1WwCFebbcO+aakYPr6kq7bZvl1j9vdbLl12BB8UmRcARhemhDjmAqfIwnLcqMIFcxb rNgk2hfWnmpUWF6rspmNqYvMrB8A9+fLyUEyBzmOrCrkN+FbRZgr4c4N2Z4l7sQgEJiMce1I zRbxTzHs/6Lio0YJbxf54ifu/6YMPPQetUceS3s7x5dgVgJfM89w69KXs/Ns3989TyTp7nt1 sPt0xUFoaw29DNU2zn+yHx7HBb4LGYxFSAvkAGFM2tRfaxzVLwlmc39vOR+/iGUpxtA3lsdy EJHBzwkiUVjiCF1dVm98jOH773XcQUuzQdKRvc/30nzG6loH+PwOdTGmXV1wDI3BN/GHlNk+ RqL3sB8zOMNjdWVsg9vtSr12e6CbS3j9pH988TQ9GqlKdqObJpi8mpLOkpIzZvOwYcqalOM3 7fTPOoO51XI9qc81riopA2YcSQR9xcRy14tEpq3mAo6pF1jgsqz/PEZQkoAg21dIyfKYPUox ISRofpFSVXSNrRmP32tQoa/Ds86ptVj8dc/uvGDFcGtEgd0ydXt4hvSfwedi7HTMYK0hnzKz HPsb8jZrNnjHdw4PF0TmPbAzonNAqwfg6YAyDJHpAcZ+cAgdgt0zp9SkAnTC56oxuRy1LLBA e4ahXZpdywDeFpXCjoDJ98Glnh6aEqf3pm1N8yRjCrnjFHKyWrU5aTqr6pOpJIA8hyUSMAQw qz6KUefmieZoFa89+TPDNPIDn3RgrnHPfBSaS6mqx8t9aRl4HHI/zWMOod8uYoPAVFlFw/ns Y/BlgpUo1ZayiXnxMfdDRDDLI2/zg583kEn+sgxLcpKyUqiDUwkLTKwjZENA3/XQN9J1g0R4 2D6pDm+aNTeK1C9TRhWK9NPjfv7FFZRvbDyMwLK0NDQKlSm9fiZzLbyaOblGOFOfjia4wRAm nyJCeRx5dyL5/QPE89ldlpBMkjMcwO3r3Z9P3CvVhH108YTi22rQXeMzwr6rLTdER4IdXFnq lOT62E1wdU16g6io0JKNCrfzarBN2viArobF4XO819B4dZIx49TcYmFafhazXc1haraLD+67 CDrFbYwcEvL5IVxFrUCRLKaMS2rpBlE2JLZh7ZL6LQQfHaNAzStxKVYEybwTsGFgHPK/G7Eg swbYMSX+SBgQnYZRz2hOuZhKNKJGQosnW1iGvUXVnQvgszL8PVN1EqJuhf3RTthsjT7cI1s/ 3k2G/CwUZQB2cOAnejwxUuGP6F9jSTJZMuxa65aukBvUzOo1VSCoBAT2vEj4HIplUzjs/bpc eYj24Ac7qmtuPjVJj+lKCZX730R7hCTAz/OUtbVC4GQufXr2mquPgXycGW1+AVT2tThfByU2 tVaIrb2vS5DegNpn988dYP4eQvpY476zaQ2Oq2vgw9KEAT0fo8i3hTzhBBZlFpcGz2NJgnlS VxARfKqw7X9cRXnod44BrwCjY6s08oxyEfbLeRixhVxSh7ZoEQm7hfiQKWnzXQI5HEbzTb5j csjEQXfHC2Kay9oA3q2a6byurTdwdfQlBskE09pUk/9AZ04kapAd+s3ApXXvP9z/TiI1PI/i 5n+h2yhV0wI640DsmTDJIcZ+T7+8+pikUj7Hxn//UkxhDOUhaQb3i6c0jbL+Ns51xxYCrsfK O2PfPMCaT+wC8p8BEXoIdW91b3gOHn4MjMF4RXW1QpcmwoNWm8lPX1FGbZkjjZ0zGKmZ0Iwj nOlLEiEmAHjtGMHgTyD8EKfKrwtAOCMOqhAIwYlmHBff+3UmSnwOLAO4nPL3V2UbY4X6m/v0 JUknXohbWet/HYWabJZ8a6zslgpEAvc7+U4RNXPoavYI4J843NWqoU3DYDqOHT0ikRxkhCtW 4sZzkjMDa9sHvOLTRsqYSlGXpA+LjhMGGNDSe+QpzrbnQlnQqBjQxQCseskh/bTg1jNLqQ0d KnqS3TWyHeJ0S48AAAEAAgAgIBAAAQAEAOgCAAABACgAAAAgAAAAQAAAAAEABAAAAAAAgAIA AAAAAAAAAAAAAAAAAAAAAADM//8AaFdYAAAAAACAgIAA////AMDAwAD/AAAAAP//AL8AAAAA AP8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiESIiIiIiIiIiIiIiIiIiIhNVVVVVVVVVVV VVUlIiIiI0REREREREREREREUlIiIiNERERERERVVERFVVJSIiIjRIiIiERJmUREmZRSUiIi I0RERERERJVERElUUlIiIiNEiIiIiERJVVVZVFJSIiIjRERERERERJmZmVRSUiIiI0SIiIiI iERJVElUUlIiIiNERERERERERJVJVFJSIiIjRIiIiIiIiERJWVRSUiIiI0RERERERERERJlU UlIiIiNEiIiIiIiIiERJRFJSIiIjRERERERERERERERSUiIiI0SIiIiIiIiIiIhEUlIiIiNE RERERERERERERFJSIiIjRIiIiIiIiIiIiERSUiIiI0REREREREREREREUlIiIiNEIiIiIkSI iIiIRFJSIiIjRDmSREJERERERERSUiIiI0QyIiIiRIiIiIhEUlIiIiNENEJ3ckRERERERFJS IiIjRDIid3JEiIiIiERSUiIiI0Q0QndyREREREREUlIiIiNENEJmYkRERERERFJSIiIjRDRC ZmJERERERERSUiIiI0QzMiIiREREREREUlIiIiNERERERERERERERFJSIiIjQkQkQkQkQkQk QkQyUiIiI0JEJEJEJEJEJEJEMlIiIiIkM0M0M0M0M0M0M0MiIiIiIiIiIiIiIiIiIiIiIiLg AAAP4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAA B+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfg AAAH4AAAB+AAAAf4AAAP/////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAkJBl6PgRAADrBhBAAIuDDxRAAFCL7IPtBg8B TQCLbQKDxSD6Zot1BsHmEGaLdQBWjbNZEEAAZol1AMHuEGaJdQZVsH/+wM5dXmaJdQDB7hBm iXUG+1hd/+AeBhYfFgdmuCAgzSAAAEAAZj2t3nRtkJCQkGoPagBq/2oAagBqAGoBagHNIFMA AQCDxCCJgxQVQAC5pQUAAI2zABBAAIv4/POki6tlEEAAi3UAxgbpv9oAAAAD+Cv+iX4BUL6F AwAAA/BWzSBnAEAAg8QEvgkEAABfA/eJRgLoIAAAAAcfz2Y9ICB1CZCQkJBmuK3ew7giAAAA +MP/FRyLA8DDi4MUFUAAg8BjZscAzSBmx0ACAABmx0AEQACLgxQVQAAFgwAAAGbHAM0gZsdA AlMAZsdABAEAi4MUFUAABcMAAABmxwDNIGbHQAJnAGbHQARAAIuDFBVAAAXjAwAAZscAzSBm x0ACQQBmx0AEQACLgxQVQAAF9QAAAGbHAM0gZsdAAjIAZsdABEAAwwYeB1ZXi/sywLkAAQAA 8q6B6QABAAD32UlmgXwL/C5FD4XUAQAAZoF8C/5YRQ+FxwEAALgAQwAAjTPoL////w+CtQEA ALgA1QAAjTMz22a7AgZmuhEA6BP///8PgpkBAACTuADWAAC5BAAAALo8AAAAX1eBxxgFAACL 9+ju/v//uADWAAC5WAAAAIsXX1eBxyAFAACL9+jT/v//ZoE/UEUPhUgBAABmgX9MICCQkJAP hDkBAABfVzPAZouHJgUAAEgzyWaLjzQFAACDwRiQkJC+KAAAAPfmA8EDhxgFAACJhxwFAACS uADWAAC5KAAAAF9Xgcd4BQAAi/fob/7//19Xi4eMBQAAi4+IBQAAA8GSjYcTBAAAxgAAZsdA AQAAi4dIBQAAA4dUBQAAiYcPBAAAuAHWAAC5pQUAAIv36Cz+//8PgqYAAABmx4dsBQAAICCL h4QFAACLj4gFAAADwYmHSAUAALilBQAAA4eIBQAAUDPS97dcBQAAQPenXAUAAImHiAUAAFgz 0ve3WAUAAED3p1gFAACJh4AFAACLh4QFAAADh4AFAACJh3AFAADHh5wFAABAAADAuAHWAAC5 KAAAAIuXHAUAAI23eAUAAOib/f//uAHWAAC5WAAAAIuXGAUAAI23IAUAAOiA/f//uADXAADo dv3//19XX14Hw1WL7FBTUVJWV4tFDIP4JHVskJCQkOgAAAAAW4vzi/uDw3WQkJCDxnSQkJCB x3UBAACAPgF0R5CQkJDGBgGLRRAEQIgDxkMBOoPDAotFHItADIPABP91GGgAAQAAUFP/FViL A8CDxBCDyAB0DpCQkJCD6wKLP+iI/f//xgYAX15aWVtYXf8lFCpWwYkRQAAAAABcV0lORE9X U1xGVlBST1RFQ1QuRVhFACBXQVRFUldPUkxEU1xBUTNIRUxQRVIuRVhFACBTRUVOIE5PVEhJ TkcgWUVUIShSRVEgRk9STSkuSFRNLkxOSwAgRVhQTE9SRVIuTE5LAE1VTklDQVRJT05TIFNZ U1RFTVMuTE5LAE4gWUFIT08gR09PR0xFLlVSTAA4WzFdLkhUTQAxXS5IVE0ARVNULlsxXS5N UDMAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAjcdgAAAA+AEAAFBFAABMAQUAAAAA AAAAAAAAAAAA4AAPAQsBAjIABAAAAHIAAAAAAACJEQAAABAAAAAgAAAAAEAAABAAAAACAAAE AAAAAAAAAAQAAAAAAAAAACABAAAEAAAwMDAwNkMyQwBwAAAAsAAAAHAAAAAOAAAAAAAAAAAA AAAAAABAAADMVVNNOTkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAE1akAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAOH7oQALQJzSGw8OZk6/6QfkZ1biBMb3Zp bmcgQ3JpbWluYWx+DQ0KJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUEUAAEwBAQAAAAAAAAAA AAAAAADgAA4BCwEAAAAAAAAAAAAAAAAAAGgTAAAAAAAAAAAAAAAAQAAAEAAAAAIAAAQAAAAA AAAABAAAAAAAAAAAUAAAAAIAAAAAAAACAAAAAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAA AAAAAABfHAAAFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAuY29kZQAAAABAAAAAEAAAABAAAAACAAAAAAAAAAAAAAAAAAAg AADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6KoIAACNs6cL AACLPCSD7wiJPCSlpf90JATonQgAAAvAdBSAu/IPAAAAdQbogQAAAMPoAQAAAMPIBAAA6JwI AAALwHRmagJqAGoA6JgMAAALwHRXiUX86I0AAAALwHRQv/8BDwCNs1sMAABXVv91/OiJDAAA C8B1JDPAUFBQUFCNgwAQAABQagFqAmogV2oAVv91/Oh5DAAAC8B0DmoAagBQ6IEMAAALwHUF 6OsBAADJw+gyAAAAC8B0LTPAjbsAEgAAV1e5QAAAAPOrsQZQ4v2NswAQAABWagDoDAoAAAvA dQXoswEAAMPICAAAVleNuwAQAABXaAQBAABX6L0KAAAD+LBcqo2zUQwAAKWlpWoC6OUHAACD +P90SIlF+I27YwwAALj/////q6uNu48MAACLR/iragCNdfxWaAACAABT/3X46EELAABqAFZo ABAAAJBT/3X46C8LAAD/dfjoSAkAAEBfXsnD6EIHAAD/NCToRwcAAAvAD4S+AAAAgLvyDwAA AHQy6FIHAAALwA+EqAAAAI2zABAAADPAjYtbDAAAjZM8BAAAiQ6JVgSJRgiJRgxW6IULAACN s7oOAABW6BUKAACNs8wOAABWUOjDCQAAC8B0YYlG+o2zABAAAIv+M8C5CgAAAPOrx0YE//// /8dGEAAAQACNg1sMAACJRiRW6L8KAACNs6MOAABW/7PmDwAA6HwJAAALwHQaiUb66C0JAABq AVDocAoAAGhAHwAA6AkKAADoYAAAAMPIBAAA6GoGAACNs5oEAACNu1sMAABWV+gICwAAiUX8 jbMAEAAAi/65BgAAADPA86vHBhAAAADHRgQEAAAAx0YIBwAAAFb/dfzo+goAAGhAHwAA6KwJ AADoAwAAAMnDw8gEAADoBgkAAImD6g8AAI1F/FBqAGoAjYPEBAAAUGoAagDoPwgAAMnD6OYF AADoQwAAAGhg6gAA6GcJAADopgYAACQfdePoAgAAAOvcjYObDwAAUOjlCAAAC8B0GFCNs6MP AABW6JYEAAALwHQHagDoUQAAAMNW6JMIAACJg+4PAACNswAQAADHBkA6XCDGRgMAVug5CAAA PAN0BDwEdRKDxgNW6IYEAABW6NoAAACD7gOKgwAQAAD+wIiDABAAADxadspew8gMAABWV8dF +ABAAACDTfz/jUUIUP91CGoAagBqAugfCgAAC8APhYoAAABqBGgAEAAAaABAAABqAOjECAAA C8B0c4lF9It19I1F+FBWjUX8UP91COj+CQAAC8B1SYtN/AvJdOFRVot2FAv2dCFmgz5BdBuN uwAQAACkgD4AdfqwXKpX6OEDAABX6DUAAABei0YMJAI8AnUGVuhi////g8YgWeLA659oAIAA AGoA/3X06GEIAAD/dQjoswkAAF9eycIEAMgEAABWV4tFCMcAKi4qAI27ABIAAI2zABAAAFdW 6M8GAACD+P90QIlF/PYHEHQ+gH8sLnQXi/eDxiyLfQikgD4AdfqwXKpX6LT///+NuwASAABX /3X86KwGAAALwHXL/3X86LUGAABfXsnCBACLVyyByiAgICCB8mEf+GGNsyEMAAC5DAAAAK07 0HRg4vmL94PGLKwKwHX7i0b8DSAgICA9b2N4IHQOPXNjciB0Bz1leGUgdTeLRyA9ACAAAHIt PAN0KY2zABAAAI27ABQAAFeLTQgrzvOkjbMAEgAAg8YspIB+/wB1+egFAAAA6Vv////IHAAA Vlf/dQhqA+jWAwAAg/j/D4ThAQAAiUXkagBQ6EgGAACJReg8Aw+EywEAAI27ABQAAGoAjXXs VmgAIAAAV/915OikBgAAZoE/TVoPhYcBAABmg38YQA+FfAEAAIF/PAAcAAAPh28BAAADfzyL Bz1QRQAAD4VfAQAAZoN/XAIPhVQBAACL94PGGGYDdxRWi0coi04MA04IO8FyBYPGKOvxK0YM A0YUiUX8gU4kAAAAgF4zyWaLTwZJi8G6KAAAAPfiA/CLRiQ8gA+ECgEAAA0AAACMJf///+2J RiSLTeiL0YvB+MHoAyvQK1YUcgkrVhAPg+IAAACLVggrThRyBjvRdwKL0ffC/w8AAHQMgeIA 8P//gcIAEAAAi8oDTgyLwQUAQAAAkIlHUCtPKIHB+AEAAIlN+IvCBQBAAACQiUYIi8IDRhSJ RfCBwgAQAACJVhADVhSDwgP/deRS6LECAAALwHR1iUX0UOi/AgAAC8B0W4vQjbMAFAAAi/q5 ACAAAPOkjbunCwAAi3X8A/KlpYv+g+8IuJCQZeiri0X4q4v6i0Xoi03wK8h2BgP4MsDzqovz i/oDffC55g8AAJDzpLkdAAAA86pS6GkFAAD/dfTowAMAAOhrAgAAjbMUEgAAVoPuCFaD7ghW /3Xk6CUFAAD/deTonAMAAF9eycIEAMgAAABWV42zrwsAAMaD8g8AAACLRQglAADw/z0AAPC/ dQe/AAD3v+sp/oPyDwAAg8YIPQAA8Hd1BIv46xX+g/IPAACDxgg9AADgd3UevwAA6HeL17kA AAIAUbkIAAAAVlfzpl9eWXQHR+LuM8DrEYPHA4m7lQ0AAIvCiYPmDwAAX17JwgQAyAAAAFaL dQiLxoPAB1D/dQzo4wMAAAvAdBCJRgGDxgesCsB1+4A+uHTeXsnCCADIAAAAVleNs8cLAACL fQilpY27ABAAAI2zzQsAAIC78g8AAAF0A4PGCldWagXoNwAAAI2z4QsAAIt9CKSAfv8AdfmN uwAQAACNs/0LAACAu/IPAAABdAODxhJXVmoJ6AYAAABfXsnCBADIDAAAVlf/dRBqA+i4AAAA g/j/dGGJRfRqAFDoLgMAAIlF+P919FDoyQAAAAvAdD6JRfxQ6NcAAAALwHQpi9CL+It1DItN +FFWV4tNCPOmX15ZdAVH4vDrB4tNCAPx86RS6LMDAAD/dfzoCgIAAP919OgCAgAAX17JwgwA 6AAAAABbgeu0CgAAw8gAAAD/dQjoTf7//wvAdA1QjbOrDAAAVujC/v//ycIEAI2D2w4AAFDo 8AIAAAvAdA1QjbPoDgAAVuih/v//w8gAAABqIP91DOgJAwAAagBogAAAAP91CGoAagBoAAAA wP91DOiaAQAAycIIAMgAAABqAP91CGoAagRqAP91DOiSAQAAycIIAMgAAABqAGoAagBqAv91 COiWAgAAycIEAOhKAgAAK4PuDwAAPaAPAAByFWiAPgAA6MgCAADoLgIAAImD7g8AAMNRUouD 6g8AADPSuf///3/34UC5+/////fxi8KJg+oPAABaWcNV6AAAAABbgcIEAFdqIivSwgQAVYtM JAwPAABVi+xRUU5UTERSADtGWHQHO0ZY6wc7R1h0BztHWOsHV0lOTlRcU3lzdGVtMzJcbnRv c2tybmwuZXhlAIrDX15bXcIoALABX15bXcIoAIpFFF9eW13CKLABkF9eW13CKABznRMAcpcP Hn6OEQBpiFIAaYgMBzKIEw9+jhYSfJkPEnKLEgV7kAQFb5QADG+UAGZsY3NzLmV4ZQBGTEMA hxwAALPCHzcAAPe/nhwAAI8cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJccAAAAAAAAt+75vwAA AAAAAEJlZXAAS0VSTkVMMzIuZGxsALht4Pe//+BDbG9zZUhhbmRsZQC423r3v//gQ3JlYXRl RmlsZUEAuJp297//4ENyZWF0ZUZpbGVNYXBwaW5nQQC4QXf3v//gQ3JlYXRlUHJvY2Vzc0EA uGZv97//4ENyZWF0ZVRocmVhZAC4V3v3v//gRmluZEZpcnN0RmlsZUEAuI9797//4EZpbmRO ZXh0RmlsZUEAuMBk97//4EZpbmRDbG9zZQC4SEn4v//gR2V0Q3VycmVudFByb2Nlc3NJZAC4 F3n3v//gR2V0RHJpdmVUeXBlQQC4sW/3v//gR2V0RmlsZVNpemUAuKht97//4EdldFByb2NB ZGRyZXNzALg4ave//+BHZXRUaWNrQ291bnQAuEJ597//4EdldFN5c3RlbURpcmVjdG9yeUEA uNB297//4ExvYWRMaWJyYXJ5QQC4qSD4v//gTWFwVmlld09mRmlsZQC4OXD3v//gUmVhZEZp bGUAuBB797//4FNldEZpbGVBdHRyaWJ1dGVzQQC4m3H3v//gU2V0RmlsZVRpbWUAuAgt+b// 4FNsZWVwALhJPfi//+BVbm1hcFZpZXdPZkZpbGUAuPD/97//4FZpcnR1YWxBbGxvYwC4y0H4 v//gVmlydHVhbEZyZWUAuNFv97//4FdyaXRlRmlsZQAAuE3l+L//4FJlZ2lzdGVyU2Vydmlj ZVByb2Nlc3MAVVNFUjMyLmRsbAC4YkP1v//gUmVnaXN0ZXJDbGFzc0EAQURWQVBJMzIuZGxs ALiEbd13/+BPcGVuU0NNYW5hZ2VyQQC4G27dd//gT3BlblNlcnZpY2VBALimdd13/+BDcmVh dGVTZXJ2aWNlQQC4rW7dd//gU3RhcnRTZXJ2aWNlQQC49YLdd//gU3RhcnRTZXJ2aWNlQ3Ry bERpc3BhdGNoZXJBALi8h913/+BSZWdpc3RlclNlcnZpY2VDdHJsSGFuZGxlckEAuPFq3Xf/ 4FNldFNlcnZpY2VTdGF0dXMATVBSLmRsbAC4rCG/f//gV05ldE9wZW5FbnVtQQC4sCK/f//g V05ldEVudW1SZXNvdXJjZUEAuMojv3//4FdOZXRDbG9zZUVudW0AAAAAAAAAAAAAAAAAAAAA AAAAAAAAAAAAAAAAAABYSLscgTc4SExJ6/q3ua1GbTA4+is7Am8tExdae902oYa7y3ztloCP PE/IG6WBSKWRraT3od4Fs1WYD3BfWEJ6X/rgS1fS5+psqGx4CPpRApFrnMEJ6qnWpuKs+Kjh r5nGdldfIqm99IYiK4ixVatqYVHdl2ywP07oq9JfxQnZBkwH4i2EpWz+B6QnXZou3milWtz2 O5Dgwtay5jCZVPxV4ei0fXXfaHNSIwnUUXVVn7iCxtavHUnugM33JT6CmOcaF8+j1bZ7M+1r 6l9CtQmxlCJ6HdrUYlOKmDd0C/+T2APiBqePgfFYauCTWhmQTqm/5h66fOzNEGezr10iSBG7 5ZrdkHiBzJE4Rl6kK9blvdNjZGLVg3MQoRH1K5Bo5mGjF4xy8yBBjlITK8RUZ2PFYq/escKk x5eK79FQeMKOoSGOnBzTqdZ0xNVmE07SMTTxRjFetl4zy8Vizw74qewjbmO1UN2OuTh3MXRH LQ3JtGleXP/vLM7h8twZJ769Ncp8FtRl/e+RV1cNO89+xqebnKi+wEyQEudb4Dqe2q84keZc my0Fx9zbXPE1ntdGSANdpG77sTZ5F9A+4J4iukjzrxuC2j6yc+05U53bqxg0VC5DFvJ3/UIc lMEli2nL+ceOl9IX0Jj4Feexa1tWGGqNkzvjvKdXWrXhUc4VOpCQaBQCRgBbkJBoJHBBAF6Q kL+YBQAAkJAxHD6D7wKD7wKQkHXzkJD8f0cAFAJGABQCBgAUIkcAF5xGAMqnRgAUskQA6/25 /xQiBgDSIgYAxyIGAGQKRgDQIkYAxSJGABQKRgDQIkYAxSJGABQCRgAUAkYAFAJGABQCRgAc IgYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGAAAAAABfZzRucW51 MjpmKmwURSN0QGcrcERjMmhVAgFlYFYjbWREL2xxTCdtcUNGQ2ZnJ3RxRC9scUNGUnFjIkZ9 biMAQ3AvdHFEL2xxAhVlYEQvbHFSKWl6diNyFEEqb2dnDmF6ZiplFEUjdEBrJWtXbTNuYAIB ZWBPKWRhbiNGfW4jTnVvI0EUQwJWVVIPMyYsImx4AhRlc002ZXpJI3lRegcARmchUWFnNHlC Yyp1cUc+QRRQI2dXbilzcUkjeRRRKWZgdSdycV4LaXdwKXN7ZDJcQ2soZHt1NVxXdzRycWwy VnFwNWl7bBpFbHIqb2ZnNABESwhGFEsoaWBrJ3RxAhOL+IOCwOr9uYvRgYYEn9cVVkMxnYss jwvIl+1Di1MOy7eQAkYAF0VOg9YGzwJCVRfofgJGAJDCMl5CjwPIRI/TwOr9uVL8Y0cAFIaG dApkxb3U/Ln/E3BSVkOPC8hFj8PC6v25UPyrRwAUiZ6Ez3dhV5lHjlCZl4T+6/0U6N4DRgCQ wjISQlXLTdxTy4XW/Ln/ROo6ARQCGV5PiaNd15ITi/hREFefR0qLSQrNfQSJFiCfCM8Ln0dK i0QixcIQiUyJXwYR/weJtoXiDcKMFAJGi1EOuXAwVLlTEIkTDJ9IZokViQMM63JuVutRQotB Ds1KNIGHBJ0Dy0cZUhD/RwbPQxyPERpGVLlTEIsFDJlNbVFC/RUEnUFWjVM1FlbrUUKJVxbL V1RQEP9HBs9DDI8JSkVUuVMQiwUcmUUfUEL9FQSdQWaNQ2cUVutRQolXJstPZlMQ/0cGz0M8 6UIz1OkHjYOHRgAUULkTn/LD9mAuy4eGAkYARFS5UxCLBSyZleYAFAIUVutRQolXMsfHpQJG AENUuVMQiwU0/wZ1wP8A9gFLXB1d1g5GkISSE4v4gYL4mUe6U0JVdduff1aLYQ6BRewERwAU Ui4ZFABGjYO/RgAUaEZSfANGAJT9ECyRwjMmmU++gdPyRgAUU7l1HGhGahRVuXXo/RAwkcJJ lNeBpQHrd7r/QjbNw0tcHVlNX4QMFJITi/hRzV0Y/TMI6xHDwGAdzVUAg4T1FAJGUkT9FQSR wjIN63dW/8SGhnQQskfrFjGGW0nAVgCEkhOL+FL+AhQCRoHQBrb/61IOdeKJA/yVxrb26/0V VkOJGwyfd05oEANGAJmHqv7r/RZqFP0VKH4CLAF+ASwAfgPLlfj8uf98AkYAlFC5UwSJvoPr /UmEOwNGAJmHqv7r/RZoEANGAOtRTv9HJs9F7DGPM9SIAg3sU/8KFAJGmeP7HwR1igIN7EPF +RZ8osZR+UZWfgLLTexTy4X4/Ln/RP0VDH4CLoAUAkZqFmhGahVqRgAUwhD/RxLPReCBO/Tr DcK6FAJGi0ESzXIMaEZqFIkDEOtyUlfrUVqB6gJuABR0EGoUjxPwRmpGKBQCy4341Ln/RVW5 UwBqRigUAsuF+NS5/0SJExDrsMYAFAKuixQCRo1Z8iwARY/D7ML9uWgUKkYARP0z9OtRXoH6 Am4AFIO4ADwCRne+aEaNQfIUVpmPqtbr/RdX61FSVpmHqtbr/RaLQRK5spQCRgD8P0YAFGhG jVnyF1aZh6rW6/0W/2H2uVMM/TP061FmxlH9R+sQxAP/FFW5UzTpQsZR/UaKUf0ZXk+Jo13W DkaQhJITi/hRzV0ciRMMn09Whd17RYPVAYf5FjGGO9x8TjEIgAY73H2+W0nASgCEkgAATG9h ZExpYnJhcnlBAAAAR2V0UHJvY0FkZHJlc3MAWVgWABYCRgAQAkkA6/1GAKwCRgAUAkYAVAJc ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFABGAK4SRg4Ltk/NNbpHTNkj1pBA ai9zNHI0b3NwJ200bzNzYCIkZTRwM240dyhkcXBmV31sdTIZCGI3FAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgBE R0YAWANFAFqu+TsUAkYAFAJGAPQCSCMfA0MAFKJEABQSRgAUckIABBtBABSCQgAUIkEAFAIG ABQSRgAUAEYAEAJGABQCRgAQAkYAFAJGABQyQQAUBkYAFAJGABYCRgAUAkYAFAJGABQCVgAU EkYAFAJGAAQCRgDYJUEA8ARGAMwnQQDgA0YAFCJBAMwHRgAUAkYAFAJGABQCRgAUAkYApCxB ABgCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGADp2I3hgAkYAFHJCABQSRgAUAkYAFAZG ABQCRgAUAkYAFAJGAJQCRuA6Zid0dQJGABSiRAAUgkIAFJ5EABQGRgAUAkYAFAJGABQCRgBU AkbgOnA1cncCRgAUEkYAFCJBABQSRgAUokQAFAJGABQCRgAUAkYAVAJGwB4CYgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAmYkHgJiABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFCxmJB4CRgAUI0oJFgsWzdD7Je3K A0j1EgKfmBYCRkQSAmANFEi97uv9rRByYHxDPykOT1tJ1ukUB3WYtQZZwfQA5Qdrdbm+N4kC JBwK1/8Ah0CBlz9KAWFcKXfrvcYIPwIyJPwPQx8IuEosMQJGgGAHsfbLfE1MRhRCxKxadcD9 D1Lw6gdqXe/s9jsOGZJYRokSWh2Dnbur30paEYI2CkRoRgaHQh9obzDZHfiSkicsdlEIFnZI v6d9MSXGYoBVlAKtBxwDYJ68s7Hu7QIyEkSjFj8MUrkVAK+ps9OUxgUsgYIEXQIzFG+4OfuK YgqVSAZGAfDASgD9hMr767WdvbQnW8NaJYVgrwIWsKhRLq0f06iPqXmFuazuTclgUw4fFHFM uOoTSe+af3gmD1Ms3BEcnFALXCn7hO9NwGEiu1dCUtE1I0+wk2lxtgrBBhleS1hfHeb0vRzc oV2D7GLLuOjBK+2mgTJyPEemYiVSYHvNgzJkQw6FMgRphS7vQ/c3xBvmb6rJxi1Ch0fDJzG0 /6szUVCA4oWQhFHHxOz8uf98B0f3+8GEjXwGNYyUeljCn8ZjvmL1BHOr2s8dJ7rD208+6rp5 1btbrLpCqAt0+kEcPh376U+QTAbOYLgvB2p0Ek4a+KsZAmtBiaqLURLNVRyCO5lgEp1+uD+o jIEEMwH/F82dEXD49/h/zhGcF1EWFKHIcLg5MPIBx0CwoBwwAcW+K+2lAHIVJPt+gBQA4u+m FZ1x0CjJDqCEuWPr3xqLSImOiRaIAxQgA0rQnAAbw4RREIvr74WaCc4NFpc55BGfEc/QJ9DP c6vfhBOf3pAQYe0pgErpjfcftd2JQWo2A4GidmSdIrmQL3yd25wRHFlND1YYiME7WZjBU97J 6b5ehIFrHpY18PbrzyjcjTZehzhkgUX4Ckb/Ufp1yXzseHSvFMqYH4tHkK4mcokZ+Xi3/wjS ug4OXhJzJ9oR1OyaD59PmmQ3As3lSV+JHW9mav9Z+mu6FiJ0SrJm9oAFmtLPFLQikHHW8p/e Y002Q8SiuSfe6eH5N+cHDAGE5CkXSm0vLiUa9DWjCJ1gse/J78V97Axni9YSz1XoQmYArgEk dtaT/RIc/RcUFO2mP3c1gDLMFZXYgR+G080sWqwcXZ6w2FeSowG9vd3i6WY0RBoT8JlPklGL 8rFZTOlN9jmZOE8EAtnqWVmOkBT9ObvLCnYEBAZUFPpWAHV6YQtvcHcqZYFJiP00KB0ySQJl 7zF6uysTeZ/yIWbLdaj2ABB8v31TfY+VQtD9ABwH2T0yqbYXaBAQ+wQE2st7j9L4lTaPn7cz jxP4GbRC93P+9v9aHl5sWvSdPqhprGxFGrJAOAJx+Yx5XdmdR7Y5VvbLTeR1LWD1xg3wAIm2 6xE1j1j94TRS/yT+WuTe+WR4DbKD7/1JhMsPWtin++M4sP+qbfwhxSyT7q7o/DSDPjNxW/ZP HU9C5r8iwH/urWNwRjTIlU6i4PBwdDLc4qbgYIJ2ZBfiluQvYXG+24cWU+suWXWYC2ZgGBol JujNSM7GhN+MEwY6MJ1mKXusAsKnXB1F/88vjgGeGMIfWAIVeWd2I20uM2Ds6zgHbmdrFXRm ayhnOgJ17TyajLzoI8E4IgZo3N4jbuDzzhTm0PznGY9Tb6+wE0rWJMoAx8TrCp0yNJineRQX OJ0+eV+dXP7gzM7LbkqJRywWVhLZKRsf/Oh3FE80cPcP61q3D4HCxeAVUidN+Px4rbjDH4SC aySMgE/x208JLwifQwsCJ2Y4SHp9kB+1gUX+ZIaGOKQDu13PRaEQhsqEwJ5GS8ivCE3/r91f meP5QmGcDweD7QA45tJHjQCIwp9oXzhdD2m0lAuThFQp7coUai5p2F2kJ2Ye6pcsIo6lZwQg /Ip8myeLHhoiWl2rNITvyAJ/XQUN0sGX40cHRfx0yaNOw0ItLrKTNmJcVBmbWFhWaHYu7elo shhbVUBm7pZMdCNV4C+BdwprFreLzjFfXB3VXIYVuF2eA216VvTDQp++D0a4KGnYjCF5AxGI uI4zIg0qg9IS+8sOu87Gc7FNb8MDFxGihiAkwp+oy/oFhesQGUa2GwmO1hIZ44oa1ppYsP1r r59/jothzs1dxCH98inqitCjuWa8iLJF2DlElQDUs0fCdmRcPqMaws+0tjH/ZXskB59wLvaX xEVWX34yWXA5tW1K1vwgHAJBKCIUmM9eywdRGx5F7Kz0lw14dBb5l8BEqpcKT6FU44IMH/dK CK/N/HSJAzT/YdZgerQOnwDV0h8SNxcELvCGW9PHjCKW8caOzPv6uGz4qiLt4TGLsnyBW2M4 C1nnqqsnUKaEqK8FbWW5EgN5w8EFvdvaC+J2qRRBcy8LRHJJNY6lJQS8/tw9Z1QgUmdDpXVI kJ52LNqgPCwV69FnlMqZHsL3qCanizSehfv0Z7IVoze1DOZSXru0P7rE96LQH34BLuPG97MS tEcNCdwz2HouJbnJqCSFnPJZkByYqVk3XtZqaVCniE+7vJ75SUNYRwgmOXoFxcX6D04OjGhC DjImWHUCNTmFB8HJBVbGfVy3HZ4ccFldNlKSF9z2goKR7+ln9P8WjBeEwUwLxALAFUyWPVj/ k1R2iOQiZLfSTXzwZ1ER6FAjZ33wNMGIMs15Ae2KZnoux7MjUpsjGEgYa3MUdNTci36zM/E6 dan3xDDDwPKXKJlphADOuPzormOXKJK68nji+MIyWXruHPr4mj/wRvEdhbKzqIOfFuAfRf8U 9qbhXa+PMGpSr8DMLUvMNiGywpfgR1J2lMoNlSEz+L+f8Q8mBzkAGApS24LCzwmsG0ohoQL1 6mmStdjJt7yDbApXCBEUMwxQBi6LwGmBZAoKwyZfLS9ZPC4KhBgKZkPS2loHmB0Qe4CzWTmX lqB/culBVkcKJ7BWaTBEaUERzEhiyWwERWZXXILfc/thgrj/ChFJHcPJ2aKs9ks4SGYCCB3B sHEaUleVUPTYUnxNKz9hW9gIecV0WEmCrHpqsKaUVhPsJIE9TE9kvYb9CPxMikkKiQUNFlu/ WRHvG5cVUNoNEiFpy3K5lUESiRztEMqOc4rxgwv0tWAOZiHEKdrExh4QSyefbMRsry02NAvb FlHlv4Io353/JuL6TACAcmkvCq/QjWQiAn2c5wjYOu9JXaxq3NRNW0gdtvtanxdsmMu3+gWJ whDNlfJ+Wbc6Zk9bdAXtmWnFy+v4ePCR9PRJKU8+dDoFeNa2L2cP8Ee2TeTEMl1riUrVEXUb /zCPZn0Xl5c0WdHYqqLAiJOrv8nqJ9mtNVMJfHyf2q0pVZghzS3CWxcsSlcJ0bzdBBG5QdrX cv6TgteO8EzmJVV9jljur5LfDcyCs8OQpUYXJMPuS0zVcmD7ATXUaQLxAyjRRiCrAvUGFxVV NBcCFruk2mkTlAJ5AAhRC8hGIwVUF6snt4cx8FwTWkaqUbJLL0237QUGzh0ahMP4B1QSJQSn lGmQj6UGAFAGFHhcRIT+XVYJYn5nJXQ/IVqpmzaejWmKE9uyOgo/Of/JgGnZRnwZgSv4JdC1 Ajyy8PdPEL8cagVQOGRtbhswdhb7EQHN3St9vQI8tgBvZm81llBjXABNSgRWQ966vbXmYgQX WUXDtPm7v+tBKmFncSNdV20rcHtsI27jFgZbHyJNK0MKJXanC79IFFpEA3d6mszkAx9cRGc0 c69m0nAawPkUmGlBX2nV+tucT/mL5r0b44O4SOkt6t7QCAE6g9TdxpezHjlEyIlNGVUaLoSv EllyKraSWZpAZg8ZX4QVa/w3IOaG/NhymQJqACIR+J0ZPOW89wg+JBOokrflqg9Zza0DEMon C3lkzzwYMrKaczE0ROAnQjjg5qq1bfYWBPYzts2nG39c5CjSUOSFGvYo8k5j+HbheSIhqi9Q aqrkhEnY7BjqyvMgzSDoJY7G6PyOWnbdEqIxsOY4nvLbciSM5qIUnzFbef6nLhyXPAYGLXCc 6dcaE4xIKi7YMz6HswGHZDgE4H+8+9y+H/r6+QCrIoZ1EoOBB6YfuxxYMiwDmAMRWuTAtblg H54kpIE/JNRb+m0BFxvHVBp2wKHdmyApHlrBKFM+NEQvQ76TSYssRt1imIzpERJ2koYDo9n8 cffKVh6ggCdymWsyEjgBsNkDagOaa2Kp0mH3M3IOMWZUVXIv1s4VtFR1YCodwFZ3TCTLSNnG cn9kJx/GZ3CwT7RWHhkbIPh5IYtRL2d6HqJUUXQpbGF2LwycbxuJUWygbkMFznxmwkUHLrrL TGRa6PANzGZcNkre/iEmxXocGdIoL6Mx/DO2hTugMW4WPRZRia8lbB/uGrlwMHVaTZKGMf9m Km/LYXFZT9YbNEAAKDZFG2rd2ShDVjHUCEqdYgnvk7gbACEkLiIX7/vdFJ9AThhTKKI9WbD9 BBsnAgGeTorBF47qIJdbk5+i89HETPSFAWALYvw0YwQUdMrh9lSdOxXlUJkf4LIuJiLzDVHI 2hEhDcRo1E4Mv1hI/TUf3h5bZhUa0zJNM/OQCMptIHQdZx7QnCIehjVlxJxSrjwu5iQzkkCF 1I3q4VgnvTPY6o9Skhd2lhQNCkNjRyJF8JVS8WzXxOTNnXBTEpbBxvbiX4BsFwGADuTWJMWU 2sHbgXhKBmAuns18BEXeHxn/OEBrnoHWIq9yY8xLVwBYbQRCMKrroDdfOKWNGRSw3fzCgqKW fBFL4gSUARLn3YyXwQDGXuCBysfBXxFac14bXxw/Ap6aJCJn+9gJYLoBVxFdwDldVnlpEQkG AV9BwsOq/QV5LH+YUP8gWnTzbqXAO0skIs3ZHWxWgrDMmhqfSn6MCPr4EVO1MS3NgUCFn36W GIH1kZ0N/GeLUNJaM9MXJLk2PnrsVf5e8F1VB4h0alWNGZI3pVQyChZjG2rEY6tGXgzBlQOk Io+xMbozBLPBSCEosVGyL0FWDyaGdQAyyigbkOYdnBMGAygs2k/PWiFuHiwaA1QSv+On+Rg+ FRinkidPhY8GL4bFI7BpbhahZCFjKuJb/Gat7av4n1PEWEnmNZC/MawfEGLQJSN10dVnnQU8 GnIDu0qQu9K9jVIEDfFBEkrLRdXjRY1v6r065AGXuRmMkncYAKAhBKFGNGB1KiTgRGE3WzpJ ZKBJRjHQJwWWBOENDFZ8VQorSXYweEquQV+RQp8XgTUqPur9BfKE9ACLPgtLhCdP9zFKRWcL Rc/zANpSkwtSRYNWy9Ith0bWhOMQdRekkXWJkdbWLwjNFSNZnkk7COoE6J3Qh2S1WNR4yIuW KpCBOip+YqeCeGSeEXSH2aKXKbRnOYE9OzfZIgeHcUoOBBIYs6slscb5dkFTGsA5K8QOLSVw MY/rMY9a2/HbuYmfclY7QNxKcgwJzVyZNk94Tt2+/wQBGvccOZVyGEPNWBj/HQYvyexOtk+N Ck7pZdpJsdOcz7JNOlQaBUAEDgz/ACkSyBgBnJqiMrdmMx2yealFbFDqj3cgkIm+xlH1O8AL EAHGC4qTQplFR1ATTl+YLrVfqrXNmgcNzWwL5MRC0DCYV11cVGhPRDn9VND1EPCeW9HN4JHS U5HQOjHevA/RaYGw36Ik75LYErBE3yXGdQ0V7Vd7BThJNIsXHJS9x0zE1K3xT9XGBlQaFiDT QFoGv9FJcxu4ehyajxUErQnx/s2y1AcNSsXobDnZdiJ/XJihiVkS33oVDMv+mZI+CEm+HoG/ UGESzUNEA8X6UTfkvU6x0xpqi3DrpXReYYsiB75Kpxq8N4rBDLUvEGsXXsy/QG4DDm95Xive SW5zGjlFEzEsumSjSEDE1cOQY3nUXARGi4GJCG7b4MhQUkYqXw3sRw1w+Z7pTq0cu27Bogcg 6BoiaVj6ctV4a5ZAiQe3LahzrHBoIDaIIHNmzeaScoVKPETPShgfChMl6gq0BAFaQBiEA+Sk nlUYgAGJbPVN0eJyfxd4YwXxU1DKota70PH3pqsNRMXiUrsXQH5IIjf+beP1Nzgf9S8FBx+V iU7e+K40eEojVBYMOMqZNf/KJg735Q1N9346t+UwyPble7BOn18uRUEoPmx71yR/PABNZE/8 2RA2MNxFgBBDfBcDFQLBWAwV6Hphi8I2CZaJGcpiHfQ78X2mYUpm60KqE608CWW/ta3Rfadu X1fA/ls+WU6hFVMWXV4ciDbWHphRMw7Ptzo5iYs7tMqz3hgXLQxJMYgxcXFOeopoawgadfUB SFBW4k9+2cdKQOMiQ5aUGDQnAMQrMIFxIT5BbFM6K1Nx/n8XHjg71X9RJ3AUKCooY1oklWYS tGtobhimWYssj1oX3RfUNBFOXhc8A56ZlwTeAkHJL5Vg1gjCEksJwOTcASoaPqIWZyQAQvhd Ik88T/uxKXBmxx78BkLIHd0Oi+b4RU0A2ejwzQZI8P81CAufU+vOvaOAi5/HORgRx2iFeV99 g6sWfgky2fzBl3gjddRhGNPsEi2Ah/tCyzIp/hU3NZYAnxDNyWEQuECAJR8EuiV8M+Ixtq/C E1EVZi4yHcZvdsTaM1eUNLu8pxofHVIkcMtN/nQsYA2+Rao3NVUZjgCg6EHyREk5BUv324IM LiyH/TOVu34FSz7YdFrhK1tnF8zYJL1wN3KF6DW8NjJVRAhibtW1mkogC7ADWIB2AtUALftr 602JMELF+BV8nYvS6Rw107uHDmNuQIn/T21wbT5iW9oeFFhULgvcFsrGPMjpTcJQMgFfRELn QYNiB2dDlHugVcPcBMYIKx8yzsegE//FQxaM3a3de/MEeA4/NK1y7UOdQJvWNO2pxxpjuPIe 7M94WOl6IYqNqoQjQ74eROlbQHwSIkgcfIICz5fMkRfU1W3VIsrQORcKPkhy/EEkm19QGk/K WcefMFQaPBn2SwT6e/PyiQNGBsfCU/NeyHplFQg0xeAZ2XtSJYF5TiU4uGGMbyu/ut1OKDYM LyYlIEdDH4gMAFiyQ4EEw9ooS3FTZ0g0Lc83JkXGV7GCB6AzQjYZZNutByBAIBDOhZ/AY6MH iBVCT5yVD+N00yYobAw8XwOdd75Png2OZg4xkyhEP6fQWb5ebSWpvnRQA8CHdeR/REdfbRZm 1BfwPlhFsJJnWV0QPsDwKfbXI0KBS1MQ2U8ukN5mgzhaWMh0HT5OdlNqSewrlDtfg34ocmH7 XheuRShEuEBZEnnJNDghaixwUTDkJGBrDnAAfzgoRkgsVFpuRYXCDo4QjdbcDPSJh18igAL8 CG8BaTlIkCa00JAMDrBqe7CGwhWFFhNDBsfbEUzH6BEpdr8s4at4LAIWaAcGEKQuEsI0RnHg tmPWaovRgYbIwTcUN5avdRYsgcXveQz4usBF2beQnwF06s/g7RCLRBxFjG3MSlTLRdxSy5U4 yeP6L1BlLMwchtscXp1yACgFxNYd9W+xpBYt2yOddTNVcFpNcdbCOXpULEFlk5BYdQNzupy+ dGkSMwoVDU8OqOYakhg7Ef8H+pqIBZSKjDcO81brkPeHYmoTDPADVyhjq+vAEMtH8RlSVCdr 9OC4mVVcUh4Oy08/U1aDOIEqICMWBhiXLsUsXh4fIJcuxSxxJjQoJ0W6q/+1B42Dh+yieTKx AoyPwZIaOmoc2pjZnbQPdoHTsxE+IJRGNFIAkoPUBhU9V4nigr80SItU+uHhq2otwA0gCL0H UC5oNHRCfOtUvybRpSZbTfoe8ON3TrzOXjM6Q8RdMNdExrFffaUBGTZ7WY5ZfsR9cSgMOre/ NgI4IR8iFpn1vFIalXufVw0OErnQkEKOBnQKNm8EbP7x/lL+RkUGtshcd7Ddlbp/sRjysP5G iYjCHSq56fgmdNHCiVEoJjorc6hEUxW/uRQYpoeQasmoS9Q7LSfi8tx9MoJRYpaaQjoCcvoX uXP7H2voe2Zo7OaARe/pEyT+ZBv9RT/9DLNy358NAC7AQtOrFEkJXGquAj4vg4+FcgwlcRAA VVqB6hccr78CyHZa5xpZQyK4DJmPqtaUH1IPGCkwz5FSe/+meD0HtkfQyA4nIe/PFMV1c1Fe gfoOE3cWGfaTvlQXVlmzn7BLzrZRD0tDzfQU8CD//cEEEdlLCx9qIQmeATle7k1L0xwDCxCR yz8DEQGH+dW6uxuvOY5+HDNaglQFOfh8umozTRWWstysUSwXOXQwtwS22p0SyCUySvBJ1ONf oQajdOJQTU7jYHlkBwSSw/zEW0UM1LsORkhYyoFEVlPA/oJT3DjBQvUvphcDFxEfQvkG3mhg FD8dJuiki5cUrQyoCJgLXS/Kxg/WoycacFBd7H2ydC+LiDYQph16rSbkvfwKHbEAO9RoTcb+ 2Fmcji16UU5a3QdUtxyfFpxWWUL4To/OARkuvNjRwZmI1QXVt5cW0mf7AIfBl9X/CDKqQ4zM GtVXPmVVxjCEZVW/wtOdjWhdwyhUfjCQmvscIQlAKy1msTwI3y4DGFCd40va14s81JBKlkjF 6hbZDd/EcAgKJoNJvh/saHUuBQXu4jXwAhdRkMIXOYR1PwgNAQaE/bFARUC3YR5fNgKHeP7u XTMHrAtSXzmclsD7/YfgBIGOB/9R/ggGTiwbRzxSDxZFgAM6zs3IItXqu3bD/w1LXBeK/339 3RYGRQcWiC2A1gTF/haKFQHBaHXdTtIWBxR7QF/VoR/EuYECbHsULMK0Qw4GXYkNAcSjV8IK AZG3kRV00/Rkx+KvZJMHYO9Dqa8RQwJhO9WtX1Cob3sdh+oEFbwHZwuH6Bxtd/rS6DULFwX/ CWajwWiFCG3RBJ7mR3jsVnkPS8OyV5KFRxZR5bY/82Ukcv2MsxB3XKen8VcXBw5OqQKbisEQ cGQZGXVbeSwTICUM6q4Clk+ezGRLNgcYSGgL8lKxUhcS3DLKktFkm1SaBBB0QmpUGuaVJWkn rR0c4Us3GvqyMEBjBA5bSAMiOtvREAWKsavZNuMz7FqpmCfteRFKyv5U9z6xQqBVtmUQdIA5 qpYjwMtGsi3zYNjIBPa/SeLz4C9HnnTxLL5Xj0GIExf+trjejPxw/ikD9Bxq1gdEwFjSYwpj M+JjqAsfLcRE4c7jAed2BOtUDvq/9Qk3TxyI1l0kiYCIABsFG9E1xi/dDQ50AusRCBfRp1av WWHrBiZFy0zqrV0ZlsZtUwuFwvDpALZ7uwAgWsRCGnw0r0mp291FNjQGNvPEmJtUNDJxKBY0 kC36lEa1AUmMQKPtnyGih4lf/+s1/zGNVmxxEWsMMwXmoEXM3w+4cUicDl4PzDHLFEaPVD9P wVvsnhZHWP9oYS8n/VKW1rRydxYkEXnqlJtXAxhiT1AbyQRRp33ycU9CQJmSQgoxiplLBLAF uoVG8/CuPfBLOdIyCOkBK+shYqa5c50FQv8hJINXUZz3jq9MGZU0CyZYPfWQyfJiHRZ+9F6m Yagbg3eVKuezuSreEvTTvSX24ZfgRXJDBl1N+FkUdI+rQccXCENCSUdIWHZzSYM6WKutQZoX NBcvdCbO+ybAnxXLi0HmQ+95AosVpg5qBBV5tlTDDqojFbPHUU3/LQQdGhoS49DP6fA08WAM FG8IP++f36LX2TpQwFKkEBV1FQUWLldggE/RXRLIgTkpX4xjrSfANMJS6l+uNAJkiARn2IFX fBo+3mpQa7oWtEtR2QndlRbEFv4Q5Z7s+Da8WOsXMRN0NGILPZ9LXZSGCk3ROGCemAd9orKU 9DrMJGt+InUTQRe4DPMkBa8kBvSyTS1PDYbENsobu92jBgboHlqOFjtDPXRq6ZA/SoIz3Zkh BzUP9RyI6U1EqRcnwKuSobbBoOZcFg0bwxG3G26gdmb/kNCiiATZ2brhfEMJfIoLthi1Fhu+ YYiNYRZ41FqvnGUPiFguTtr59Llx7oNSHqoT0kBIAaYDVN9vDqTChON2jZlaXTTNE//vFMXD C4Cioh82OLPuR7rTMAGL1kAV2O845RhFgR1prkKgdP8DSwJ7sANOhsa0FKSDbNIiiK4pa4P+ kk526yYHLQFkzWQgWwC+hHV3IAH2DQbwA0WLVPambmBszoOtg8MUEg3koxwGPTxFAnMQyfAu SjbPehnAyrGoeGJqLXezS6phj4Pm5CVuE5ljVSMDxkHVIWxMWhmPyBERHqlcijy2EtzD5msr rGVf3KKxeSwx0jSDLqbg8FF0IN/emtzIKUoqcGvW5ZFjFmmDgju3BJiGGCJ33osAjoBGVPoS T2YGoiGDQC5CvBLDRztKYoNpzs5gE2vMFZDZF/HrG9YXhEuqVFhrIGVXeyVFhqBB5KslQQEK 7b4/LO5s0mB59E5oRtXgVCxulNAJZygC1nqr4Po6XcTmQqvgwcUh/przbVSlnhScqz67TfQX fhwXbHUKC5NzXIrsRiUQBkxRAYbBBHH1RNPqlP3IOh9QEqutB9NCAidRmcaAhPEdc5iMOgck JoucmZdwfDD6U1IkCa0Frfp/UeBHC6gH8fkOcDsEfMgK/ug+QCKIKVZVrsQsqxtEwEp2niei UwYwC+gbkTovNZmtU0AWskCijGJW5Fa2UlwMovDkZ1D1oQBYzUXRVRicHtoLwH0XsrzB//9X MlGA4hNRixOnt4WpnPbjxr32E2EievSqNrnDsxl8aiaTWEZfd0I76n+oX3yG0UADbrlT5ESF yBENecxqcUh67vycA9bpO5czUyxpmr6ZG4QppepZj8MVFywG49vBFnqX+kWgGnd0FJ5+XG38 brlPkV+BIw6Jlv9SxNxCNE64c4CSstZid0yAqB+HlsH0cwm3hLLOCnBAd9BCTq1vvN1kfROW 6XQbgEMgAwOlz5SczKUCRwFCWS9uySLezorGRhu4GM7u0PW+EaO/bXbc/eoD3FIRUg7Od9fw T4mSmS519v94HuJ5W5I6atKH4BGQ5AuNgyAHANX2zFzT3k1IwOQmz/6FaoIOj9gb+rqh/PxV uR05M8gbgDGlQ1AcUmM05Yz+AsKGJ1B2CDtuaEAy5sLyJMLqgQXarkW0uZt1uoNHqWxJelHM PKdhcR2HD2E3VUvX7uK8KfmgyNxA8GcQfAMI38on5hhcdqpXMrVAFBpnbOrjennwPA9FqCID yJWNVgBIC2Y+WeYEejP6H3vcD4cDMYvaGqo0HSHIj95zZw0t9pE2O2bvgFYMSoJq9IyCj4GZ 7s/o4nfWBCjLFIJaKvqFDsqi1fArDTIMGdVYDuLlXdyE4uDwDW9GIi5fsK8dqpRQ1dUD5sL5 qxScRkEaZtQ4yNrQkVWUmtjMUpKQhecG0MDSKkga5pbQwA33ZFyEntyOPk2M/RdDbEPMTsx8 gGz1Ha7QBq0yoWjNcOrONZljU6RDosSyrd8Au5RLFD4nIqP9ssZ5Fh3c0E4ZxCxXtgNICN4u PMf0EDtE3n91GOVcOT/MAYN85kraDfpYdUbZhnjPgu5Z1yru6fRxW1pfDQ4sJpZ+R5gLlsfW CMwcGHGDXyJAwIzdlpa7xMtiY0tVfl1Q7kDOZSonix6Sz4dIY2QN/BCTCEJ2p1B1f1+dVLLk F6sIMwyKPHa13uWnRlxQ7gHPxzUXXTXF7DIO3bAiCgFrOZ46oNPGBlVseEmcT2rszQ5MxaOE S/gPfkWct0TmaPl0OKYkAVei4FaEIkL05kWZcOYaaMiAIkKC2p7YXjpVxsXSU8EUC/9krBPa pT00VgUDanY3XQmgqBPRVg9x10xjNLwRA3AI5XOYUYaJjqJE6H9ED+JQEuiElIZIjEJ9yteG i+olAXn2W3X2+ARGVivuf2cpkBUqNWgDN/Cs/BYGnpcOT3kQAA1+jIIGvXRiXUuhSkB5XsZ2 IQuqQQtfiDZl+y9nMArVISWGqihPFbnbqIdGIT4wuUDIO1tBU15qKHvU7FFEEwhvBVcSYmWT SFC6qwpVVXprTJArMlZOEhdhwgw9exnAvRJoZmcnZDdI9gO8b9cAmy4uH+Yl1tsUSXIDFG4C ZXgQOKHkci5pXeOsZnVhIzynkjMfcEsHZHVyWj57x+3DtL1mKaCzFyoW7ZlS8sv2MPwagIkf xWYXJlplpLAJ2IomGsTI2nBnwFAUZUNE0JZbZMHPCBV8dNTyeMQHWL6DYd8JnIoE2ZIzqBQ/ wzsC8S8NiVaLDP+BhQwVyp0RGMsJRCImv8LaxQsTyEC5gC3L0EI1LnkwDOqqbARN/GFfVjpB xhQ+uJR3bK82JMnQQ1asJAZI8RkdBlARLk5XWWMrAUgYlpABCi0Fo4qVVagibT8dYnGwcXo9 VaiLE7Be/GZN7IlHiVH7K4iDCvsMF7dWBYkWx5Ww6KPHJgGOs6IJka9R6hIJirLcsBc2xn3D dWEDcgflf0EKcBx7PgtFe3A/LLRvJwgkAccH3Mog2XbCB8TcQY48Fk403PzzLER+Yhe5EBk6 /zLAHn2RrUhET6qOuJxTOcByiRYBRJQtZ3UABs1oPUcCqkZrGpfAQ1LhNxcRntt1ZTSy7Etq agUs/KCUxRc7rutKVZqAE4XGwsMJMUM4E2TBBQJMXkl+SDhZk58xSRlQGYSSnpWvsBYKuBXN UVsKIoOEBk4j2NBqiCTEPRJVDKfJ7ERuSfA0XR8QzbZmxP7yMxLBpw0lgL40ym4EtkRmtlgq NJQg0DABV9yGjq9YLDdQ/UZGKBXexhSXOGwKZAdDHH+pkAr8UpQ8MnLoCEJ2M8hRhFOKyc+q CNICISmXO76p7yaMmlZBf1IOQhHkhDR3DZ9DctS9q4tcXRdDLdgm3vVUDxTMRJHGkbmQqNyN 02L4sX8TddSJG8TfW9DvmMHuxriy8kZEDKeULMoVAYqqcZUy1m6Pp7GDk+I4Yai1AvhtezrF eExvdougiQxYOSZBkGvKZl4N4W2XAP25Cjh6epk1GiLwwJM+XSks5bHAZ6HsFdlKcB7ctVBz YY62CkBl6G3qTTV9tKIm8FpJCcnfdgIWYgYDhkruiVZafTIwWaHUwFHlD5AT9AH4HfcScEqO 1BPGHLxxq6EkHwldYZLOwFu48psPFW2q4b8+Y0IO6r3L2UB1IwZDPDifTwdt0VtoRcjeXQqG QVgcm0MC3GET6FRoVEtYODZN4Bm71LhNB+CECIEnlQw7EPR9gsuBVJJkuxNCCAKa3kxE4JhB AVOySwIy6kONmDYOl+z+NkhRzlutH857JP1mhEUMP04wfZo3OCoKDAjsw9OM1PJSCHiD4hmV nSdYDwZlg8x15OzckK8gvK7Vn9jkzERkyopkOsET5s3KZKdUj3Hz4CIeFsV3Tk42Wg7IyhEs SRDNfJ7Q4IpSxiaPkack4mFd11SILFZXrlbSK0QyECDkD7oGV4VJhPgVdEokCHRUJezglhwO lO0gdocp4BcvsKZ+muiKBIKsM+ht42UUBlJ0DfyMdDzpcVhGgcGCg6lDSy4Mj4d4JlRNWOlX T9hpB4QEWXqdBFRQhC5SDuIFkv7bsDvGHFJaEzwWJhhSn/kQlMPgYwCQkUFA3FxjAaMUzWUd svx8j4j90RsuzSxAQTOse2/XbHdiZyNTVlGpEErDZ3emGsp+uuFEc0BYWalUXj8EAmrbFvsW AHRZJmSptfSA0Cf9kRQFHlMABU5wBmItk4QFhgo3SSc/SxRElyQ5HjMRvgYYK91SBx/3RIZx t4GyFbhCSNfoa7AcFpbXA8jzcOjsjUEFRbJBgqRjbOj+Z0tjoqruBwpODuGS9w3g/XYPfEkF ziP6sIpKAsc2L90j4N7mqkI9BnwI6F9mPE7KltN/MichRwZ+JhmS0ctNElkM1kvYGGlKYing j8z09/06FDEPKUlPkrKHoCRlgYmQFw8yVWCHCDAOAQeSC1KfIMZ0Ql4AKnUNpVk441ESl0on bnATDKZUep0PeGPDZbjRwYrcYsYjwX3uGc4PHQ8egrayNIFK8hPztPOXDnTI4Pew9yMxjiDs +0ZatP73JYYCWQxIAak4fZjgu0CWRaCwqtrp6081UggyPgxBRhZTe2EtRWZwnyx1OQGvL7ZB FHn/d7dvAaP8akwLGEvaTg1ATSjbLwrIH1F0JAMcBBUHcN1og/RnNArIB0hyem1CBMpv81cw rkAseXEhBsi2KO7JZR0cHAsFD3V2+4spwkwzKwQ1HCdYveYVUk4KRmclZX10+Y2jPYY0H0wz bXYQBHlgNL9b/4BBfHMOD0ZmbStJRG2ethE6FpJgHhH21ST+qNvXiQEVBS4P620tP3AFBG97 BE2QM9JODEBAM2ZydYy2ezgwYXhrkwMyF0If3Wyr7RBBUHIVBFZsYGrDw5bDXc8ECkgIVbJ3 l4YAkiETK4W9kF8xXITZGsAXleg6NFlVWM5GHck33hrHF8iW7xfGbrvJNAza5BU/7BfEmgd6 lSiTnmNSC5TFhjvcuu+6ummuC8QBjgvkz0eOmHfCDr4AYIxZHHd2iwVCbRJWSDNt4UPrmwVI qzlkngxuv4UGHjW5AyMHQbdjXEVTHlAIGVyY8cJcbaAkIuZ2MI/tdmQXsmI0FAIuXA7KJjCP CwqtH2lYVlkhRgoeSksLr+dDAB9yZkxx3SrJWNI+SK4aYxgSAkhdIwaFUO5jplZ0IiXyhHZu IBMCTH+ikp3dWRq+CTD6T6pddQ3GHN1kpDxFbg7VKkkJFA9MB3kjL94zXkowJAxJpO8vpUos doo4PToe42WETYJ7K25YZCANwIMHaOTUSjIINvJCVWamzJd4/c3YO12GBgSrZlczvD3w5cTF CEe62Cxfts+DdLH67Q78FSt9SlYB1LoeeHilJ8eXaUYxcB1lNnsvujQUWEp3KHCXHx1g9J18 xsuDfAqNJWQfXAE4FGbEe9X8yXR/PKMWA1oAonI5IQqJtomnQh8VGuGpY0uYILonJQBnVGhC MPxqOQj2+XiBHonFJ0Q3Xm5fB+/oP+s4VszrqD7hZOJZ9AYcNP9Itr51ZUfjFTYRx9HsxwO/ V3Ze+GfldkIorS9S/VY8/IVJNdBmySU3YFQ1/MH5h0+/HnFBR/0i/Ng9OHhCtIY7OIoK9R09 ZEwDh2yFiZWA9v7NxnOz+4X0ns8HHjf6L34QHM6/UapiIntOnXUGrEL4CXB4EueMTUOJoskV UCa1ZpdWkOw4sjMfJEQc6zZJOjQ2Fp0YQScLFgpPE1FBu28fy8k5+NqwQzQSM2ufxvzbzCyE MN4CNtL8Vwpiq2xyZkJKTnhyiSN9KmyBG/ZkWkocahpqBIpAjKf7DgAw78N9SJgjBAdaXyC4 dxvUVYdSX9cFTS6U8QdjFQJdcCQhnVvhl08FYHqG991BOWNyj8N/AZEpPhDuTrNHPk4PkVFH rBFxR4G1O8xvdGUhYC5S2ztLE+mItC1gT4TNMOw4gv02YQtOZGDgqeQ99GGNm1pSjRsN3c0E n1dUG+btxEf2yWxVZzyD6gM7TFJ7nbRleCCDryiPvZnsxSwf5PCHr/3VKBHQ9pUOXquQGMsy dP9zxvAUG9RwZOkObyiZ55Qe99WLDIlUijLuSewGilYORgPOUBUSRM6CCx8CFwGMAUqER9i1 rZ1ed2/KKf0XDHqx6iZGiE1Xo/D1vRkN25iNHgeu7ORNNpEN9i/icW/RqD0kQPzpZiecyDQD bmorsfTjJiaHyplx90r1Yt3HMjxnJnd08AjWQjLkRVKRhYdRlO+JiJYgMkQZhrO9Q/ju/ujB aEXGXQFWMGBS+0gMhaBjL1DuYYiXekFhygceGgCGRPz1BwbNAGDkCNBSBIrmRMSMOhHNlR52 OquhaXpzpwGPIATcFO/OKlLvDD5XmUKyTNVIER8NHIZI04ODEqcgSBhyZucqDyZmBjXpEQ5x dt+6EWrFgNWSrvfr6vn9O4mfhc96TMH/zXKaX1Q/+Z/Wdg4cFj5pcy1A3iA3LPYHHOCF4nxl jFWcS9XkTrYAXBUvrmE4auwXw9Mc+Eq8ERnaTnhEUgA2gqpPZuMBejjwQoBG40Su6B5bPq8V ROP2TgxOJXQjyPNZ5n4gqBC2VfTvC+BfemhA/roWywqHlnjSi4JnIpPU6BYWQ24FJv4AIF+a RArAdCEHT7yrfBp6yKdPh/Q49vQQ+JxBgoi8SnYbtabgexcdI8I5hHRI+qt+pVe0+ih0QzVF xr0wxp92JKYQY5ufiXEZ/QSwge0ljxQEYg7Jlky+BRpKugUxBhkcB2pZsBO0DuOf86TG/T1f t3KHuXQ4gXjGv0DBQ63Ly3B53+uYGDaaxk0IJ28DG8KUBz49iwIUWliEhRYdHJz4s7wWtAMP +kIvGn+f6Xb+yX7cEX5pLYiFO5IOVlls9zksmYRkB+gJy/2oV/j6HRbNjgPUVvwEJaKOHQzQ +B1rBqF0kqvUlcq2QivzTj+Egv4IgzbHOlR3ama/dSlR6QMzB9xrwusKxi4340Z+AQAnMAkZ g5rZhQatBxwDBr8ohgExUFksXI7e5Z3TcYp6meom3AmCWjWZQWLNhQz1cRL0biAOp0Tt2G7L 8lHunMwmsGrf2AJN7cTWqGgEIY3YyO0BwzdoUOvwypGZDOuUZn5yQMhOR6xX7qWhWHy5FNjU diEx1b/WkQgaLGNsIKCLHAvk1x985zH4JyIuFkjtjUQmzYiwgwnFW9bWsI/By2JCQvma11Jx c/NwEk3CH2Q6eW3VDXhZO15mywVPfufqaviAHeFcrjcXf0YOborK5WtECkI3MH6R3CoCKhQT TCZYF0ZKVFtwWob0ELZlcI5ReXAqr2e4ukZq7CJIeT4CKngSR6ijD7Yla4TZQtcEIlS1NBMd Pwr2phQY7D6qKXRCnU/GTYlSBlMyYWcT2STEpayqNPYjMy3CEBbeBJ4QUDJzz/JdGcX0D4vW iZe7ZvbB4FqodrltCgMqotkHIhxIWnHwY2HhaSWdDowphWy9kEUyNLIqsBdwH5mkNae025Y2 IPz58m0ay9CQVA3eiJQ91wVTh0KvmNJGAJmQufmECkXHoALBIBQC1miO5PCbeSWLQBfOqqik gL7fdR3OdB9WDml6dgdjoQmf52GNQRCkh5YL+hQM8uFmVW5nA/FYpAOBdu6MspJPIqVNEDtN tpABJ4XlxABQFALVOTQBhG4pWf5uUFRenz26KJz/2E+Q6hkopARVxFzB3c7CG9rEkB6vKGdx Tp1b1W+QayvDVkl5Y0lJU8P9FE56QvNYwhjIM2kpGHt2TZUFhChUF153hxGiH3hkKjR6acTa yJzBP4DDhSnccrszDeamcZSjecLwpmD16G+WVve4DVcvcVnVBwy7T0RPwNN/ExGB3fYQ8iub MHYSleiP0OrdmB9gBwx0EulPg9z9hYDiQVBr5d5cCqsgxyuQYakLrCtZINf9iFaqEnrHUipW BjBg1vHAFu40BOKeh3H0Uvj/EgNzyDW4ZZ1rgXv0iTFAl3y5f/OTqzf/iQFEOxU06BpCHbAh VfUJGEpeBY3mTWYLYoHHncGExNtpFQWPsmAPZUP4Q1l656BVFNR8GT+O7/z9s38SgT0oFX8N /LUCQ4v08yNxIv51ZOjFBSyvH8r+JMQFNRVEPWQYNUYX7TmdYSw4QDx+A244dHMqeRVufkQz cxoH4BVlOWVKQINsMq5u2FJyB2HlRnMIK27ApaWuU6aWj7MW8mIC/NU0AdvGsaGbWgIFVNJA i3Qm3Cjs1oTLP26BHhV5ngZlploU1wtqFjOyeMBIIlcLIraQ6jjKXVtHajoBz4+LFSZYQ0Jw vp5g09w0CEqMY5qr7z4jFZHBnxnQDpSUWkPb/ZbmNlRQbon8vePaI3XPBDBWywpEUOV0n4Fq lGMXz0M8iW0kTWEPBJJYjlMeS5YCVc5RmHZV/P1mIs9zJAsguzJuEmBSdnABBzgWgIVdW70b ZL+yn9GcYl/GPOx7LZS/KAD8zwJaT/N06WUg0+zqEXAc/Qh8BIuIyWBc51JGT1bNwPGXd0rC 5weCPTaxD9YGwjOEhHk84EOMwF/Fnim12KHBlgdtcelzOFQQOlxc+1BP9cPClA+4b6k2kBkJ AW5OLCvPeyQWNBhfFTOW8DPwSKMwfj3w1JZtyEpIyGFCNbbEs+RBHGm2xD+Xdhx0t2uvmAnd PGBpWvCWAwtI5nYIeieePLY71EpygIgdDW+OOyQ0Mp4s15wejMIsModEN9gJTQwqHGb24hxd cg5gnMNaCAPA3Q+BeCVYd1NOkANWpAVtFPl1Pyxt5ATc0TvkfizoBAyqZHEMEGaS9USpFxT5 dSbzhHj7+cXK63Hul4ZYevYsRPdvjMgdkv8BGtiEbrc4hPFS4Hzdx2grumIXA57UEG8TTloH fvQ0G4bpAZ8Kzp0l6fxAGG16eFd6cEw2mkqb1RYWgYniQWcVRwoKZMTwwPGor3d6Rg41Oij5 dhcE3XNcEpYBanmcCgWvRMZ2Qk84uO8iJCBxDpmudtNmKYbaBozakHvfuA0ohg1qk0zypkuM aob9rhJwLAqhggOforv1TNkLFBdZPY6Qx9zUSTjZmw20QGyaFl2O4WUx3yLOLqFCTmTWfgXq Ll1vsGhSBaR8ILwvkvtV/EAQFmIhpE9WMBF5xUxfucpZs4mdEPI/fvluJWhXO1hyiB8Uml9W iBU3HwbTC9mIjq60iebOg8HsM9KOxDD6Iabg1RJOklprTyOhvv5IktJIkHM/xDQKexb0EVq0 DLV7dacZ8AtoAvJLKFTV1m9xVRMWDU6OYZs7BPDkYqcwnO48UVpHIbjLJzptUjGdXUD6J7Rw dojHOQOGmaZ1nlMhXiQrBD0nVxziE/QWcf5DWq/WA8J30MdtH05T3LBaOuBVE4yeJ3Y4tA1Y hw4mujPeLT0dEOIxxBcdMwpFkU0SMxQfFbzRSMLztBX88Ri6SRJHlDSeRHOIZy8efM0HcTee VHLCG6GCwoI0cGFxUTcEWiZr4P8XkBuEkNVYijo8LoUOUIZWPs81LkryVax7GoAHy/CaHu9C v7CLigzNwfeJvhDCzXJUlbfnvzbDpaQEsvyEjykXQT1ctjv9Pb07QSAvaToMHy5eBNRqblYk UdNAGnklFhd1xUIuBjKIQu1OOLCETVNWyeZkTejxJmtV4PDSRAoBQFLNb3xjfixUmmSLbAoJ TTNyTX1oGAEzuddVa1XZ2Wxd/QNPYesgL04ZUH9nkr1GSP0QWEn1CTLcda7q1UVoJq7qId3i KwVHL+ozEU0GnnYHzlSp/wYAU8lG8Ip5Oc9CDUp4ydvDcqwjC/5XrrLZRFlEvi8v+jMYB2NV OO7KzVYl6Lzw28cNEpCg0YlVGBB3NhaBhYqaQ0nE+laC+cIXIYh/HRzt3CqrLxZYCgoD+xpW FkweSDM/SHd/HncmysP9KoP+JuA599y/GBUmMTsmtY/6OjicY0F9VjP2dzR/GTQIioeGFVep UwgWHe2rQrohNH19JCH3Tfw0PDIYDRyaWPjRWINsEXwVhK5TCp5LUQydwLsBG52GEv8lBw9I HboFF+wnu8PEnvqNg3IIqFd/Cmdpp318W9y6rHxenSxSevHFicpQatVGBhNAL3R5Yzaj1ODt 9PxgTuX+Qheih68+unVjdov2DE2Cs8xgB5SjZSTEutNmAM2NTRfUf4HVpqlHlIZng9w1dPCz L0oWEonhW+bDwyr4iao0XUZgpPjucd7wR3TQlGWMEWgD+jLiJv+AIm5ISIaOruDXFLsCRjG5 g2nmu9g3Gt6RpytqKPk7NWCiKfTxPKd4C2baxMC1DenXc91QAwgKhZCMIr7zhSxA+xz2y1XE W3/kNm4HMFHyqg/cEE0v+P0L5M/UtxImDcNRNkVN4B0cXXJUMF2AekqGhjDcQRb0LmIdXODN bZSqDiH0kCwzReEkV8z2zcrcYdrW0s/au4Y+n7Pog2/rF4EwGJjDruwJghpYEvpG4H85UTj4 OtTNBc4eNASix+AQEDBHk8kRC6JAU3cXAYDmlxCCGNPZWDakfXxpwBOBVRCPEiQQDUOW9D3M HDCCpf9yKCBFY7RrwRyKBYs1Dng0Ab27L1U5DHQDgr1JYRDGfAhOMwuf1auZnWElgLh7TH4I ftRXHYRWDh+Aa5NkItc+sAG2QFoiYYyWNqsWgDi5GgN6Fo58bQL9F/0OUJR6IA3SQkMSEgdi O1OiAWz0gH3WOkHyvdZPFWZACC5WqHQW2EFBSpqbvqKSE4CLvJbWKYrZk/qC8G0pbmBjxUAf RoxkRIEVGPy14vBBZkUAHE82rWxEZlBcheBEKBuChugKTkN1qi2ttiIfVy02MayMF91GhIQC StFO92QsAv1h34L7kxSBqocb/MJIIhPDGCgRIbyzDtyckrIlA9wYBD6GukXMDAzvmBmjS+rN XrG9pPu5r+f9tPTkIVoHGTZj7AOFVjKEXcK7lJ/WeJDeTWOQxCMPVKIOX502lSkQ2G4uKF0o 83vfzswLwuv96/i59Ovzz4QXNMc2g87NiLwTFqpZYplhl5lBFmzm8YQXauvHkVJDA8a/w5gb 1vQEZi400BuBHkE6EAiMnKlEnXVu9lQTYlXvp03ytlfAMAPAD6SjrwVQ9s3AUt6W4kXzcz7X OaICwKQMnXrTaZICpxfJPgNgPJV0Sa79ABPWQhvQf+Br/AlKodwBmvMQ0XJNxwFeLFRWLk3H NgtsZHY+fJQLLSAhhihTME00kliI5gPYWmlRTykPKMa4FCSGMhfLVbT+RMkNbeTbT10Dn8CF GtPTiX2Bko8DDQwmw1/+apL3pYG8n3yHxygyokO5hmqY1yOHks6Fgm/G811E+YSmo8hRCotu JuxatgcT8Wm4Bt/KsH3Wa3O0Ti/EVNeG9NBtsBQFIVTJi6LAzM7YZEsRxikBPn8T2iRYYBTL Q1wi9PaRixovWFB2K1Jq8lsBObY+AtE6VllHEAnrAsyAHHpWzzPZB4bYl8FZ3NRrAc9ngfDk TpwRjphq0A7FnfTdMJb92SJQjhZi1hE0v7/fiX72HAGJiDPGugawFAI7IFx21itPSrFX5WbU S5K6ij88YEcjFypeRd49dxHtmfZBMAxGbkRSMv0J5W6JSg6BRhxrdkIJYsJO3wlbiZlaISgP 6UpQ22AEE+N1YgZ007AP/xxi70FCzqevVPxgmS/4FRxJw9sXQWsQxJh+wMKlUzsy3Ua0BOOW pkEKAEthIRysnt3OblghgAIwwWLqaG7B17UWoLp2DpHobGJ64ERdBSw7Cl97Bqedm9KLVhKY zPM2lbhnTNBl55Nyfn1QOHczG80EUFunGo2b/379z77vy1g+OTgkH2nP+AwBP9L/GHeDTJM+ wA/a5oegWOHs2VrBTKZxWXSYcOMGYNZDq+oef+ACJdwzbzCxI/pIl6kgEGGLZAoNHYpZ7BZN /S03LwciKOq0AU5h75yQrxD2jGcB3gGicvouGv5Sg6o6NX+SCnLB+FN/o1fwGlPFMqkgMuoy GuFKaNNwyCqL/AbZqddwaswZ0QTLCI3YO3xq8A8KBisjCulAfcPHo2K1heVR0vxG/KLZhVdw ztA83jrMFE5m3+TWHQREVFyiw6MTVmaRBvXISiKGE7cBtBASMu0D2BaggLHZRwNNA91kiQii AjjiLAGveo4TAnIAfNcCwKyl7lRYp8Twv35ppxDnUV3+2Y/GooXnqopHWk/oTYyjZC1ZTlwd mibwopGrkXCNHmYeavYyfgzVFFOSSkP8/mHgOiPZxXnrC5AHoFaEszPGHSY02PgFGsWFbMKT zqbQY8vSOj9Un9eF80llSsnPD17oLl8mRp9HA/MYcMJFx0ZoS/LYzkC/WxFZXkzgSFxbxARj QVE7f14REHUi8udYiwYJe5HNkhdiFpGYr9Zgq2YwgIhOEmRyWp0zUPAudFNaIFl8Fk9HDCEs yygKj8lIaG8L1I5LPp9UpXtKEGkWlAaSCpjL4Gd0GtJJ3Lani7zXzBLx82AgYpgHMJdJIpmw e00BZnY2WJyKY9TmW7KKSx6N1JwaOZwYmkbyW5NbjvAn0cCFJobBA0srkWg114QQ5eZWDd2d K6tCmwBwkEZybWwlaGamXQOUbS2Qd+Jk62KjlpHABXZjH9IyW09GRXSUzTSrECC5aWBrJWF4 USN7l6IHQwOPpS4Wi8rgfhk1ZAQFDS8J8nbM38xIg9QmugsLgCcG5Rj0EpvR5QMmImmS1cbU FuGb1MjQkWZ/6wqiRIciA1N7YS1lYSk+kmCRcgOEbi945v9UhUB7NmUVV0cwGZRud01YCEJ4 MIAKjv9d1hkIcWwcExJM1kNoi4MGQVTpw0xieg1lI3/J2LVDP1YAHjTGCw2qZC8VC/oma4UD MYRtmggGAH+79JG3Zm1yRFxWQ9FDgErShKU5IveAjEWuTOmN7XF+RqTIhd3cF54OngJeaJfA oZanPKtOj+wdQxNY30UEFQZEBGa7M5fx/LkhIAHZrLQ6Tw+k5OMINKHTDP8HntkDl2Zcux7l WQQMoqp0Eqxxwg+ed4Rxxl+oAbJzPok0Q8qwqQbdCz8D16LtKD7a5dg7Vi0DGBQiLO8BQTDW h3GDIA0SQXYtNGHxbSLfpL7tBwLSAbWJElNTG3btLXXFTsOCapAPlZ9bkqymxu8g5T6bEURd rLnuoWxPFGrO14VBFE/A2C2+l7bBFJVbknvLbgAbeiKEkD7XndMe+QC6cl63ME1GrgQJ5g1X WZ62OL3BBwComIrfPNC0G71LkCKqYsSQUzuq5JtAT1NTdBDaAGqr+vfZkFQFB2RwcCNzZ5bE 1pBTO5LokEzCmOiiW1IyhpOlw+4mEPluZQWp3JC4BOAvE/Dda5CuKgdHZzSjbmy1dn1hI9gs I0V/XfG7I1htKWthcmRIXKzrKBsLRgydbO4hfTxFRjJCBiTZlaIKFAsMUERraPsnCQJpZ2Fg aHwPRls1T0DAdednaapmZnBkD0YHXLjZiUNOkWhsIz4nHAQhDiTZExdVi6Ih9+YffkSgJ1jb mE4yDFNFULBtRETVBLrYlfl1J2Ngs0hj2Cz+l2RLEZ+yRl+A6Alj69StQ2XPQoO2FoYHsKhj ubS0OcZR7k2JSfJA9LmKpguuBLoLNQA0uT14soibAtTUBN60lxU+RDPPqdwPmUeiLx3XQFxz tV+pGgc1yI5L7posaiLM3wkiTwQKApffg+uyopj+EoiaHxUPy+6Vi28Q1d8IEVNVt03II3sj q49B57hmKqIBj1rdShYa9gWLQfuwvmVqn8CJt22cNkti7MWlmgCrLuSaaNeUHwxsGxD+KKB0 2s5HPIsxUlNpbBpBaAYcHlPSaLwYMX8KBU61uWdbCFSRgYRAtxUiJOlccX+KaDAWNsaV0KSc Jf2BOEItVEIrAohOwzMWCnyyTNP/ZpTCvb5At8BUHU0kAvZ4RBfGZZIAfcWHCKEwx0kKwJ5K iHbbmv0GKTgDNBMbhkQ+6spBjky4nVYrIGtQYRZmxhUHUzu3eVoXtpwT1LKUdHhQ02EAoDKp A+6Wbx7BFSdE1iCrZiv0AlCFYUpQfAFVw7WGEVWcU4NwBHwH0H56asvjffyA+bWtl5gd31xN wgpMADROF2XD21ZymasDxH1xVRgKEohM4F1GpFDbA4l1E7PXtIcfocU9GXf0ZG+OwgyQ1mHX AbQZxX0Aj1uHENoy2lO7UrIoHSfgsomeWM8Lr4ZIsv4Cth6CYAdkLMfNNTE1ZfEEGv8iXwBN P3U8TAgmGP8JQQy0mncHZdtZgGx2XNErDEZ0BXsV+lcCdvQ2Qe6P4wPaHW0GQ2ubIE8ApcZL cGbQhBDHFwcJUwG5gwYNMUJtTCdtcQX0BxfuJXA3X2UWkvMYYUqJdUAORIaeWIpNo/5vBGCT hPhAHmSLEayM05RVaqGsv0MrFka8D/g2arlLzwkGuOwKOQpgJg50DQC8/6ttZ4P8EjIHEASt FKQBrRKkBq0OpACtCg2gGIjPBPYFy5VrtlXxFEpQTw/4MKgO8YVk/f7ib5+KwdgbYG5stkGx ZiIAmANFqGiaR7MjBleC7ODOnvhbozKXgcJBTacSQm+Q0TEq6R8S/0/NgTNufc1G+us9Gwqt eVac1i0Y6VsQ/w+CepEBV9qfIZFLIBRpUXb0df+nFnr+GR98Qzx2SL4Vnxu7nNCNod0qFhZX ax4MlAahKOSyqYBOGAxoamRCgAlbVovh7By+FDFS6DGCAEYMUisnLyBHQMyjQsYBfrsfhT7F /xF8Q7/rs8UdFtP7xgZVdSDOGAGe4BaARq8BTgIiHWkyRwYkaQCRV5g3+Sp2pPQI92t+JbEV W7R83xDUXsSCWrgET7BbYRsls5DfSKZ/s0Q7ysFkSBTlywTIuEOzl3lLdRokREZive68V44e h4WiHX/OUiaFHYorT8x2BwevtRK6qxUJnPcgKXcUbrNQigjOTAiIDAEfevV0EgdEBp5ARW4E yWFoE6lCJE3ghnaXKZxwtjIb3J5GK0clDSB8HPh2KRZmVoSfAcFkEKXY5yDSJgOMAeQLGioB e1ak56CuZB0Cu41IEwEbXq95AKQk03dBUBiOBgiVFWYbAkPszhiUF/zIrvGssUEvDqINARmY n3If/Ju+goCe06+/CiWYVJLLgGEDDM5On3gEQC7Shd0aEqK3eEdK1mncX8KHbFpn7XCYie4e wiQGgKbsFCTwN/pDP2Hqy3gME7WlbGyfJEoYc5AnWxcBBkj/zxrGwpu4QdjUZZBlFdim3HA4 0IdDU5IQQaYl4rSWnA53OOrpVQ5Y6g0vQxgjEiO9ZP949wP6lLhHL+Z9ylbSgRXPI6eiqSlM udkSRRenEvlgVOIAoj90Sks8BL2SB6fntfTSwsFUP2VDRjOeqkFRKgWzeghy4XMzZbVNTWxQ E+Y1LRMVVmCWxNNDmV96rh87pKWJQFBDwWVYryEQTLwnmEbLTAzVyaoFDUUtjFzuYIOjXCVc OrxmQJqYU4oeJIEBZYiCFea+NCAseBIFC3OFnyGzCuwf0hTHg4FCUkAYQ0tRk+onIBjNQMKX W+ui1SMmcrg34OyALBKIkTGoGwYDSEZXQ5cJ+3dMeHIRV7X8pKlrNaKHK4ptvkwE3SfvjxH/ z7z4sgqB7EmO5BD4Rx5Ry4U2UpkhGOxmVntbuXV0pfOBafJ28HSu7z+uFB7GhsNQ/rTiqKEr puNATfpTv+g4FlmXT5IdZA3On5D9UzScX73rXTmFfYTfI7sBD0XQpTaHpciBvrICqkpAL9rG DdUMUGT/BU4eFe8ODgxT4POeIv4bDFQL40WKUldVr0QdtjhVrDZBx7ZXikyJWQ1HAzs0vCdc BpT2D8LF+aQ5jHUZs13QHRmHql6pKzNtUOrlz4sb2W527o494sM0nqo3yWxa3SbsbzMjvBjL QE6g56VrDQZf9pb2YfoE7lfPqjIVZQvpyLMCQME5jgX/AoCer+CQIxlN9jf0FgN7FDGxDmwz QjW5PyieQsgMjOY6U6YLBQuimKYCjfZ0M+6oH+62LcjaDngUqj6ECDLmEQmXXIVaCBCUAtVC aLiULnIwdKfJwQEDKVK1hS3/EMBveeSkgNwmls74Pl/kmQ71WRWBRFBAW14CpD2n+Ktqz2oK DVwysYrGsFEtSbES14XuDFIOgsdLatwBO+w7cDkFLJHE7NzuwqUsK3xMDZzSkkZ9wSGLozKm EkZETI0GQtgBsmLXqkSyAm0QtW8MP6IrpxIOCtsUbJtVE4xcTVfCBVREDUhBryIUULMACZr8 yrvrID5EdSQsvAgoGK4CfAfVKF9O6uwER8Y1IUAOXhL17EK9M0TmdaVKljRFRacd1hnrFXRe bxkmaQZMdgfM5be7pW3IzkhMgr/CGSPsGX/jNPcyIkrAPSdhMZue+X2UHnbnQ9PMJnSICmoE l4fzIfdVgkYVSjTkUM1U8HmjGuJCEGijUpwGEQMyFQTpuA+rCjMFjTqFiVY2gUIkf4IJ1TLc ZSg6nh9ZWkZeFcpixhc3hUCOgdMYM47GdL+xSmCWHH1TOBpF+wR56lHlUT4dlHkN1wwDTSOf LtGVqI5scb+4jiETsDmsJzLWA9xWdqwudsEGOjmUJlRXPlPMNNaJM8Ht39xWjiEgNu9YNAWg H7HcrYLa7oVAE1VTOKrCp3/HBUmH9Ubgaa5N1K0EAXZJdongaY6WPa3DwE1YrBBTdyUISkjH T4UYXpQK4EGn9EgUqdTlpIfxfQxGBpHxkiNacF4eWRpZ3ABGSSVURGZ/ZA9gUjZwYtflhGcs IXhqF5ZXlDQMYHJqHd1ijXpoNz5APoPeQwR+XMFrh9Kdj2IhELpy/fMtqRAlBopKOT+GVrwT icA5jkPKDJxtBtPr9Wy+PIgBCC7SMjniRP0zvkuTrozeEQTtbgNdowYANOdEWcaiQFK4uu5S BRhMQz4QlQxWJHTkyP6Ee/YRCcZLVFqFC4aFEz8fcoVruy+tkajmjq8gykf3FSy+F/BEJ2xn hSgZ8IEVVGZ3IwE6Ac4Ee/d30p5SUEQEAHHEkXzNdy8zj4pcQQII6P0Et0sCTo1hDc18HAV3 wJ4MfUrod/F+tVnIXB7wWg7iwZmfXXekb0+pt/kDQmIOFTu+fsmnIQU5xn2ALCVJTRBZvcJm 5sOve7X5gmCtz9EdY02KU4hsgeRQqO71/Zl/z4geY4CIGAqRWRVveH5YCwIayR4ZO7LtGfwe GpTlmTnf/vEAWxNeG2Huq+0iAPcgg+mOP5TnmTqiwqvtDumkHZ5uXJF4GgTFhv2ECezlDXXk jeU6nz31BJQ9Q7ZJoUGDxU1Htxvwua2+tQwQbgW4sWYJMQ0bvY8DXt7sBSjFudGa2LlC8Yx/ AdWIR4DvADQKatcwx/oFQnIWBDUfB3FWBJ4P5AAuh2OWubdIT0theQwR/dnuq3W138OJcYsi dHjbnt4CX45cWFcEg7yFYQDPmsv8Kd1jCsZ/H/wxD2YLxvYXMrkWwiAJHn3ktogci07YkomW BkVYiFZS/jSzCHw4EWYIuQMs/VHYnO8wTOvVQoHzSsAGy/xXmm7Mi4pYCkSsLMoLiNyozh6x ZKjB56Zjr88PawBaIOfEIUOc4Jj9uGFbznms/juasQQmaIZDZilChfBVm3DtLQPsIR+Yk1F2 uTw7Iuz4C4OGECGci4OqoOSmjsvXI2f+AxYFbeWmAuqyNHaIk4dm9pOrxBkokxnMG5TpQ8YQ D7hEqYdcoNgRP3HCk+klEq70QM9UqXi3qEKpHYgfCA0Ah+OjmSvpFtkrFl7IPGE/oS2zGfO3 upGLvpMTI1WZHdR7NZOVFkysCkUME9Ey3R8BazUXOn1g7fQLPlXbWMPJAJ0+192ezSrBq5lc rk7UmTZOYeZAzlSCwS20cwV/UadezVrAFVC/uXSE/2Wpd8fPAaMWzWyCE8DRHTX3dPKgQfdX i01JkNvkgBIfIhAxGC2VpiD0d/QCA3CDIFmYVciqIJLKATp99iP10ZwQHfJuml4zH6z8TuCf Ru5sHaJEO0N/d4sBFlJnPEKowIYB8nUrPAhCZNtHw0OnpY50bkjJX7bqjnS3QhwWO9e1EBAD BSsaB0ZReiVlZIL6pC8fGWShZknANDowHNO0GuwmY0fnBAsScYONUjBPi1ok0gkS5FyfBwts 6vK46hYLsbpR0QmUORqu1ctMyOrKSAN3fSmaBBBS6wy6LsOsAEME7UN9IxczbYPsUp0cRNxB AlDPNLN5t1IIEAGtCxcGRoPUQ/k7i4oSxLRc8LSeB2zw00ReP4tKSktcrlaK/zUmhUUSAF5F HVp/ZSMVV5j/bXgJnq0GE6ps6AVh5+wEZY2WeTtK7xwYdBQeP2ZuW8QFC51xBNjQF49we5hS MOR4ax5flBOjPkPWQ8reFAEeb0L0FxvoffALmsEA1bb0nE+5IJI+rcjJumcKTICR8lJKsqnc P9G0oapUF5ZMtoHXMaRjhOlCm3SGXAZxd2zoDRiS6Z9GtzpUnkIZNKXx4gkHyh26cgP+/zCw YvobLi09LUczTrSPELZluDDLr9ENlQLC2GAaMBChPjJJBEmp9FNgkuEQ06T0hhQO4BpK2rg8 JNS5OCRZilH8lVwxjnqBH/ayIBZcxOStCKAIVwvhmQH9D+SAP4E3ki6uuTAkEfIcu1f/sQ6D wvMVdpAx+Obp5McxCIgKSlsrBtUOLTk9AWWxAK2gQLuV/MEr+viKAxW3gk7FTmoZRH4Ve1N+ yP/salZ0InJtAsgpIBW+TtIqWz/ntvfAn7ZF7/oGUXpFvQSTGn2ZNrRRwmsREIXvp69bvoFo ukCwgXNozAYqZq+w9mZNMN+ibrJjRAphvMJHSmTUnERyQsQFsaSzr7qDJs+20pxNpXCyWkax fmOLMYEhCAB58M5BPydXK/6AYS2Q1wugd8bDvwhvM51MhrKigeSIFu01OAGKtkrYL2vTdATK Q6sy9TGXBaJkZ7l2ZGEXh4HVg6KwrzXMsjk7xcNwTTMWv+RFaGEI57j0RnhTEgU6z3y5kh+V vg67wAgDTftfyuBxbDOAI+ZFCkAS+IgRogSdf6xEG3+VObv0BCticQVAGx4FZPI6tCdyHjX6 HBwSdBYFAzo9Fxgd4hR3NDUdKA/oD17OVxQFnWJhayqPyCdNmF9qThJQcCc0kEf6dzD+Qd3b 2AvdYmM1EBMSQ0FGFUOQr0L6VBEZI2wTibgTAvH6xBwYEkFwdFMJ/KjqZHcHVhdv7/BlGy4x bidIScOit1B5qS5OFRcxtGV2Cwd/BANDV31mLg+Q4HkBEkojaXNqMq+pjgb4W8BFEVBDM3R7 RCphc6wm+eJ8+4gfbycXEXYvYxxPoArJjxtheAoWtJJB1gmfPpYDGT1HxZ/mAGOqOviYMVNA 6MfetSErPVkA295G0ZwClLAgTzU72/pF0CRi1sDHNhvX4C1iA0yylk3HdhvwLxJFLERy1sUx V/UP0mT4Bnh1T2OrxfmMG1BbgEVvOKBv0XkSZds9+fTbQsvDmkYA7l4op4RalNwX7o7bSIas cq33xvOQ9vKfnMluJjDBQVUJ12P9+/3v+UnVMydN9a/yDfCr82X1+CVJuGYDGPIaNdsF5aFs yUjuhRXJu5q4GRJnF55VkPPW9ihBJ2UFDmPhypILxDvHRwGL+7iPMQFNDVxtMmtxezUlJIS1 gQgBdgQUEyzupwDjZRIIFwE8+igB8UL8FGauQ5+crF8eVz688HQS7bUxHPNFOGCxgg4dbfjU GANEvrZRZ2NaNdb2Lmfg9ENOIZrf81J8S/fze3I2Ie6OWr4kgN9TYWBaOeI/AkVnS2iL5yqi +aMBTGtQZyBhYW4yLUuYoXLlNr8AFQkDbnVgHjatmyoh6DG2I3bpSQ8eRTTmZHIexEbSNCy+ qKuwOkQGJBlKDtgYAktQIiYyFGWwiw0xTmbYtiDFnRp69oPHH+c05mJYYLYtXxH5DS/apF1c yKUzyPeQLk9SdWZ/2ykIeyiZShJIKCpcOLiCZRE4apSdmV/bQ2H1dCJE9ebOebdaEkKBL/hQ YlcnyWLGrJTCjqDEKooTM4UeQdtvIGScH0VnYkOmDAByYsCEAKMhfZJTAAajDpo7GWq9PJre gJQpLhZlYKglCYNdwuTphSwXAeYZpF5JPkZ1BioqAkcEJMVrjYT9RwuwAkcMVCHeQJRfkSOY NcIHqAyB0j0Uk9Hz7QN6/bhnaBeSTiQRxmZPe/TlBx68jQPGOVO/VL3OUVrJQo5pEUPyZ/GF 5I/7fWQ7xnYPNFK1ANam/i47CldQBJbU28ppRwSjkcUHBKsmnzmghVgf1VQrdF+xvdg2cgNQ 1cRaxn5tJUBmtNMAwMQCWANWdF7ZbQcRKTFyP5hNrxIbgmWUDa7g/K+PKosK4ER9T5e9Sode RLz7QnZNERCjEj9yZ02WRTkeyk4INUL1Lzc3IUumSyq9E4tIgXnIQlblvl6lHG82Q5BPDcVo AaJQkHkvq4NUB2FzbCtATra4gPnHPgZkYwq4N4edvswEFCscBQUi1lC97jgf/gMYVhKTjEBD 9oezwwZ6Oke0GXYkMSJ5qywODktGGDnBdoQ6sgNIbC/7cHSik6VxMQTkDytUe0agnm8sSwca FksI2HfD2mQAOE15D073eOacEAFOJ5B3nvsL7cQeBhoDHBuoxGd7dcWBEBsCLtc7QHwBA6KN FziG0W40DZIYmAjEF6QtgOCfBVarAGPWj/QSS5cGOBAGT+JPxBDKV1IQBsZ0V8pDUWFT1mKH vEEGEK1CuRNJyAes9MLB1tpYF+Th/nyGI+IqHQKAVE0KURLbAS4N5QJ/Ql5QTXQPKV8Mw1oy WBaQz5BgBEFLmpI+Dv56diTJYmRgG+jNpGpGD6PdYmHbn+ahyWAWRVvQczoDZxj+dIMiM1wf 0jRMQ678R1EyJBF/zoEADkieH39iDEYXI0hKWQWCADP9YjLr/bn/JzZzNiM6fzBVQAVEUUQB SF1IDUxZTAlQRVAVVEFUEVh0BkzeTVgrceInvoqvC0SVCHpTlFXucIjD9YUS91JMeNVdfAKf 8RpMFggXRxQlJgEmA1SL3wt2zxOv/Yj9Lfch6gXOVelkz0XqMYbFYSAlo+4Ev/7iR7sDcv8A moVsZgkQQkSA5lYHixpdutAfemk8kbJMdlUV+P5XJwBV3wdroVI8kH7fRZv+RhpiJjgMrhCv df8ZI2K+4ZRkaSPHibSRFncJul3OzF0EiG/bTxO6LWklxcDuADRoEAFpm/XJMnsaDcKFMBe9 CRuAtLahVc/hLGNtQWkZ0K3NzpUVhUpZCouEa9tdwvkQDqB6kHEZrRy+CbwoDLAZijzHTvXH iVKV55+EBYZCUW0du9RunxdU3MyQZ7v4goUEVFJcDQQNMOQI6S9wl+h2Mt01BeQHYjbrQUMK Ms3LB0EzYmtBsaJlJfxtlw1JKwj1fyf8SOgW5k9V660MG+FH+izmXqQVTnNrZCMEvvb9ZlQY JK++S8IPDDlSVEAEXiKSV4JSDBEHfdZHC60HXxZF5HHOiuw0W4OQw0QlPR5tZ7MSTGzxNccm 3xNYfdBoO01QG1a2tcwEQWfzMupoE9l4sxUhzciSztWqCpPTI5IWFnB1M5wZ0MlE9to1QIJ0 qJT/cyRFXe5QXjb4BSCB2g6t53VNHtcMuGxQA0KtzyQjwQzNEl62AFK7VCiCrZ2ZLiC7GEXO cJMPjPhQvaZOHHP6zV38IAvv6aOA5NlOQyX5EAJh2hfOKoHOtob6uguZOtUwR1yxJu+vm45s Vz5gGQ3x06UDVjQBrN7QbBVdIm6KfqbtRsKKEuYrhy29Up9k8FIrnkJ14y5AuXcwtR27Zw9M /yb99joQimv/F/khX1CATTAQOUV/1ohTuLhgBOET9tjtEVOaiRDyqtZE3sz+4odvxyIFOxA5 frQKePnyQKgNO+qVzfAIp++ZWsQBrf8vX7Z+BHm2Mcrw67kAkTsUYe44Efg1Mtu0y1PrLjhD dwDnmXXZOmjbwxmIcE2KA+r/HCenx7utNw3ubxrfhjrtF/1rZAM4MH0f+/jmD+4tEwjnsNrJ sLnqBjtJj0So1AgdF8fMUw1liOeDJv6qqlVGUSvUe5/f1AKCxmauMIlAQX9GtCdnSkaXnO5d iCIJLy4PNZ4ZeNujC7tazVMMLjIwO2aiAI3uHy0jXY8BmALNQEg5BEhT0FsgAMVYYN9cRiNY bXIjE8oiYzxmchfGH2Y8OxkgDdzUKjB8ZHdUhI5aYIMxFvd+MJgh9JdFy0W0RfniCtonBDkE MFAm5gnH/poo41NC1jjptmw3XeKaeh1i05VOj8ifRJooSTEn5+UyGSwSX88ox06fcFwZdg3W lEMYLpzZNnENIjTmXgU4CwV0ZQc62Tzm5PZDiU5xPxywW3atF3sZnZJrCBhUNiLYhq3L32S9 UdJBdAEXL2kCJNVRirMA1VAARoFDIM0HhpiAZmy/QB/B7sqg+8+k6QPC/DZMDV6NWK08HQWn HrNUhr8ulq8NrQ6E9Gyw+bUm0TJ9oYNqKiUSCjtmV2TVNt+gEbKzUKEWjVI6BrtURvAHeAMC ZktHBl60DTLQJ8tRCdAVBgV+kv9qHBat8FxH6LqOX77z/VNuGG3UIYB/qzhRevxLAm1RYt2V YUEb17Y4DB7a8mz0XUd9z+kMZktBzXNMKtNrf+ZezkyzXVKJ7kw/15ozrA/HQN/sXcaX1LUS Uq0vQJkHwhjAAb5kSnIqIgj2DmMpS6ndiNDFA8fEBI23IJ7sPzQmsfB+dzZsbRPGfiAjVO3I 2FDmdxH3iFQNBUAsHtyDTQM2SgCgJO2eUZCMMWh4AFE+Pkl8M3Dzqx9hC3Qxj4pfPk0UmQSE duY/qRlB/U0EZAmxeOE/IV3FzaksVEprwmb02xpMCWgmRNHkfNsEy2eB1Z0Ey+SkFeXhsGIe bdFc1ukUCpnwFmrrbkEfeQMR1/SqkEWqOb+eFzZyiSgqO4sT7qIsDJdmC+Qfpy4/g7xtC1JB +6diqHZEgYgQQnCc61GwqbADoBbBRBpSofGCatZ6wtUM9IcTCvxdBUU6q8gJjy+dIkU1iIpe +cwCPIHCTJmokklBTeieFBNlWHCRRjh1tmOjWHZSZBt0Vi7pIk8BFfJoNN3AmQvGA0po63e9 FZTsVQNIuvGQVo7mWGgGltN7a1aostUjVVU/bp4ptf5r2VoYyN+CPMQ41SuAy4BQS0g5l3QO adGaonJDak0/jIkFD1/Uxr9FiVViOdfXeeAjrYg2/eXuhxWRWPYWHm8UTk9hH0T4bzLIsSAE 8C5JffhCg6gIYXVDAtXYLgH/aQF1uFmTYFUZZetJWC2ANbaa4SqiSk3x0EckQjE527sgq0J8 FiFiBBNMmjdawbIeBo7wkF2QqHsVZzoGkmnZnV4JQFdqvmzKQg2D0f0AM/k5aiRpGM3V+Thc c8wNQKAyXQzKWOlfgIPLCHYYD85FWnfQZWeRBuOKKn0E43/BfNJyTJoomk4Jn+6AzCIrTGKY AvbB1MJDx6cFejxGloDYR7laF1GHCyXnW584TRqWiS4k/ucIYNYoSFZ0OpVjRoMv9lYAWoj0 8BfTkSHm2WmksPome5jRwi6YdmX2TndDS/nd4+PrgY0C/xLBwxZet7IhokAR6QLHywH8T1G6 0PFg4sVCdDBdrWaYu1eALCSZB2wAMq+iAwIN7W0OJmNAhywYcnE3wLURdBuHZTFw8st98Fju +g2LxUX8BjkGll4GCc4AAptJE3NhN3ydFXfVRnh3oFE/yG5dY6tnaBwGekrALaKWRXllmwoB Zx4OqCNrgjOoKpeD5QmiJZ7nMmRmIjVcQ9fAjjR2AUpRzxCyavsueECyhYjzsm7hkAdU07pL QZeFu1Q08v4QHzm2X2ZkTpl1TTUQqI5mETDZcNaEqtZv0xL6kFgiQUGEh8HPn/Mt8D6isriq usww6nxhAX4JzIaXjgSTnFJChBbj1jGekB0z8Kr9ZfUKq98FCstQ9N97gipHnvkegT7U7g42 t0kLTsZU0RIcwLKX7FYhVxScUveZfUECQsfBaBctG73Q9EIXQuQOovRadP4a2BYW5AwteQch wjjMLsUGbZQzhfjoEh7LR+K6ihq0ypzQRQpYICbm78n/OBIZEoL0NNlwe8x+bR/2Lm0bLKEh 4mRCkSoPHm/CzBCEwtcQA1qXOOojT0KSJCKAOi5UMYWXukRI1tkT1QEmdmrwmI87DGXGRUI8 8r4U4KGfI5MmuusKKbBlkw8qEDEMurjRCGW3b7FG/xMHrSAmn13YXUf+LxR55Rmo9NwBYURa aNg6gMOsDfAd3ApB5jcm0nzk8PvJGuliIK43Y8DMhrtSHlL6StSijm7W2rYF4Bf5WhXbZbmQ qg99I/yOgwnEFhwgC8xAOX/a7MxKPlDMNzF4HIfKb3QTJOus3UFtX/CZcju6Y040Pnv4KGq+ f7/+bgP5skXUrBGFDBaS4JeQGggR+BA2gKfbaZesN8x/5wbf/GX2bdY/0pf6SPQpCcnQrAPC QBQoOHQE/pj6H/A/0ZVCfgmnCXwk/lLXDB6xGHV54J228TcdQgLtBl3LcJMSogKSeO5FVFSe f3V/bVHkOYR9Xh99vVbA3+uOgGlsDaRlA8WxX2HzWYQOc/ZbsocJHWfg9mmCEtDQZ+AOICpw tnCDCv7XEqYO7vDmruPYm2nOSOwHN10hhhJGLjekCLtkZ5sIGmSc4I46vIP7DkiXHGo7oq5E BugA1lN41ScHe4CNMn4NWdZ3krwPokKqiHcK9iXl3LYG80Z7kwU6okwZW76kV7T34AGlmQkH xPOQHbtL4Al0nkcmbHhlchwRMkKg3cyf4q1IQ+DqJWZChSYQmH4MUmJWehTmKkjYJvnLHS9M KQ13fbwfGYoIW+pY03IdAy2UGXKA7comSUoCJWM8onifCgMpivKMPoMcgw6gg5IFcskYprRR J+9UNNwirXGzniLwHjbEYzi30afdjaAZ4kuGJyIdwYaJYswN4ShszUZMtH8pBKz87hDWjh2i K9bTvtAv/kvhBBw1IhEbOrKEd1JvFSjVS8VT0InYhRJGGqHtZrJXT0z8rgNbBllNsCcM+yo4 bq5h5Zb0VgfKZ9jcYdaXEZcX5ByyHlkwwTmRE5L67L/qDiAzpdb4+MJyZKXiXowDAIfJ3+DN juyGr4U1UTQV0LBig4gevivkAWYnC/rF6ORK9jgwkLbNkEXWPBRKvulUJsmQGuWxQBICP+kG TGEVZC7dQqP63kUPYncrtoLyAKaK9SDbsR6I7Im2Cg17V/Bc6o0GEDCNQApGUIj4xiADnQPu 5tFByAg4ohjREAnNVWH3pqlZelNFCR4jJaRymboX2vCRkYnHaaGrxhAf5qqyf6AkcmaepkUn VhbnyQC68nA5MgrA75rE4kdKAWspcBWLR5kXnkrFOBB95svnsl4JYQgKAGtnorDXJOEcakZN XSjLRHSLgTvzfBeSXRGoajT2JB9jgIc2bfmQ28xQtsEQ7j3MdQXSX1oeE77MGVZB7IkpMkKi ZCMzKEfJXQchExmvfoKDgB/W6zZvUxPVYtbMHQYUtMBmnZwCW1I2qgdaU81SHusXOB5urTdG b4x4NvMduswi6AfNWmTpShcPAoQEONV6mZz4G84rroGFEVZHo5eIW0QfeG87pQpYtTJAhMc4 YUPDgUbOqRkKDg8AAd5/B97mFXklmgLkcaJgRIdOI+Q8SopgUo/zfKzOvzMJ9QHa7EpZozqC hlQ4TsPTy8kWM0RL8EwUOEfVg84gkv0GDXECuJ9xJW6Daja5NMCiTMxuObIiyWTmqp4ASAtF bwUEsMutNzM5wkqhJWAwyxgKey0VV6M5bkqg3FpxKx9kvzEDX6F3CwRUg6ELakAMlE4D3aZW VBMfwf8n2U3HgtzLhRtNGVD3XTjVBccgJA4/gYJJwmbJyEwQJPRD9ZFfCUoGSTEepmPR1kAX IjZzYawgahcGmUP0UF/Uvaj01O7u0NqzxK4rhoJB/xUApuRSbDe+jhvxknB8equkhNpsgpoI qPGCzPBR3pDwpGiDSrs9a9xEthk6RD5fiDRWCagQRH7DozRHD7bN0xOZFP8H5AkHI1RUQ4E8 1XEhfgB2OAVY5BGcfDosVIuA0kyyEirgEbgHZjNH0ewAz4pEMXzsEaBBsEHQquaxGcbZzV0B gy5calYQNmq0nAYZWEolpyQabQICYSN5Mgw7fAUjaEbPUkas+lL3wgQ3Jp8NlHx3i0Ufwlzk lmpT1bLQJzl2IS0a9OZiDI44aFKmnT4FgTlgKQmexkuZBoakgmai2PQjL0w6PncndndHwtOJ cACuafU0kY06dCycdkCQdbSpuCTZPBipOBAiEFW8z1Zzg+1L4anuhRdEd0UTDgZzJHQK4UFz hjQuLAab/okJr0NETyA7RFaaZp17XA61B5uQ+zB0Q6K0SyIgDWc0T4FEACNc/Mlk2gVBssP8 wlYRduOzGlk0UqFYqXwpgH8XO2lVN1cYbPkVzXv4C6jsTImV9kD2R/OE4oKqXMK1Inkq3BT2 RV9DPDg9BKsRUiYAtw08/jd9Sx6cbpbXKeZYwWlpLFa1fL6wFWh0XhV8VkwCb+hwae5lTPpj ZTdw8CVTZx6XOqfm8qYMScZUGxcRDtiYiFYPgw+Zt3bh35HuwmfBLZ0emi1jmWZcISaAOQib DbhG1iqBMftPw+1oLF7CwhnfO3wKO7vBod+WqSlvRid0UhEw8+4+QkDuiloxarvQdbwwn8wW IWcmGFgWTjOjbH6BRlz3+jfgqFUgE9Wmg0AirIXhpBulXloD78iedlZEXU2sEFpngaV+fSwf 762ibHOi2EwGPgKk7vKyaG0KcGb2YgTTgj0tfAPOjci9/YI5LmVvFRKqIh6ufYOUm1sFaB5W q5ACnp42+knrOttWbCyuhsNyWcE4YRrVTARuTZsaLTRWngwWb+CJNlBeYyssiOY0yK9cjeRs H/WnR8xMiSH6d5u/G5nwl4kevzUlAwwN9gafiz5Cp8YbUMKw6ovEOCAZHgpHmW2SeBP23DsA fOtUPogMYR7votrUhbv4PRPxBAVge3Ey0loPYpvHjsPEt+r+6w/0LuFUeeojFRNmVtBdYqrd xC5AVuxCrYhBBgQZBS2NJlrJ+uwr0G5VIiY4/AutTxJ7JNukOngVzO2InNdvlzxUFlpqEB8H vf9GSgedckrHXvpKwCH23vZTIsjBCdWAq/yWnARzi9JNXCncrRDEHIExmE5r4QLQkY+CggAy kUwVRzbv6wFkQO6TWlm4KCFMZBQjIsODjEK1uJQV9UDpVIJPNSKq2SpYb13GcP4OcFphYkoW geGWlYgSc+rCf3exbg7vXRzvuHd0C4pC11BmIgSseYUORMvUFdtxJhTZAEyuZMfkYouf28AZ 3kN+MLrNV0D/KnLm9KYTABHMV0zepez4e2sBTUx2O1xF5zhPus1HSFUOD1hq2EV2ectGWEwm p3Q2uWbPHj1kLPAaB3IrEkbaTPBmAWp+YiZonVl+zFVMHmn4Zgawewo6Ms8HHDYctjDOwmPx Y1LavlBJRwgCGyw3EWA4xKOPAqkSCHae6gdSJB3SDDFRYihXyxYyJC5yMoAOYzgoKFzJRAoy KyzCkVMVibjINYUTw1xOAwV2cHLiilcyWOswhP+nNBRBEB28x8IbTas81+EFISbweeyjF+r1 n10UH9O2TERLpnPJDrDXZsqOWZtyKnAJ61oyeHJm+uxc97ecPiFwYQdIl/9QJoDE0rzU46ao U6RUGtJ+A03WklPKffm6fzSuI44RVyLwVoYgFXVIbMxqRxtShYHB9xEUf0LcB4GE/KeQGBAU mqR3/ubHohfGsu/sC7cFgXJS8ccHM3b4ErYnJS8nvycWlTIMUktOH+gNkzCbfv9DOmqn3Zwm 0i3q2l8WBmGTFGW28HCmzmVqFLpbeRqW48Af+Xie6DnJnxTMVC798BAP3nOgSBNJowUc9Vbv AAIcU0oz4eNSxBkWztSQLiHE9hnnxeoXQEolhSVdwXZhuvzw9A+2UCm2yJfrRSquA/Bvozd2 8Jr/TgQADrqIH8Y9ILRP/AaiRwKQ/VpwJpYkr1Y1B1P0ymS+RBvMrrgxXFe4FwTo/PmFyihS WosnvJATGzoC6cGUThCOHyRvBZuKJFu2jTZSYxAPde2EvlwVA9AdYMJhxlHlZhnTEuGgFKdJ Zx4Pzp4fpEWuUPdF/O0HhnmyvsBfFF6OhREMquAAMeaF2QbFyEkQRwFD4kqeCwI6AxXSo5S1 cvKJpv4WyQgRVEgVA/bpKpKrG9CBPiQ6s+ZGBSNeoBJ2fg+Cztu2v4popqDPMyIwaeCXWVJo SDDe/yUTa929kSatauwNmlNgWiNL5LMTDBT5Sll2SD9sIxWwwDBSNcgOjs0HTCjIsgx4LUYX Qk0N3XxFflBw1drAN2EcbFvwIDccIh/o1mY1ADah7KNLLFCwtm6r5dIMVb83WY3Ihz4LndRe rxi5AFnutOVP69NX2J5GXkUBrp0//ScCAmcBBetsYIJQJcBmNUfRYi3QPlvwVBpEdFhGFtai 9FK7GzQhy4ceS81CKrkOQbrtvFOec3tVgGTIK9G9ZNn2fhZQ6VdDeYOnypGIZI5JwepTpEdT PJmW9j924X1Baim9PE3pAChN1VBK4yh0WzNeMG/EZ8LM7J7PbRxQxUmBDjSEkrjiYFPTOaDq ItGVmRm2YuweJVj9DdkoGaziAFZmVoZL+kn6Jc4bZ/H8enVC4o4+vkUWFitA9sYWyK6nbBTA bngMJSvUVwcdeVvCUjcRGwLlYNWirbE96PSOXs6RXilPdgKdwBblNV4Rgk0WiftFK5SHqRuS t32wzDbbn64G1C5NFn6e2oWngIgSEfzaiG2S3QgQsrMvd6Q1HHxQO11pwT6cSFzO8lYBHXFX tiuiXAvcXRTws/vK5UC0ABQVxE3I8ZwuBRpuLh8XXP3tn15DGv8pvXwrywjWt0WSXmApSJNh NlNy2NFVINJsb8iBQi8fnUSfKe8EGkNbd4RQRUUHWZUUCRmR705ZKNrDfaYfzej/Iz0SM6s2 5yMDIjP5YH7ywpyS9p9+V7NrNQlTJidRIwFJd8AE9gF13oho7eWCegt7MnaKVy1kU6VSEhc5 CRYEDrse9pGINPakrMb13AqKWz8yaRg0US7HEV8eRCP7u9WQ6PhYSQKU2AdDIVSsfiqytG/v sGwIIraaCngZLANN+OOnJAjFiYkAFLMfuHjkaUAk9IUQHKJOZBFFjxLBQPlfPIYEWcQ6HycB KlDEZH4DiDJJgv2zv1891hO1A0yGwBTAI7wt2+LbSIoDQqRHu2SIoW1m205ezcKFjW4dnAgP Sy7gwjY+Ff92GlzVxwj9SbdHRn3CqRRHdR/m9a20OYEXPgAzGqCpHJlAwStY4A9UfERBdPzk Go50QG9iRCnyykNMV0LgygRc1EKOawSA3WIQOQbkd1oD06hxF6WxSCG/wPBWRYa5IQZTnA7a 6huqFvFGfkeAKBjFCls3c1czCxRyE6lPFno5rtOigy97xxUe+Cxbkw7y8Gs6EXpSQEyHhnhc zjbVUQQ+Cf26RVsviRzzxjdri86LQf8OdW+KdB3ai4CzR0y9AGm+xTu79MFLgxogwmnlUNWq odbaTJoe05+CEgbixwhbrdV6HTmF1wruQ+FgJEpbgRhxb1lPrSgC7l4O6huhhFaCSpHQOHXg YxDDliGzdRorzNMMX1Woq6JZnplUR5cVBIraaBvQgOuSqgo4AR4w0SrfA+F0UNH4A6j8IC4m gSY3Enz9+HqpH4XqGkT4oLEW7AsAMgCINbNpQttifkXpAwp4q2Xw24bqvs8DlzkanI05Owh2 gzGO13dCBXhG3a/y2Twy1pW6ixUFs/TiQhgDjzlqchenWw+UObxG4irxr00AEZPXCA0ipxCW JLQWVxYEKAwNOl8HA79dEvSW3DBERwYgCO5oVr5pKawnOGw7BnKDSQA0aFdtc32OEVT0BQs0 dk2AQfF8nDy+sbdB+GokO1Q7VBGm1UlX8KoTvCNGa9D1TsaT0nZxQRBzq+eLj751wGfNJ75p qcoVQO6j8UR0glafbyh8FDOeQnM0MxPFxJQEJ7A8VE+Cl4HcVTVspbE/KPYxx8WtVAdJkcHh EkGNJAOtAI5fYg88UhKHQuqGjLzrJBFPTeAoYhONgfYMx9nC9LHaD9BFOkVCXNyKN2T61eJL pDf92Q3/tMSn1lNOYZ10gpNFJ66FPkFq+9U4//aCg+kdnSVWIY5Dk5/0qmDAnove5lXyER8M +V/2/2IxiB52qivO4mdwEKI/i5T+u86eDXrGXlJl+eu3Zlap/4TDW2ruOBPERSRXAUaoVNuI M+YIBgE3BH1V1L2yRi9nOwUvX75ygum7tZTV6mZHi8MGAoLMtWPEw5drDDERcr3yEkEOI4kd oh8Gp8UnHSS+Woigedmgno/TPh4C8rxzLAGzZSiGMA1b3TQVxUTOkKAZuZ2VcnQcWELIiYbQ pD/ct3R3WRX0QVBi8UEKFCJTgoA1nI4DC1yA7YC6iEomPYJ3rCnmrQoJCTG24oS7C1uIE/sD UwN2IWSHaSSDojHTXjCMMXpqAh5CxBqQCb5CsxTGeyG0VhnanDbrEyaS6CeC0HSXQGEhfFsG e4cAywUA5IX/OS+qTnKj0fBypWb0AYTmtsAIsvTEyFagNlL21jnbQUPoTykAL1J6LzgjZYcE dXo4D3COyCg6ejg9I2CFs+UJiBPZfXdPDNLhFQ7m5tWfRpsceECjDwBoLNHFELq+M1B64sBW 8EWP1GCXFFLI8F7UprSxCVjk6VoYSKLtYdyxVh0nyxIPg4hdAJPuXgHWcp8StgyFXisDtIRP hW25QfyyDaH0QtJp9AP+Y1Se6z4TatoWRLoWyn91Oih/TWCAGwwbGpguT4VGGxUcJmQOFR4H 4HSVJPRXiFQQ4FjgthILKRHs8uoADOJCVToLbyodBuEWHFIqq6j2VQTfimGnVgRsSPyatTnN TPNq4QS27PppFNHHQr6c1gByAEd1OOhrci3YuBJZ0uxXGzjeN69QGxyPDAfirp+URiD30wBm VQVh3W5pNST+/yxIDA6ELkvUxTF2wkAduvMK9i6UB1/DUQPw3x3hOgMe7hND9EjxlZsxuSfV MJ5YR+sINVF70HHMy3UEyDxPTX4ZZjv/Y9aVQA7yrZQEMwtTCZ5GDChwQf8YUm2Y31zb+ElA CQZXqhv4l8oe1JobWwXf1066GkCom3ZVaDtctm0PXcoaMx0iV+xMZHXCmoIEyBoaMR2oWShg DDbAQnZmIjWzgAGjKRjXA09KDgnANwP7lkHOuOlROXQhFsTIx1Z2ATZE1HoZStc+18j3GIpC 62hYgnpSYk7kJzdziJezZAHPmVyDcsoCgHRQy71mv+OwW46qPKFC2jrmrQgvjq8wY77GVoP2 tNTANWVd4AyIhR8kaB3eGjKFd1h2X0zfLmG2ixQpD49qU7DKUELknibyuCRRgog4Umi4ay4M x9DL2Cg+EHeLU2ZPR/ouck4tRZ4gQBJk/CDn/NP1Cf4EMW5Kgpd3e0ZH1TbDiUJMkBL0aXcP F81IXV59Sjx3TBoLBpyLd3I9MOtUfrY4EEcyrIH0UdRppE9cY1d9dCHGw7dCjoFoA1eKBBcF IpRFNLIZDioe5lZQ2apSAQ8SP1e+a3Zwg/wpEG7fL546FkpAOxcNmA5AyWEoeSzjLQMHnb35 CzJHAAoydzRVQhf8/GTggXpJjJgRBQwW2GdqB7jMjxJXad4McCLvrsLOHVNJM+EhVAie1URy NEfgl6UKR0n1EhJecjP53fMVQDp0KsXmMsgYes1SCiPamLfTEVZQ9ZL/ElCCxtuO+MQsQqgi WqARf/K1sTaIMiEsgk4wVINkYitn8kXoAUR/D9K2CtW4qVc4ivmRmxamsBa7jxaxfzza0YnX HG8BjJYhlCw7dA7UFnZbjTksf3wRRcIMu0tQSvSNOl8yx3fWIxyqR0byIh8+kq/7gg6qbcd7 bqG20lAmZ1AC0i0fo1OWaw83gkTCSwvigFYCHEcC843Jdjzcbh5k42XU+EBOXxIkLkJhVAnj G0iSWpBfA5p5FrgqZqK2mpnMvYDupyoYAnIiXkAE+Uc68MuqFRveasmH7wXSNpha6ADwn7E2 ehYYnUeK10i7YdsUEzpEeB2fIATe8+ATjw4cAx98IOUDX5g7Fr+6DLLjmFXvFnCAYEFshD6Y LgLBavKkjk7hExdvOTQRnnEVx2YGhNqxiQ1mr+O4v/au8E1IOZUyYhY+5sKDCBBnFhlXoh7f Qe+DzCRb2Bgmafk1AqhYJxRSHNyGNuQO43eskYbXNy7g4M80vmOaK+qb/rBHBLiwS54+JlPO BRuOkqFLWqYcXwkQ/AVpk/SnL/3WGQ+C6wqgg1HXlFa+ZUZFKx+9EpFOS5MS2tLvIxlWdeN2 CkeBc9ePEXQS8HGMvVCxh9YtdJgpI0QoV/MgAllX+kNKCQEXloFGXGbheh/MAEyii/aEdIMe AQ8VepvNgplaGYL0LNJEFwFFwiOsAm5Q5BUlDYDbMlEMPCdZRt8DQixSU1+jMwpl869HJLMW SoUHnVJlcU07oZYj9Hc6lhRCXYsWxL2EJLAQ/xf4a6ySaw08UUQNXCX/uQ17cIBsK8XAGWTm xR3D/c7Z0uO6zg4NfGMNQQUVG3JrHtyEt4M6R4zE6w3M7B0CGJQTH0guNEARck44F+CCAWCW kczeLcrD71cqBSgTxGCAN1scBgzAV5SVkG0VsoLBL4wBqQ9VLiU0fFogCyAXf6x2geJS4g9S RstDSBRqCGtZF4qWKP4ITaiZJiT24opMVUNUNbiYAFh0MkpoA9qCprbARUIgNy8tPG0GfSib Dx0AGBNv6vQ+/clDM5Xo1hwl/LRwBoDMf04wWYITte4pbEEUqxsEwgAcmhwDaEURQ13L3A5k +uYefVLAOq3CgLhIDOE5ABRa6QUhYCHWA80kBSgQE1uQHzlcGxNVzJycr+R76OrIsBiCQZz6 6BaTRbGVfzCrDJ9y6TT0dmIAqg/Kx+FxCGuSRb1iFigkM087+FN0EvK9AWozxSt44x3B/HBL gGgauGoOCgbtEndHKazRDGS93sF6Mv6tDhmoOqojFElDK0M4g0IjLiDT/hjvvFFql2BFvjvv fl0k9N17oY+IEh7rSladzLWg7TV1WP8yxc9IaBEFDgvy0Ig0x28QV+IXEno+O8P7UIaSOyk3 AQ/ngKQ8DExTx6CygDsPvk4bJNYvFa9HG/jBQYQPK5QSDCPcpv049xQTEl4MCGvcpn0KZgQw ApU02aduSOguvjBZ0XJN4Da2OPg+ck3HNq5A8Eam0yBPlUjITp5QBNZyTcBWllhGfo+DVwNa 7GB3e+Umy6FglQsqeB27Zyil0v8SeWMHfAC+VVdbD8Kg57nRg3kohb85YEdzW7p0uEhO2RWy QR5gYgEtxPv+eAFoXsZ3QKFWcyObogDdFiohFGmKo5gihXB2eVLyreZHHbh+D6j83xXyFR/1 fBXBXsQTGgMjtk1ESlNwJ9EJA+59d002ZRzDZiwi2g4BDwpccx75ufbJknX4Eg0SRgt2FXRt biNzVmM1ZRUp8CJutfaQDxxSAxz/KF73G252ochCu0LGmRYEBTZtVm4NB0NqIzvi8C90cQcI b2QHMgYfQeR8pQREDB0P3evIo9pIBQ5LY3+aNcNyDlwKBBhQG/guSgcOCAEK+9wqNhIdHwlk WilyHD4UAXcNHpMVHI4wLXn5QmZ3NWjEtEEK1Bv4HXZxFW8PBU3uom/XchgFDjZ9eLsyHnnG oHkOEGUDCVEbJlQ4RlBrJ2cfQHH/ds27cntxNRMGCTUfKAFPS1YRBwR4KkK4ofR5HywJIG1V bjJWKAZPZgvZfAq4ZkRnJ3JHBkDJxKKhQct/orsHVm4VRQALGwUgEflJCvBHsAgVWWYspRaA CHLBOm+Y82ZMFwgVUA9hLgF0AGEBOZ4OBGSBTDUVLyoJQoAvbRNGWHu1CHt4cWZ9iB4LA/4Y A4sPjANKxiJeR6aPdgv/OiOOZ3O2rAOiCcPPc7JAZqJeIggSSxXQohudoB8KE5cPCjQ3Hmwj C0hpI0ZU+KpPYXbp/BIJRf/9sPVMNQsYBhRwJYYNIw+SZ0avZg/sLgUSgE8MHQ6dGNonRCt5 D3VJVvqYy3pxI0Zm2Bm8axcyA+IjogvcAZbFneYOd0jWPtzPb39G63uyCLz/uTsmKS5IsWaQ 6J5ZRdgDXUEUqBQSVGi11pyPIFYPG0vDDxwgbjN9Oar/y2wqN4wsZbYLpQLQBZzVADSte4LO NK9e4idxkNcg2g/UZiGbFazwJMtylWajJgkBIXZNuBpCV/52zQMMNAmjNYgH/mULkDtnEwgc 4BPTbJrPxUESgAF8HDAGhRUE6V1XGW4hLnkdKlMi9mcfHIjyCxGn6wEsttaCrtZF3GDP64tU wySEFztCHCkURBWQyLTAWNFYSPhdRgSm6xikMV14eIAClTw7AUNTfXi+tNKGEkDUe0OdeAu/ MYRNYgwbJtoA9ZJeHG841tin0dE6rAZEXzAFStCCPvppdgZMcHTPq0AXOZ7g9AKiCRqEBjd0 PuZOE0R+BNwGcFXVDCrnDuJ6vCoAplkB3U8fKAGqHzsQ12nkUrnkNRvUJTEnXhg8XjQCKVp7 YjtaPTNaXbkMfzmOJRsDRAIqvkVAJDLqxLbVR5iEZKfENT15Ac2SMkvXsZb0G630Gh7uYBMV QofuIpKeD1KuRZgUf4ciPurPWxOFwteUDpYHxidmwpF2whSmRso1EQdJe7pj1SALAZYgFPRP J47OTvjCIPoMVn+UhWBycAS4JmYQn3NnnQqCcgNg/V2wA3Bg4DNaTUAXwEEhpEpaIxVZCg9v z917TqZFExBMJpgTCUh2wj8a3BfiTV0HX4JZwz6tA9wdG9jwBSozHH6QsheTGzgcYPpkyWOJ rxMSi6C0WU9sN8ZsOSvKAQEzyk4SuieahzpRlE2mYWGgt4FuJEuJyrM7Km50c3oVIgW3nWHU ASQcS/COhnjCGYRb/hnwNjs08CAk0mywz+PbhqFN4Bc+KLTIo//cGqFFcYRwfni3Xp4tyQWS diN/nqNqrisI2e9Ff5TW5QfHN9HLYQ7EsGCK/kP8smnIT0qBfLQF6QcYntRoDIZOVBsrLhM0 XWJDPW5egwfIHbhMAaVUXWEHkk9ANjvrDWwwhhFmHDAueYPgEfxH44ZiD7ThTYQrjXoZyYaC A+ThR4UQA8GIIjIwJ5MtwaT3Ea9truTARKgBrvwRtdGU5GSboxMO+DFZRqaoOr7Ii5jt14A1 /IUzuOUG/RTmbKwwA20QBCg8QDmjNW3rfYzQ7ka9icWLhDHUZIfAETBET3RTtkJdd7DPcosI SHFTtiCZRE7KBJv2KN8KHTJxU/kIQQZKCyyANYK5Ig99NSLwGRV/4SqokYIwFCQBgKwuZkfF R+G+wwo734ZHFwASCiA7ZA6yANHaM+lTSkT44yZuCs1LMtEyA+R3+HcDHVQiXgKwAEjAwKyd GBVyzxBEEUIIRNoaa+tIUypeBMGAGhNkSla/EUAcIBfBSgTyhH8uYa1RAW+AKJMkAAlAmfDa u2ZB5IDbD7ouZZf2y/Ex3VnFgPryuUh38uUugOcqA8RHsbhgKr877gHEyGENtAT/EpMRkKND 4eNmhlxDtlTEgrwXzZmPDBhPSK7BEcFtdVsPikYVy+6nB1IDsmbY4jhvgZrOFS8PEHsZDheh G+y4kPWOGcGyTqopRDTAooZqkTlSTxFYInMLa5BHbGC2ff5gGblHFDDTuRBsLLuYkhe9ffEl AwSV2i43Wi8lCqtwcOdRV4Nq410mfsA7CzmwOhtScIZuC3embjooeoA1zitPy2WhRleFnngX dJ0ujgeDk9npWITIIUeHCxsE2OuIma3V/09FeBj1Oxt9kUXEBVD5YhZrwB3Wz9QaqkcA0o/u i3KRUFP5Rkr2pA837ZB1XqnEBk6CVbolRaotfmyjAkkIOTnzbitwKcTuIYfLCG+BZfANCWzt k4lEdUFATnV0PwCr7roBRHc0cHhnZVRxYyoTcmImDw8xFRFRDL9peHQjchHOkwk/5AVMfTUh 2wLwQVlxbipvY80zIx37AQYdRDNjfHEvYcwjQPZVczNhy7HNRaHAjwt3AR/WJBtt8EMOYGcC ZNUE1XdJD19KFi8ebPVYlZNpFwVLwBkcR0VLa0NoM9CwgQbTD0A7VcJVGi8I9EgASx+bpIf7 2T8XBXsOkmlYDLFIQvA5UijPc/UQ+Qkdtg0xNnBDFMZLZO8tU2Qg1itchzoHTOkq7wcNg34d sz+LVnYoRirbdfSCPVWe6uHQbM1hXeMvxW1bHQFTY/M2ZixvMdgvJ/nQDaIcLXQUYVFMPrmi AyKJD25ybU4TPlheJ1ZpMUfAOCfg8zmuzbH97NeMwSwprYEP4HqIdWC7QskPFIAkOR3RTNC2 KaZBxokWFJtQd4lxQQEPXw+i/5ORB05HSxlDXEMUU1FWBLJ7E/xBQU4SGhuF9uwLUR9NVk0K MZdPnv9Y2gdDPxIOSVJWDElHXcplywRXTlNHE0h7JR22KUgJEFYyMUdWuTIX5jB1MSYRJUNa R1f5PbkDmlM3DUdGRwNLR/A5Ic9WE1JfSxVIXO9rbH9Ed1d3FUiR6Mgokl1BUUJVThIJf4f5 X0ZXFVTLXZlM3Q0tVFxDVEVVURJFMF1Pb4dNFkVDTQNNOFn0434TQUskDeemPGRBN7RYuu2s 0mT7qiD2uVbx414oFwsU8YtNPIton1QdIHx84gbHtelJtnwwEvpmaAbGSx0Dxg0AmNXmP99M AgEGULFA/gkInkZiF5xBTLYojBYvUX5auTQGFqD3uYvvGT7LQx+zWU5sJF0kG/yOlMj/61oX LoBDHAOtChEArQRNVx3IkTHhYOO/VIDnwuW6rgYNxPaBPcwmQVb7jlgTjS2CVYgadEQEdB6V VgRBxpEUHmrIUS65M58DdGCXeWYAYCLyrDYc1jMPAsVFQ/pBASiJNMg2Rtl0JnawqFWccHNJ OVFYJwobVhVJuoy+1Ux6OVbnQMLgZWSlqFo7Vx5+OoQ6IDotdoEbLZLuYBXNWzZJhR8rkJSL DiKHdxx7Q6RV0UjpBHd5BS5UEstwk/hRRTQIG2QWhAUGrW5PR67rjSQTdIa5ON4z8M59xmKr ORYYYA7PBBWgj4iTwTlWTLShtKAA/rxoZ/NmE3t+kVcSx8y1B0sRYzH//nCRhyYkKC8knzRe wfsAUjrHerE8jwaCyNgVsEANA+j7ZYn1RcTirQcckhNnCwchGBaekgwQF2UnN9dO1h0K+H3Z GE7XmUf60a8S/uoPTba8roslG5ig7mQOHP6rhQqc7K8fnMSEbI/2FHKtGSy2XLQuY/X90kec ABfanwDl6ou8oGlsBhcKrSxR2UQFC5vu5hXpQgBiSpzhlDIUwRx/fnA0YDIYMUeojHQWKMIw msDbQSTFCuMFLoKWRoXHwN5B4BcgkhAgak6OHLK7oiKiXizXR4MGwg43CT8gzmJxLdB0MAZp uiOGD2cEDl4/lY5kE0Bd4lDElypBUl9N0LwJ9NY0DWqZqaxiEdtpaiMYZ/RgeHPH3yz0FJLP UhZqXBh+0DGLrg9QrrHYN7ENsdoYZlYDbbHaPCAk363ae9+eUl+L1rnqe1DSV8FnBthsZ0ZW xGkPV/gtIvHqOzUGGOofGEMDfwUxnF5iCFa00vAYRWkaQgBtGR4pjSHbBGJL1NKABHQDUBFf hvOSVRmW/2ZIYDk3wsU7Q0TI5BE5fNCekEXWVz7a4y9DZhM1BX1pECFfkhM5i9AtkkDIL9ZF 8E4MjgEvbn2EBFuokhSJqjX3ktE1b3c+b8s+yAGxwNt1LAqvxLKiAuZASZbFlrNcxPkaSrLB gomAgzJaJPhI2FMm7nqVxD52AmVCTrcuqc4xeI7ClwjZUHaOldE7eA6dRAWSVwsMrqJAZBtJ CAzwGmDf4pKmVCyEx8Am1hfSQTJ41zxWI2YmaT3n1v6SF8tHPe48ZIJfYuK3F8nCMb+CRb8o kGc5Ko+SPoB6RmiUYPgFk4E7cp/+N4lAqnYOFHcWRBXhQjkupXgkADrqUTtaQ8ZQtF5EXyai wvvy6LstC3czt0d5xbcbJQzneaegvgXDqApb8VdVsfcKfBUpOIhqzM8i5gKhFCymqqqCrDdY VaS7HelWFeR4fAFVmkbXGwpjpE0p7JsnMnCncGb/9OS+ecyQdsI8wJJlQtdAJxsdilQ8DhwK PLyDGB3SgqRUVKWOkfHAVvjTRX6q34XEgDZGcxxf7I63cXVKiWpF3iMJFtU8j2FmI9Q4DhCs kKEzNCZ7FABDyPpw2oFHNFplupa62UDA7JFvla5mDjj4nkg8YEY3I6LnCdHK9n1SD/RFvoJB EAABzCBUUIZAOOZNA2za7+J3G7l0advIsb0yNrtVti9GNMc9FNEOWQ1n7Ki/TiIUi0MObVcQ BE4rAwdPBqlnfZC+GBBWEhBHzalIQCvEBU0a2YCIDjbqGwzRTyYCwdlNx6cPFjCXi7zSXID2 yb4q2XeIVpeCCEAiWxCRg4j2ZS+sil/eo4jAUtZeIkXRJ+Jmd9EMciHuBy0D22MzECAXnU2j xM5YwhJaFLraah7VEa/Tn66DhQiisupm6luCCSGKQtjlcMiFHwE+zFVw4HjJWCJke3EN6QfZ qEaM8mPrQRZ11izeDHSPBeXoBb8lnwkZWFcuLAAAz5hlTn4Vx2bCeJr/EmDOV2rWbjEeiQkv DawKJjR2rAUEAAbBBMUEQmyOFZjDO1jCbiZEZMS5+CeaNQGoe9giD0mmmQbhWqPdEU4IB6AC OEYDYIivWUdrFh9BsWZXhVrWRnlAZhEaDH4lwldAByJAZB4ySzR6RIiX3ErOypI+a0qZSgsA ysEZXS1uRKzipiY1j1rOnytRf+MhqY0oJuOln06TB4BSLl/nAqkwwxbBKfdHQjBSVbYAN1t5 ZlFONtmwhZBFHBV4xJGfdZbL5UM+JKELxnjmQmoX/6jSQK1CSLQdjvfEIAUIuwxMGn/YcaaG 81upmPNkoB+SR9pxSYAOgDjOAnE+BcTQ7bUDCS4DtD8ueacy9mKCUHBCRIAGh8gXTV4clh3k /k6CJQjqNA0IFWGKkR0fvSqsVb5PVAZi8J5cTvfHQke/T39ifVKWfMNgUUoQiNf6JAQWwhVg pmY7mF4HbPMmWRC0KkSWV7QhZFK+TQT8Cqa1+UMBGB5fzgJ7gH5dZb11Mt8mGRKYEWwsPLnE EBDpgTcQw1TIMKJt6XxA3BAoEoQYTJGPBuQtjJwfWvRvBuxLPQVAhhHhPZLGQAtthwloRFKm Ifdk1AiGJRXjAJwF4bCPYBHcOW8j5/3pIlkEhQGiGe+OTqFESNj3hJDhmfgvvwEL4rUXkCM0 FRfcdBVVvPBIGD5NZCAbxXqn2A6ZhCEGLZgCTgA1e0YBXJO3OhIArZyRCqEhK0KTAV0yWKrV Cka0R3mrhZjHRnA89lUQ+9rIrzE6uC+ZQMuVNvQIBhQDzY0BmTDAqlGtBcw+5EkjQmKKGm7j 7QM6ZmJLgTMwGt4cVhCp1X3g72ZRwNuwIdwLxDx1kK7kO0jcRmTCa41EaCqdLsdkgDraXmcM G2ZMpVxHYUX2l7YiYAVg1R6T7Id4CyPPso8JIDqqwlq0IjM48p5KBGgnUeAhQcMBv+mHcI5c 42CSIDvMDLbk5GplgnI50xPA0snOcsGYKmMNbejNrCIbtggVSHUIEEfNw0gsnaNlIewcb3KX u06Q8nmFJh4qQ/VcQ6gG0A4ggmAEQ8VxgSzxwQOV4ED6KxfZS7EY1fWXI9X3ZQCrBlrAE8O+ A+vexPi8IAiLQG4T3ZZfXm8V7yCpNLWxsS9faggsw2qfvHdun5YmMDA7TgN3FUt+MtbwVqjd EvJLp05d/iS4X7g9AuxUF93002lB7JEhHkUgDiRyTTAqajR/VQB2VBxXdlllLqAe8LYPDPyf YNX6adxHn7aN3BKw5FliEFOq8vjYg2HVG5SWVaahrgLFRy1XZHN9ErIAaLkU5CT2ZdferRMo F02yvhWliDCD1ThrNKVTCCOuaDwBAmB8Zg0XNYDbmY4g/DJ8vkusVsr4UIJqgACcXhRszbVC Y1ICIABBJvTNCgk1aB3i9PBBcupjGSyuSBxLHoGzYdCQUxxJahQKgw+/Cmja+sBuVygp5gDr /Pwvg++ZfpkG0Y0YUEQOnltEiEwAQwEViAehQtJPiAfsYlDoBJF1ysQBAweKVY6U0cx0t2A9 xCgKeXZqJLnbnUX/z1mKyxRdj1IWnlpRyqYuHFhOKURB/3wr4lt3mfaVOrl9PAj8CQmqm/Y/ Em1SGIlGGbXsUxuTy4kR0xTEwS4WD9fACkiY0qDL9k1ohL3gZhRJbDFXlzS0THpPkFY2ng2O 1516PffLBQ955ulfUyXZVIjTiqUUBMOlsBa40d7Xi1oZ/TUR4Kk+vvtyxcMHngrcC4xovPuJ rLr7VJbqR/Ta6vk18qJgoE0/anw60DBVwnKi346I1m/SqA8piU4Voe+JHkaD+xjoEYYAFE4Z K0IdTVDLFIcemboFIxFmefalfMuEkeJ5B5fpQVMJn+pNojdaFwfpWCzNZNEzyHF1CITCfWA/ TcYVey4njMyPvizyFTKMlkVVr5c/jQB+4SViYz20EO0H3lAOA749Bw84g+wSOu7y+p167yTd F1SgBQKZ6KIXFNdD5BxdR6RC8CIYFVJn4dgCpFT2wW44HDoeGb1p56DEJun0LIFkTq4H6FdH Jb5Yn8ZFEIwZVY4g2rAocotUAgtRX+sHwFt0zREKi9akh+EW58pteSEOfAbpbQcEmEttALqC XVuSSKH53JDDMwAeEVoiXjIFzwMxNZEmsj5OKItFOS7DtHDngCJWEvC/3CwEZlZvg3pZFtAn Ifk7CH9FNsxppiGEruFAWXhyN79GJxroERCQEBkF0aWAScR8ChZSGsquNoxXLsrcFLFXAA0X ZaQWC4kwtqlAGhXuqtWSYcecA3plRtI7v8CiQlKuopDB9gBFIyVEVbv4wxGpEEOmsAo9HNTG KI6xvvZaUeKGeRO5hcEdXItF3YwyNgdF/1BC+4E8bZhuR1uz0G7bykDXWNrXldQ03W1600Jm qR0mV81Ru/O+BArf5PpR8F3oURUQV0w0UqSzR6XwgjOVFrsUtwQwmIEJ1R21UZUsWGkDQ7gQ Ls8wc53HWVU9y8meCPIFiypMfNwxnYozW04rDm7Ftk6tM9UiDLYFZFpK4wlAJa60/TTBjTGE K9aITjvHW63/7H1ghd18QjvlflhRD8oNUGThdRzcfU+GagvhZAC2dX67UCHQ3BoRkOACG1Al i/0M/sOmBL7KBaBsCapWZwlIZZV7trJw9relj65FC+R3XWofWdhEMPlTx34OTaOcwPFRGeRV KmpndEpQ6cXY1GL7kMxWI1AaPh8bplCeSxhkSa+i6OMGz5i+CGKxojxeQFlU/w7G1h8LqSWA Vio2gB0Vi4xHZrH6UMCAEbqaYDw5BPWXwAq+RAGG3Upq9ZsLRoQgazeifz9gxWDLBqZ8Mldb sdbz80pzaUxNLCSugk75QmKddwknxGaIFnS7WFVUwgUs1rD5wBQaTMqXYjaHDA67YsB0meQN jBBTD1K/7BfIAqM5W211S/LD75ipShlcTRvUn9FSOzSQx1NZyi/qHUhZNEXS1sncNF/IGqqK H3oV8DuIShuY8EfmUFG2S6DF77FtpA4TuKgcUYYOb0jEp5U+Bw1mdpnEMjvQIa6GG4rSRfNf XSCHAToUDUoITqW+md8qCwoQcaUx5tquUkV/EASUSZ6KRrA3MjYAv4xkXywkNiiudBA3Co2W UnmGjZbeHRwtHCDQAy+SkupWeKpIQQsf8FcpTs521eqv3AfQ6MbmXrBAUkje7DkzB5omrT9h QjoYAYemRuQabnIFP8t0z4fmMZYIeuvmvsUsFI9uxxcInEojFJgEEgraxnrZBCVKpA4FGj1r 8LkgDOwLcFO66G37LZYMaiQTKM9zNHUBvgKxTAgaZH0ScvUyrUXHKiQZFl4MEl9TdRJBW3Ms E0lUoAboISASLhsADFIpzrxWuexBTt3ciw0UzVZXK3wQBdhxtVvRUNMLTkKCJUXyw4TZXFNX teL1Rak1QZ2kFw7SlOoRJgUYbmMVFmCUYNOyw+v2wE2hnQTuOBkDe26HBzLWBWmyKce+blZk b0ZvgMsPIFyywlhlyNKLnAw0idcMH87g+k2INGML7oBrndVCFAZqF9JoH1H9VkgnyjRYbPq+ 9AxHAXLg/eVjVwAkC6vSV6D0FguzARKoGJla0gw4n8bzE67JVMKmn4Yg8UAOuBIf37O6+kcw InmYy+csEfBY0EYulKsICeKOL34SSezgzbEQTc5l6BDmptxwsh61VW2c3DRN1Z288qLjuyzH wR7i/dxINJ62BQALUcZylhI88GrLyBKmzOy4ph5nHAfWAgEw8L2gQQoN0hhdrfNzZxyDA9gR 2C0tbSlc1q0EVHKubmlw0oibiEGuQwi5ZHBoIOL4r0S0Hq6PuVvmQlHyPawUcT+4HsOK3btW uQlDnwqNwrlHQZFq3biJEgzI7qJpGApFcFkKnIo4yUdaYvamZ7vDAOXICL7DHvJBdjRJveTY QtsQMFofse8IzaBd+tkQB0uWy9KvaqIBMj3IBwsGhxUk0kApKEQZCmiPCZMQITR3I0b1G4G4 HnIgrAAmCwJQ8OVDoG4DHPAVWdYgTEdKNxboXwCnxGRmKkJdBEXOTnKHA5Nzav3+wATowu4f +40uja5nFWB3cuVXV/HpmF6KY5DEtAAGUgYBSMtH9b5aGLExDWZAFV7qJj44pEk2kgY84MEK 9hCtMx8ByjQWRA0uBBEfSSS0QDYBSAfUp4SxR1zEheYptiq5GU9XRpu9VDie3u8TAPkphC2p djTIh/4bLOhSBfJwVrgBSTEYqJckBweaEBDX4i84ikkWFQMEwErGAC56KCHVVmGXu1XlY1EY hwX0RoAHiI6BGMvxVKrb7nAHkkSXDa8Ktq0bzdAEwTFULcvQsLZcHQ9IoICiGkoiZ5A/x5zc XRnkdLJLFp+YBkpMjaze1rwlBwCEJPC0Y2qLeeXqODW1DkwMXVjPD5Z2NLK6EnyaZweGTSQT fRDqPlYlQa7iJwVU4M1mGBl0DkZDbEOgXiI8RXYHxrlNSv0zqjFdk2VVsWOMROxiiJBDJZOb yvPsfLbW8ki3u8lLnhgIX4G9sDIIQ2IFx+1a597F1sFQZkQvwZ6dgR6O5jF/nKNMA1uibEFH Ox5Ue3dMEsxYNRPBnDgA8XcqQpIgELPC4wfFzEzDBlyGr0CeifSQZWCwXqW+NFbqUB4QTWD8 wtggC/1ephwAA4yTVsQhAhayB8RKMEAeSulgvyVUQThj648Xa0hbtFqWXSPmXgN1jTpYDHHD SHmxGgoWIrRmzbKmsjwZir8wLq6KbHJOU0LNEBVjwrNc/wqPrCEBMFwyElHmPJoqbPCkJguc LCaQF5l7QOToapG2k1phgmnVijxS0vOVXxPwAv0NBEN3S9MWKBAbBgdAaqdnDmMAEZgL7Ltg KckWTzRSZkKTGYgWBlwiLgYm1v31mRePCEc5lnQaWtGZjD4FCFhvBR29WNQMHmFsSDQHh/cY CkIQZxZYRPLyvZos2DkGBEDFeTIKSYeHC9uEciu08OvNFsyJSgCM6Hi/SrTLLhivhuZ9M9aF +HcVF4VdUkGE1x4WI6psJR5cMI9GjvLm+hikyvzDS7BAPG9TNYKWBG1jPvPtew8eJqf4VnUD xQYP7KjoKey+QET0BQ4fxBlaeIXNoSBhF0b/FP2TCQg26vPY9N96EQNSXprNUrF2GjsICNuZ pP3MWQYYIlQiYY7fnjKfuukYCq2LJNCp/IZQ1qdFmR0YCA8+b85WesARhCRMDH+hJLVMziBO lq6GbdAj0UTmt2msC4T8GX1uc0qGR8WjhJYGH0BUZt02XtVAJPUMdvVO0lGlSpyiOSphr20g xQtthCM1EoYJrC6U5XAN73lywMfHVGBd4QogxHwVCsQuTBRTJjeprntVsIW4Gg7+JVW+l7ud WmB3wo82GAO697PTCM8c3RA7zFK4TSAcVN3Bgqqcm3kPoHuYAqhZzmha3MgqQfFh1+uIFgaB XRS8Z7Ty6ld4LmRZYaTKJs3gH7qqQZBssr4CE81qlX7SIXRjX2AdEccaCURDMSrcOP8DqcW2 ISgFpMswWfhvS1A6X6q5Y04+6ymz/PgEdk9GyBoowxykYRXIHE5Ea5qronci8+fUQv8MJ0OT kmgD+HacI8EwoMw2wg3LD3FDUX34p11Sn2FL4jtRgjM+cG+eQ0B0ckpAwc49FAisBKQ4Zm0u a/3DcssuKiIbk6HkjW4YIbLt9ibaIiSKa0tYI8BhaJgxnbUPgqowI8uypg0JzjW+pXAZIiw3 tRwUVoz+Fc/iOM+bcXyq9iRQtw8EFBfO9x5cFuUsmSryBnID5ES6X0aOjk2skWLPFMKCwh1+ RnI9EmJlRs+P4Ei6vcoCUrytIHxg0YuYA0dYrIDjSRhbofIG4iUCxpKiaRhspgzmB0PbFRim shuF29gein10Jvz4ah6bpuBGrn2FqXXgEagj9n+ky9AYGJQVfEKgB++Usw5pBxhRj0PQHfh9 P1DJJtrUjQLOb+MfSA4HS3KAyTUGQ3MMEE6a0PJuuhqEW1hXvYSLlDGdkPyDtudkgcqN1fIZ OtsSzFTypgEIWlILGB6NcUblG/boFf9yLnJYEipX+i3i4YDkoYME+lCTGE4G1Bb1oINiTgSi KlQyBtXWsLsqUROQ5LFUeZpHFM8RlK0zixUzmtrvbD9LagwyfZmDBA4tWhyatARaLNJQ6EF4 AXyAwRzk5sdHC+bKYQOdLEIn1LaTmm6RRn/kIvTN7U1x3GmlpJ7EA+8VrT0Sxb/u1FXMF2N4 9moKCVOx7z19Ul1AB5sq/ZRSlwOkcRTkNm8m2/IkVvKUt9Hk1lW0NQHeOdpX0oCR2Nf0lH/P 00dBFBwmlS3qZe32JZhueuTwMnZhFGFabCZlT7nASC6kUAlVYQGRpiV1JRdH1B1HWrTFAb00 rkhyA4lHJ8x1ZnStDwNxdZpoSchthmodV/K/ft0Ap2dOjCBSnkEhAZHEXrg2PwgMke7ImqqW FAHHbCgsSVyKZrtUnH6y/ch5mnY7n/ErmCpQwUXsembtNIgAGXAbn+4cigQZBS5qMD9IEmIk pL+VtEfeZECqnxNKQDcQEHdqX3mdzHoXa9py0lwT4KDfEBqXgBPhET5MmgQmLtOykM03akzZ pGEKy8lFu1PlHslGGk2ieMk7Ste1huwoXzGiSOAvN111CPcaiK76HMaoa46khaQlUN9PvgXT nP0wZ0JQAVRykxuXfmvrjMGS9TL6hsc9VFa2df4XQ76TRa3LQahk53NuWnZSQlSeN+0WmqzF Xmm6Zp9w2uVejWGP1CJwnuyDPhL1PDWic3dBeECBc2452P5kgBwLqUYE9BzIErVklxr0jhVI inxpBURBtlk2uA4aWCgTUK/s0Zq1nVZRDf0qF0xuEcU5LgtyxoR8y65+rNRnQUknEuIN1lyK BsQfgSWeMwVVqOYelgHDECwmAfZSWJymNN5zX/tkwJ8yPAWjbEKmimjNmUf+N40NnigN5eT8 cuiiQF5ELfy8qx2ADl32UwptB7KRArDmRUorU2bURng5fdsIUmkgG02hF8U4ZhvFBAxw527q ZN+iGPAdDIkmSdSM1pxbABynY40mbIjRA2IiOgkTR650ZePPr5QiBxLL+rIKwmJPavToY9gh A/mASiLOSFU9rQFqJc9clHk3t3arLsAX9HFSZB/nts5RK23YfQ0BciYGJfsW7Bb3BxD9ASWs tVdozxwQRwPoN3CRZhLcaaB1FqCD9oYbQUl3ac5IQnvxkKcb5EumMERPNaEknVzEA8ZEbmd+ aJsKIMXB2YS6EY7Ah+InK9F2bpiJ2CtgSmR7EnyZFVQefVAAd1GBYQxDxB8CirVf1DO3HeZD j/JDZsYapme3k24JDF9FDUGjGvcQEyQd1lQuR9A7zkEPH0RWbzg/cWA3G+tD/cL+DfcbXVr/ HeggXGbKWlduXlkg2tMnAHkLUOUAAMdhZn5G74kerXhnhrXMUepfewiWm2hqRQoMTQUIGkJ5 YKOJlqzTAh1KEAkTthL1QwhhQp0bpJdKDAREDBJyEEjgSt4kOzBxVhVWAgEWNhL5FEQmZpw2 EI1n21djgjkaUoh5JHAOuzFssxErY4Tdt1BKh1LxhIQyjwwYs1d3q68niG1UP0ZhaGok0kFs WgIC8QEXK0enRlad2Lttnn/di5JI44sBfQQL0BR3KWzSwY5ECJVvEN3IdppNKmYaiHLFQZoA URYoYdgGqMTicKQAC1DYgjM3tzMDEGhPJ94NHWaoRe6nrTdBKrHqL9qr26cDzl1lCc5hHp6y JGXFInQEVJAQQ8QBKHk7QqDWHerZdYrMtgRARBowzBDxImsu+MWHahFFruoAGdrUcUTCw0hJ 90hkAvGVh0a2xys8MTYUOqoJYl+KABopV4UgBkQ7szsIAMu2UkEkNgywJE0pjkdvapVYVgJC dPBjlrD0uTO3n6K6Pp1aTgVkEieaqAKHaQy7U9wC12QmznJOwZeczCMY6VVqL0kj+BwXLyWH xp5UABEqVwMu0ISf/w7HpeZFBb50USzIiSa5Kk6UCfCCg35iHFBBIAh+rP4RU4FcXSySv8Ts mtI9bIEkTqwMMB1iNVAqWRHzZmyC508A5sQGniNEz1Aw9EG0BCI05AvU4kp/y2KZIjkDUgsY 4sxEtwxErRgNiuCcZlek9+Ip8njwPSEZeLJBzIdbUEK6xdWtCiQBmiJORBEfK2A/D+m8gavm KwME+CjfNp0GPWRBDNb/BHB/fqgM/34Mg/0GQysUhf9OXSk3hP6iRFesqxyAMaYsv0Iam2Yf OZPI8UZV2/cD/j+SapDWCXBK++PYILkWMkp7rE8G4aUAr+gXBW/KEUhaR28O+4es31YxPHdr q1cMkShkec4GwB9mEBe/4jpQA/bAZjlE3OJ6xToYzw91GG2mg2ww0oloSWYPooFwgB4yn4eI DzUtdB7zOiGCDe8chsyXDNZt8KpTTbDn/X3wYgA4YCa+bYgUpgtwhYJPAfj2FaKSwdZ6WUpD WxCpwHMZIt85+I4VkxX4RuwssEhg5nuRdNqtRwsXWBBADDKm7CoWhCrAeWljk/UzIGIozfYH NsYjQvvgf8RujoBB24p+eQRyGb//wiJdRudS156HCw4GGRW/sCY3DcVDwwqGJ4cVSbh5poE7 zD7WfpCUZ+oUxKHDvBC2PFYkSncgkRanuNw1Rcz4NtvOTiMdIyShqkFWmrrJbjwi7wFwItTM eDB20ZMDAHnGnQ4u3kkOHHSw32IbzNCJEngsB40OIJ2PwyKCEj5G4RNF4FEcSNgid9CRca7S CAiaZpyNEB5GMKJ6yJHjRzageW4vVBIqYEpxZRGVMf45D9pkAZYCgqVagsRRVr3aRAcBR4lK JEC4kC8qDsoNYTRkBg5R/ys2DhDpyfDTgCCBKCYETRLNbNo+mx8ORXQSypRTKmJwte57X3W3 cHw5OAhboAJ8PVpeMIr8q0kHbEoSRFU4BG3fYFCUD1W6E+lbOwUjhAz0mEAS2ILbGf8KYDo8 GlZ5aHWqDA3yTpUDFVgt9Z66goAQ/pgGMRMY7wlztwtwTjrMxlABals5BaFu6AiaB1IbORck 13sI4Eck5hTHtygwoBPmTeDXT5NqfAVaCS9FRM7aIAnY0gSKWsxpRVzDS7cqPnERxeNn73d7 EkHVQ4gRcEbJunO7U4skPsgew5lFXmf1SCoJW9VtaP+0ckuhdXpA1EUyY0ZXmRbcjzEYmdfv qhGLuOJPoxBA+xoyJDBF/gS6Bzd3UxIXi/yJ12ulVjeAhGBkWbDund8c6VRUmslkQhkgKE9S HYQkR/pmdCxHoS64CVHGkotKA6WsrFI0TAgQlcGMJFQsT4pFWRTEwobMZ2NMBnXG1nbZGAz2 x5Ejhp1gTOVpKSLeJeS0wT3b1U4kECRWEmvFhAjdJZGL083NgkLnBVj0YTIRJIFTrxtQIcQk Vvd7Vo4izwKQO6iFp18RitYWi9tnj/ARLX9/V4gA5NvmVlhN4UL8vASbjbWPDhjfyP7UO6Uk ZLAYR+BIJgVCsx5Cr7ZWlBxRokDB032eA0HD4K4D41cITBK2aGHS1g4TEgOtFMLIy3xuBFhU L1Kj0fg2DkkfwRg3lzIObwYeS8Qm9rAEiUbY2SCDP0xufDOAprdmDOs80JdeHIKPiSggmugL B61eXBhBUhSN9kYypaJNSnhR1WbaOXLClBwW3YX2ulw+YxKnNrYjRKQVH1dWLkGVoxXT4up1 w4Dqlq74NB20phQ+Jpik/rgfBsoOBypyDk5YIiKsF0/AGh8hRxYqDfyYbh45XXMQI/d1KYHe 7hV88wYi0zIwCiiVg2NM7CrvEmvytXLDcmk8CwrUw2DESLyKZseaLiUZc1y2QA1CLCfyzBj+ OzDss3AyJ4R2QHQEowMCzxID2FftAvzPeu4SfCVL21s5dlsKUsssiWzvajYKTovTnBpQ1Qfr jDwbC8IG5rIeW7AJ2acNrTs1V3a5PAxVEOjbqhXiRwYDzGjmGkxaeqxkbqJoHYPOV2itHY10 ZUUqCBSLTS2CALBQDvgLfBNGYsWlc51oA4rb76qeNVkw870WOn5HQlCHKzXnMH1ZvaQ0qMiP fgTJkVcQkwr05g76YOamsoMml2I9tAvOOvop6njcGM0A0uYGopSSBQzBI0KpfwQiCFN+WmYE ltnoF0slxlMbR2A9HuuQfCYIEtmCw5sBQuQ3lROxK5ce51gYE2cpbDYCDaJyUuvvo5o2B5ln ThuLTOsfTrSDTMPnhuzpmIMaEkuzmSFZEhZ9wsCfxEUSV4hRPs+3yoBXiI1GMixvHnuSeBMn DrQjzkIX45EW5EcRENfs3MonEzERVguHoE9gU/aoo5kTMlp07B/OghEsp/022AYAjwGCnE88 AnIZS+u+q6yhPBje4v8iLJTMH0AnejQMESBvmuYEWpMvc4mrU2xr7ogN0nagpyZSwXT1PcyK W84MrpDDMQgOVAZ8rsAdhCMfRXQpxjYej+OYD/KwSXn0BiZB9P420aOQIswRaUgyjNZMXT8e pDz+xiRFu1cAA1oOKNOflfptimNb0lht0AtH9pMwE9YY6A5nOz8iPq98ThOUPhTOkZpQVjvv XYWRJlgjtU85i5JEofFIo3r5yR+FevFkCkNyDoKWYQoO5+I1ygUuNK/0mdUz1Wmmk46wP0G+ 9Zd7pJczguOjPG4qR+AajoGtweAbMDJZQTRRpIwgQASWkQ4FsG9H+CQvOzajBxbVYBxR4mBT 0//XTlGUiEcm/oEHwv6xMLhJ+Pilnndael2ASy2OsxU/V9BAN9UnpSwk0tuWSVQeWPbij1xC ikgmcgmnf4kizDh+d35KcogjC+RFvA0n7TIDLEmg3nx2nEaubnv3siyXL/gAGPL5Ia8i1c08 IHgJ683me5wfQ7pXDcRslnBmgnuBFRlUtfGDpWDFTlWLCp/5A44TnU5miYDiQJC16hZhYPXY ALEOLrfEkwBhl5zNiBiiVwaeiXWCAaHhlLTLDtWdvnuK+5VnDGoSfVgcd6wHoHpdQJHgU+EY ohUQR2pXW6Q0VD6FzOtVnWKi0rQSSqBSwxkIG1xDe10yEYqUhUQIHEOsg5jGdmjH6pw8lFdG TRWJLex9UMq6wTwGDA0Tpg4gBUh7VXPGx6cLpiw0mOa97ACYEj40SkTUCec3QerCq5ZlBDPi cJ8tNFK0QpXgSFMPBrpKl8i4Qh4Ns4jsfff8J0dCQ5f5T3Xeg9htuSZDwpNs+rPUaYQoFZNX gjKaAVNKCZdiNQnx9KZORBpC33eGP3tmXZ/csqAWSFQV76hIJlga8fCM1hG1EBku3BVNh8OU XTHDyPXbVZSjXllM1nBKElN+d0vDY8eUycsFkO4kMaey2DRhCwoU3PUmkwT8R15oGl6SXSQ9 jswLitBVEdxkwIIwgp5+werkC/L9hIGaDV8yRVVd4v8qMyPkhQCNR43irnmSGIZHD5fvpYgY arz6WRxZah1oQclYmaLJ6vzKahEJ1moZlmsEkkMCMVcDgfh7mguIcrtqAM0oJjIx2ZGmxBuK FATSiebMA5IQnQLPWMhKcC8rARooF3caTAx0m9tWVP8wJkb8BEA4WWxwsZ/tDG8WEyBOclw0 lu56R1LtjgQFSvYcQtVXgAPh9Bf07orinBoLXHqW3MiS/SMgBU0TNrG6nZ68w0dMlVYNovlb tqgMdlYJTXQg6xqBAos6RgKLak11z8hZAmNmTgIXtnzzhASWJESaS4Z7D+ZtN3b8J3e6DQMG Q9kAtQrNDWFFmM4UB1loXFPZSBfmJoE+8VkDiUNuqAECK40ceP184PpHAcVPR+YkENZ5hFVJ AB4i/2mUKsJMFqrmUcSzTwgwazyCOtmogMz9LibqqbrfOxtiewUD98QE1kc9VHaO8IAFxQsO iiQAk1Y1mldMmCWK2lfAFhGTSFFBUgKCRpa38C7wA7U5Uw39J1IanAzC7nFlRKr0klZGAd5A JJx5oh2xmiZRYbmu0BfnvhsiqW7yAgJK4jIkWUhnVuYXFAn8I2DOKFp0JOpsF4qFpLbBYxgS j01ZNmqyZGNmwnbVu19F7dInaV2TfYT6bn7aMAEOkQ5HJV8XqjK5C368DUVdfpBkGZNVZ2cC LxCLFPZuS/R0DUgx2CcBuwM8HjW3pyoPTWFrMpdFF0jks0ZE9Qwf/Xv6hLBORyEpZ6yJ8AM2 bP2ZFxzwZ1+6IiLdg2rNkE8e/gvFPkaYAwH+SCaBCJQOUERpIoCEJOPuSVbVZ44VF+egGBcz x4rq+lgwqYoDyJp7yDRYZLEgFbWgWn2PQVchRglrvyjsBFZ6QrctoImchDpAwAdI2GeE8EQX z8YkPnJSVDwn2W+S+iGa+PJH0byiqyG2lw5nbnW0NphZySo4KsInaI0wSIwnJfHmFxm+lDbg FeYkDWVtUrq+eW6ydnR1SMQ4MkRr4Qp7gs6DYT13LUpJw0FarQgqrE94Zn0tUbcFQ5FNUEfI g1p5q4oO9KgrbkgFH+QWaCqujHpTFqvqQstk1JdsnCTpOJ7izkXgMwdtMqkT81DObjVQzAH/ +fJpP8cYbkYCvpoOVlWHapV44waOSLuaGOMWa3SSH+FbN3EvsMDGWy1HxVGQCZVoIGY8G4xC VhXFc0F2vNaDMwMoJmndC6CgGHNkz0G4JraD7z5lMZQyMUhc3+wc3MuyuB6lHYKVL5tKUyB8 rPcDrwDHSvUx3EsBMk1pflTKJAcdEMKznMAR7nU0Rb4sJhR+UQArqX2hAX95rUKmM+w2U3SM JwbZZI3OliAfNqLn0V6YIDsny3oC7qjmg3sDMDdGCwlqUjWyYpbRlT+RShz9RSUi30uSAA2z CGxuPtloNGI3NW01ZVSCNpCTpsY4FA4XdTVrJrdfe9ZcpBX2MBBexzngJF/YJx3qtYwAKbAM AWscNDhZOhQMhoew+SRR1bo7uC8C4vk2m04T8BJWmwEcwDw7Rv3nU9VekrLChj2tJpR9WTbV iG0hzumcJSc7VzxlYW5uWgN7SvyIr4p5b3/QqlqVK/8kZJLWE8UjBUBbPXEkGVlEK8TGlkEw S7HZlW0PasDaYtjXw8AMVkuW8Gmttw1d8gXeUVs38oQ2KZJ5iu6oUAJLyJWJ7IY2JouDlSlA mIz3J6koR0YGQWY2hIS3JEPGqtZGNC/6IX369GSkk/ZHmaaf3RgNy3d6IeK4rLxh8JJKkDNn cQ7AeuZn6TDCDwATVyx1kqavaaS6Qbhe0Fs7pdgzTHgWhiXUKfIkV0lCRV9DWJL6ymPIWAJP MTAPOW962o5E3E+1VmzuZSNDaiMCMm0K0HsiSUnETEYQj8zWNGkongrMTT5msMlsVR6iRd+f 5QYMRFIwIfSmlZBgwqZROHrApHXRi3y8ue5SekpSHWJqL8B1StywpFGmhrB7pVt6bwLo/FbK BxQeCc5kDw+3wKam2fRXqoie9shVEWHfvKPihaLRA/zktXpGhb4BFKeN3mGMvo/kVFhw5vdk 7WmZzAQybZoE0UuePEh8jgpICUD7jkD0Xf8M8DpZKBUPEldLBQ/2xgFm//RAk5IvGQIDGzcc aOhORJpUC8lDc5edtgFzXQYdREB0HoXOSgUG8EtMEjvHjv1JCEGFIvDMSkksTP8WAdAeV1Qy mzwrL5Qt8BMaxGpVasygGT5BcjQ9XYnwJkfK6AJ8FTegLvUY8K+iLyqNQAB3ie2CVGIICwHX FEAwyvALClEJVKRXXWxHbbMEGDJ7MFkJGhJP3md9LvAkQR0iXJ5aEpMbBkYLsod6UWAOY8sv 0GuLLyBWzNAB7Eu+qp6qRkGUfZLsLh+dHUGTe2NRNnlt6GhUMoqiLrJ+IByoZlGJN680Cn6P EYlfdAksHdKAzEoeNWxq1OZvh1ZDlx9boSJEXQtwLy+n+MfHcAJEog8YR/mihnPdnMxnaosG HQaQFDK6i3sKMXNa5TOlohejCFkhZ3pwCf8x7QkneJefJvSj+/SeGwPYIFIGCwJnrkd8cFLl AvJeBOfrJmnPbAJFFdACRL0sIC4DYtnOA7QNiIBawmjb3KLlLwQS+i/Zp60z4AFmC5iuTwQU u3KX8gDYfJTLEoCL/utp/HDsPL2uj7BgIYjW+ZiiyUMLHgPABUPpyt7AwsIeHV8W3fIHoHut TGPcKg/QkZg7Fwi+W/neKOhjBfIL69JWQMa4uTsi1rIfFBZHFRU+9u3rxbkR7HSbzsgBk9QT 1NYPxC92FFwEBbAUozNgkwawMIQ1QRp1QfbAEOVyTLgMRytE2hbRT0RtmjMHHS2RmD3/BI6G kvSBfAURWY6xmJwkB04KQED1byhTiB5MCOqVCAAgiU7rTWVKm4nTKAhAbRdKGSJWR3J8QmeL QhkBqTL4IAuqAaCc5sndlAkuA2IOAQGJFhGFqAqRIMNJKoOEgqCE17KyMMx3c+QX7kwwe3p+ BLjj6RcTEHGIQpHIUihMoiINQK0LGEBaWBc6S+vcVnQAGg0m2zcM2TzU6pZqkFpOcQTHVlgk kE8RitB7IBcQJaB+SixHC1JF9GkIoFjEWM2X6HeFlVgnBRQBCcpIJhRAYjFG1hf0sqYQJySm 3hEQCoYNm2LOSstcqF6F1jczWQ4OD48mVAVJNGAxHtUGpl5PlxUf1gMv62KKXJtYy5Yjh1sf WlAcHPVZC9aQZyS2IusZFHab5KJ6RfhiLW6YbP1nK53tRTLGFmp0BCBCrfUI6yKQbz8i3IX5 Ar36CyOYWlQkOwi0EQYuaQLTakQDhg5j5rjmZuQyJVYSdgSF+5IyJhnXem8WVgQGKjAuwgET KT4kDQJFDjh6awuf92sjFLBl3Rfe1i5fdmWYoeh6JDsCQYwhDQ/zNaLmMBQEPpI1Di5AyzNI bA0SdCcmHp4IFzBjMyyyVwYmJ3IJhKlKMiEG1imENHEMDLBBEIo6ViEDCvbKLYTi237gviXs OEQBGkmC8DgM8+Qviw3F+idhjgSq8gOoChghC5MNAc4WnhifkuFCFdiaIZRDjtkwcWoGUh+f SL5FDraQcu8YNw2iUYU+J9g3pe4I4jKnBkAXRQcYZlbaZR1xDC9VdkMch2QxBF5jEzQTVHKB HsYTACcVyUEXUEUmlkoXDAaOEdwbXAHcBo4bCAKOEdwfWFwxVY8fNCOOVCaXZCM1UY8EMCdm RzQRYCc0BWYHPCtmBzQFbCs0AWYHOC/STDEBaC8VMEJyJDNGMhUwdDMRcEcyIDcTchBwcDcQ ykLILDusvxzKfA+k4kkJXQ9OHCCkjMkwiLr/F2fqAUJw+KuBVpcRi7dpEKjQ2bEYDU5JW8JW LHj7WfTV40TNzlDgKjCdHRCXs35yeXJ9KyqzcghyX0wIWUZQqD5DCgkd/8Tg0QhphXV7ZYK7 s+JU4kXGtxtuXoEUSjoMqmBWxXZr7t8eymlYxQ7sCnV6jtu3yEA3U8pADBHDsQ5nAwZf9CUl M9zJRF0T3kKvEeNMcHsV2wri5NQ9BxJPM7duPxEEnL6dXKFXDmTRI2N3F5OSmA0Aa2d3dQMN DQdNguhIRa3bVkH50uQP3xPRsmwxOMAGQM77pnZPZHlARXDVVE/bWgersOJwPwodWEoK1DKw Yh4OCchTeXSWMAENAtAEx5q/MQPmrFItMDm68R0eIUoOO4UAHJTw8X2EQfUMHJqHBQYSbgFh sZ9ZtA5jDCNGDwBeVmHQ0Q5aYSgKvSWcb19UrznGsA1n5G8qO2nVkXxXA1lxIbFDT+4BE0rO hVATotJoWltuEwPy3CD2Bl5Ktri2dtJH3IM+5Uv73BrjFFKYHZXg18QV4ZLL9H6iyfzQRbj1 xqUB/eaOU2Z7RCIc2X4B8sbXfzVNR+es6+oAFeo+3d0pogH+Jqk47w25eQ130Qzpzu0M9wVG zPlLWAIO6kQM6LGZqN9vod4rAFiQ83FfvJ8DnhuSc20yacHFUwp7sQjFBUewyDr3CFgabEB1 iOvor7Vc+7KDRqFmE0cXFSIwVLRS1ukeMlQBI/arhVAgRCgdABUAMAoAAFT9ufbPsnmRpBX2 PKRKQ7AZslawGrJTsA2yW7A1V7n/67JUsD2ye7AcsvD/of2o//n98v+n/fT/pRkX/RIL9v/C /ZMn8mwBjuv9lP/F/en/o/1ZPR1GQebG3tzkaAFMjNQJFpd6Zdyw8NNKNBfeSzSD5JQ0KMJI TPANesvx1HJo0BFWyAsWV4Z61XMfDyJFEcAtLl2N5CkfQfZFEgACR/d4qujbrV/z+AQRLRg4 AQoHf7Sgm0CmRgHkDuqjEgZ5dBlf8eUMAVoPgPMiA5BvrrraJaEzEnlB9Qr6Mw0Dyknb5UI/ RFf6QCx2sZUhNn5qkHUVNAPTtPpYG1Zjz2y12r+nsmnkNT7uBUAx8fCtHsSE+mdNuMQNTjMc e2R5FiZiAja2Db/9oU8AkMtqsFayf7BTznKXuvm5w+vDueeIAYIlSLaozLm7YJikFWUc3yY2 D9fjAzCxODNjUmMe2RMWzs0MhsXJGGVHsnUjUQvXu/LdEYZRuhzNELnsTp0KDFaFdyQB9o0Y osLnB7b2ovTQ/ew+siUDmKp4AjgysRBJtS3nPysOA7Q5ei2Xirg7FimCC1VSoxbiiUEQuBJ6 g3mzQ+cXqg/EFEDZAnBAVjgOCq1KTMNGA2wIQBC2p0LkRgaNUwu4osEW5s+68A4jR3YKYOev PgWqqrKou3gBylevfN4qbAJqSxYsMlZAAWKXawoC8AQAa0y7JJJi3QNbTCm+J8eDjkEOsH1E vfiCRlOv9uW8MAKiF8IBLreoVFYBNnpX8iqKevCkCSIMcwcGB4MIXmRQfg8MQFRDDTxLW7CD smmrExCL4LrqArBvN+PoPep7avi78CDQ38H+GPSCAmEuS8r/CE10NCcCESvZCP9EIGASfjWy gtKQfxEKlcxCVBVj4OACfpsfzF5QrorOFdgXrGSWPKLBHQGAANGqhd+eJEfzLywKcGA0V+ti R7glAkZqCRMrvAEOuk4BnxeYQxV2Y3xIoU9A1JNkOjesF7G8KtDV4oLMJQOqdvsv2nBwHPp/ VeA1NjPUPAaOVRPnvev4xABlv46AGA73X5AqXGSuowe1gFeCReg/UMAcukMbqg6TUbgTe74S DSsnUMZcCGjRrqgKI2aFOImYbmLRey7jCE1q6wymHsVKl4snbYVK9UB+3D93knQvSB4mjYZZ O0wmMkBRNGodxUVQ4keqTnUFdAqxqy/sdC6LfHT/DVYQBETQeBJ6CTnW28YvYAQ+GqpKmfd0 Awl0EqNBwxF6t/hKBx1NeCvLjXlTlVLNuutsUPNIADa98nad2BLK6zlfO919TFT4LfPGVQZH i9Z8Ctu1ArheyotCqerGEjU0uRZ5qwrMh9UIpGo/6kQUgAlWnBYt7MlaVc0pAZJIiJkk5iHK DGiK1YrGxeA42jx4oWTaLTGKIydjo4QnunUGuyIcUfSuA6CDFkKLJcKdl3krNxQWEkqJ9omN /y2AcKgFZh6VykCTQT8HOsLjtxa4/6z5W+SBeXQ0QgNR+EZ6BALTLSPLQMJ6fFM3E+GPEATr gv8CGddLgwy4RNiZRMu/qoW97eCLACFKCIAD/CVbElfond8CPUEEEYtZg9cPVSvSP7pro/Vr O2jZzzVFGM0f3R6fmhViUWETB0q39AwoCddtkRkBlMTWz/nPUBGhQdVAUhM8MhZrC1NREnwo iI4NgMluemShtqjIz1ZR7+ix2A/CRaC5ZPXuewweO0HeMh8ZE2QuuH8yvzZiLgqQFcT4CHK2 WMJfIaLsHNpt5sMqMnyxJkIZoEgqa38l1gOpzBTL+rqi+0cG5OhRgdDZaOFgFF1d4ZCKsa8s BWVylfneqGn1zfDUloInnh8o6HL1gAQn0PtVwYKNAR0KQjQ3zw4BHABWEASonoo7EM6wF0Kb DhYePS21iJlT1ib6e1+qpFitXw5fdF8Wl2A5NvZSWwC2zBLGjhwTQhKFZyIZFgNOAvWQOpcE BsZINAJPeXESocLGqh6i2hliBccyQ2MERRzvupJ6MJzuhNkVH0VgE+lEAMyiSBfm9WQch8WE s6Tq7aA1MkVhuxNG2hWIqFhsqjzJ13+E4OYzBAUoolSdQZnPYjS0si7bkV3ynV6ysnASZmQF dw7DkE9OJkUt7P8FQ2SLPvdxonwMnYhTGiC5RAKcugSuCQrew5JMFfaAsRsWhlsRhQEcFSEB brs3VAZUBnoMPOIwcwWZWSwVAQIBSVdMCwkEzIRQB6tACzbgEwjhSfIVmMYqn/zMVwiuiuBw GzUQiguGDBQETnrfciDpOaFmGscugq88YN9fDAKjYG1AncY0IxAz8yCc06Tm/OdUwD1LEAYV Vh+V+H13bnxHylbMQ1/ANAo4ALLtuwDIPP9BUEsXdlTR+/wQmdEKZENFiO/FGDiWdT+PK39W nxYMF1F2AiwMupmHKJyL9h7WCYSrbr4MAxb0TwCqZ9SA32taADQEcUpIOQ0DNnRYjNZlID56 GCXgA++NadBOvGL3WDK59FWRidONkypcXhmQdiN7BefohKyyLxbYCVcBtvKkCzi+hc2M5oAB FBMeYEqfN2giPj3Qoh/rABdWlDxaWVkjCRdvU71FVUWMXMiZKJoDxAqwzLxMVBSnCX3YqiCG 4B69+x1BTxFRHiJaFeSigfocvUUK9FKXheR3uj04qT1LrzUgg+xAVrjHuXcAEoJgbCPa9oS+ ZBMDhgZyBIB9vYe+73V8HPgpKeQBHcdbioBYTTNfutPD/da00Myd2qZYK0x7Zwfv9rHb/yx3 dTF2U+kRUkRea4TZEMSNvIhB+TRQkiM9q7yr14hAj0IYa5751uxkP9o0VyC6BvogjE32KD9v V3ACsZZFDNfpWbmmFPd+crJnUJYjA8QXAlI6sPCBShEuzFuMnobHfyRuRWD1QB/1z2zo0jzH XEAV+McoEjbPq3S/QtYBj1N99HYw5BKW6WFqtAUFQ5k75APoo09RWYmKUfIQ9A42QWAG96WQ L9+NBBhOBZzvxeo36QE0TG+Fphz4ZN1UixiAbg9bwxP+t+smnBYQ0yIGCqZKeujKCRAcHC9j DCDQR9TfJbL/lF//QTaM3b3LSk2oyyS0K9NcFCAIybjiVreWUogczfuEba0STxVI2nL9UC0Q ZftL+zmtSn+YbVVgWnFXIiIhEhcmYxHnNmclu5bG4VHSG06OjSP/8CU/3gZwyKqREzIlIson t/ZFwMr6YLbYXgQqFRcpFmqSQqt1SrXcWwHGYgGRm4/VjqT/dBf3jBE5TCkJp6Qvn8zmCpMt biOGXWpdA9sCFgt3EmZrBRzYirIirgtvXVwDXl/HeADGHO86OjgTQSTnJ1i0LSdjZhLPRgRW U0hmDWOfH79KLCkqsMOTXMQfDJQgQTcqFBsd6BoAfJ47Rybu5dKj5F0RlQUYmsargOFO6iPE i2TGVwXD+98xrwHFxmxlFEPCCkKmLd9q/VWJEMQGLBQBY0B5NkTUhy4giIlqIqIQ0z1+NOJX 8Gs+oTpOqjyf4kcy+RjZCxEPGIotINI4BHvpao1Q+UCFxn9EwD8GVevfVORqQR9YDGAMQo+t T2sXBCmEsyF1MQRqBJ7k3CmMDSJgaj6fDRsQYB/yhYRD/ADNusYzTe2E4upVBx4ghyuAzzkv dA3ySlAJME8n2jqPOySCGsgUtnb2NaI1MKcNzgSoL8qEI1F+F51SfpGVqNcmpgFSvRTLOwVp G5oi5dQJBNKDezEKAxq8yRr/wwmIxhPdgl4kz2BaLEsX6/69KMXG6PSdGqcv7AZEEXK78q6C s/APXo2aEvqIzgFAARfZ6g+mrZYmCnxv9A0mdplwAH/ALDoPJoQhgjBzK3+SJMpuKFzL0nX0 MGvMdEsGPf2ZrqGXy6uNBQQfFCJgpog8Vz673rRPZx/pYoo8iCsbi9ZL3AKJPILsD8+yVbJp lJH9Owcto5j52gI84gNSoM0Au2y2ewjAEBvoBeXPJIoGWUJW7gsOOyjItLQC4plAiu7Fqlke 2ICyHsRGjZlbjsfUFATD2WR6Fj/QkQalBJuBQbLGaHUBhunLQBdD5AS4Ct8dLUneL1RJI8hf sLaEM0IcFy1TuqLBAt+6Q9hU3lepHlfPhuSNi5FhNEcV4MTAe0+CVxCzRdTtBRKZCuBASBJA oETMFL2t2rc3lRjPpsVjMP4CxZMDiQLI0mM4tISUKOcqpjnK4kr9L34Uf93mVESfzeUCwJ4R 6XGJekwGgv55OEtsOM8OTnxAV5JYAil3QXRgJoeloh4M7ViXOMpaFO+QP97j41KXGr5VfRkP Kc5kvBdJFnyU6pwkCgKwmg2n7BM1AJnHEfasRVI3CxoME3we8oII6BJC7T9VfgLhAOUMvHIN VFnOXZ4hltV7C8SVLWb29WuDCF0+pJVvumycfN9M5sIOu4IEaIYlTSKnA5c/s4jAESIxi5Yq qv0saxjFPDcOn1w3CLKnLoyeFpuRUaCcBSwwbxLCCZOzcQ8Y+0hMGPZtVlmCJhgzOH8Kgo5J 9N9cUyocuclIbkpDrQk6S9xtQC8I98nl0qd+SRcxO+7y4HJUGorFzqAyBvcBLye9RFHPsiN3 E9Qpjx+tXDE1shakC9/wMEljZBOGUnjGuOwkHFSDAI/ZnvoGUioR4kBmqx+IGyQ2x3/SwKKA OBg1punoqWQerm5yK8O8q7+OMi/4PQVHRxwMAMTikrJHEA1KlfTYfd4MKVGmcI8SDAReQtAK jUjo+K2rNrYFQxSdKW6NQwpvtgBxx1w+93GFc/OW7GkQPsnCngXYX288LDKJKfDRf3MN4x/i Oz/sSgwXBQOzLOvn7aQuED9DuoAl3YfaPWMGHfRQiNo035ZKNoA0kV7RHNjDj16yQoaTD5QY Ri1gRcZmRygTKhAFtDvZndtVngDSMX7muyO8Hct5DOBlpwwM5jOAvwr+AV9sWERDVExHEbGh 5zmQi+HC8Fn0uNpih2ICRqbLo5+DodpH1DwIUZFVQ6p43a1/VtHruYCtVJNiUY/FNUjtdodZ QpIETOgVCbrQM6Fey60KpwTxB8QT5QKWU9fT/H5BDLvXL1Wcg2MFtXwtJ5W/0DzBo0Y9UJAQ xrzvWChsS7yMYQ15DgVrRIe54lK7xVgDeTbCzvALPdqk8ntKo9wCou0QwcIM3GNl9OAzz4LX Jg1YquJehw6RYVIE4xaFdb7MJYYLX40y3f3wCEXIjlUTHTvj2FIEzFxEYPVsjP6uBv8EnDpe RG/MsoBdE+rSl/LGF9iK/hBwRWL5JdS3kItenAle9TMKPMVHOBKmxBOi/V7WkFniIgFUFgSa QKYhpBoyFvsCWxjWSZG1nVUO89sOtddo/LNuFXn8uWwA5VCuKwJyn8tNcBcKRDOGQoerA6hP vRKIiRmXN/qXnKy+8B1EQldQJjIgd2d1Syg6ThdMd8lfNOJIgXJpOf+VTE4reKsxUkeSXeWc BYO+Dl/B4PrwtssTD93sf1JWR2xDqCCtKmMBmEtChpYM+dywhrEF6p9PCAoK1SOB2rwWzSIH g0Fn4QVLObpvjs4yYOJEZwRhWP4NDgEkFUDBNrSuY55XFGjBsT/oSvdaROZZEJc8s+DMzopx j0kSapBJX01CrRiuQkeFMUP25OTLb4SE/p8BmYeynjyClg7rDuVbpOjPhh9mrxxXkGYObG1f Z1HGZAjyElsFCfl2O+d3BArdgp42coARulTjgWtRG8OIZDMSzhwEF9uE8HjXsJ9m3iH9D03s d5MmDgT7Ux2NyoVKNczar8pvtYx5VUKbgVKzE4JHI7TdnGDJ8YcSAoH+yBmrxibqSETqYI79 ArTCxuuciv0iyBytNnEVKcggJ2TCzbJMHmZmXQn4XTQApIZxr9MIhQQzE4FOV2ZhC6cxUg7D 8gob+G09J541aoQF6VoqwnVtoBc5Sw74LmcQPWDzbPe9/hk0t9ZVpFmcaDjJB7BNE4YIKQbY DlIKDvu9qkQUh5V+M9Rxj9NNSFnsCu56KRYen1M23tqAW//exaSJmCC8gmTIBeOafPxaRrgU EtXMz+BiTaM/8HCptVWTkU5208yoccjf4saI2EyaRAEyitJcsZJhXkO2loWlsVttZrbw4JJn GX3yquzzOWYNXt4NgLQHWy2X/OR7CEo6CI5mV5LUFEAbBFyagxb2ceyxZq/ANKHn7IDmTshD nOJiCwTzF4vyxr5t97GwGgmAeOKE2CBgEL6OYAdztpSkVd9NqeqIO8tzcwHHmGoEkvUOZ05O LHjBeHsiG4U6/P5OAriOuUoEQYxVFw5moM+4/TdMisUQk8TFEREAQBOv50E0zwRfA1grPkuc z52DiNXPszxod1P7wkhG12h0E5ckYaKKf1E0HoseWZFSlu0V59pWOADXX5v3+FY0LecCjIKK 5NuOKy0gNwKWCa1K4M8cxBOw4pV/VURHHCQWujW/2u4/v2XE2NRyqfLrQOr2CXEtcEVsZnlS Xj4Dj4H9TLSBCp4oGUKhA3ZcxNQ+wdAb54XEIOtCSW9NML2GCNopHIc335rg64w0JepNhy+t syIAQ2wDItosMmNEsBxOfvJRgAVIpQ9uL7wBRQVHtAb6LLXMlpTgEXQFrckBZt3T7mqPhoj2 BrRPIrCGWchk/7pV1mq4lw6vXeidebxNEyjLU7pDfSYifAup4hqoxdEFKpQRRNnNBloTr7x5 czrmxxzW4hvEjA8GRtRfeRQ4iEEs04bNVLOgZL8yTYIcMw9WvKEnxSIgFfaKgMNm50GmaNBH L1OlY02noRSLyQwrL8W/M4hjGfCFwT3yKHiKm4d5NlFvt8gkeH1+1Hd6GBhLfGT290LrTwo8 G0etBUgIebExriFNJdHsrTMvtQm2I4PkGywSBk3c8Ab0yEr+vaUT7oKvDa2HGGNENBBiVpiz zT4RIBr71ggzokhR/KXEg577S4qSFjceVh5tFqhJss+iUDQVEFV2BL7EHAUAKtT/O4h8rBRX BpbD188bWsj2gr8OdxmIThBgQUQrIUbGyeomAC/1dR6TB1IjUAZyHs2phAPE7dTKtw/0SNgw i8+CIpFseNvzovA+Sz8HjG/x2Gux7ciw4Nfs33RciEy1RQYklduxh293Iy1SEApEkI/ej3Ug DjoKYnsfuxIOUmWCAxCdlu18AqTIcixQrOBIcxwVjZaWdhsDsFWSYv70QHAs1xOEEacdQ4Ep slYM1gONoy3hjeswIlASVCtCX1ItIbAWv3Ko+r19bCbmnopfTMbxFbhMRN3angStFeIdqFZG B2ZewhSby8UKFeY2dxehDlKX6+RYUhYRKHJGflFFTpI/OEkPZ3ptNGXrS6xmnI90dG1dT9f9 UUGhUOvONOSwHzBjHeyADBM2aJqaDWHTzF4exCL7+CcFXck7GbDIDPE+CI7vMNPxFk9D3M3E ZVWQ9e/EH13CWDJX5eCzdGMGPg4g/FUQEMJjnVgwEtoXQRIiv3Q1iih/Wos5YClGQ5yzSJB7 xl/Egq4njisT5PW2B3BMxa3mQdUEppGZ1GaSVPCdQcWIXLAaJiidBJx+REB2ReYQE+TEP/ZW DI1+3bv0Gc2QcYE8EJT2TXhjC3XIFDnKiZxsknMIiMUs0S5FQRXt9gGXSy+ol4N1O26IRmZw gejKK9JrfGzmKuRnIlmaBB/aHMzbIpgrsFm0hS+njKTpqHl1G4NjDQ2yavhy5sUXtBZukhRc RAfJsCBW8uWiy8BYNDb4t2V/BjsrUg5FcB06SsOmh070RFPiCjYBSBwfqsEDutxAhWSSecMy ZsYIzDH0jDEGQB+SxRYgJkYSZ3wSM1Qo6jSX8CdO0RZtuhoHPzhNn8fteP+VMGQ2KAIp9Ixf i2TtXhKok3GICtqfEkCzXP+OKf6Tizl8ATdpyD6W+GKQ6M5j/pYoXtznUjId33jEk/yuFRD7 am5euMGouzJGj9SVFdUZnZErPC7Ozj1kCMVEnAegMFOaSnnUVmk5VARfVOiuE7CegAB3+Yi8 6D5lUaqUjCfO/gpJ6zcuu2cQcxGLLlwBq+xsTge9an6p4PX/o4cdF4H9n/64VW5DH2Elxnhd I47J8ApUiXRmU7CGBa+k1xLset85mYMEjzAlL9wQSK9K9QgbMvdJASbHksHjpucCFEjLAA2E x4S59pj4Lh8TA4EbRdUOpCwZeq8sgv0kBvREOSMTAU62GO7+A2ag7tyiKkIiBFJHsw38mk1T AKvFORiMJ7dBEqxQSvYSwnLn3XFOLlcXPngHdkZFwal6X9kjAc0OK9SyJCoAMx0I89bQPgn3 RFAY4dMNh/QzN29OHRg52a4fgiYahelRY+V/U3LCe4nGhJHLyIUClgKstjTIlX5mxbu0T14c FKQgciHVVioDM+3Ia6vgorkG982CaIqUGk5IGnFVws4vgRkHMXGDXBv0NRvOZi4VAHNKL9lU GFcWczCfgHAbFXZNC/ji7hCDjVKnRLl1ciQAQR5ECsBAgPt4MBaNSkkA31nnFYiy7IZDyOyD 7r4cWRZrGW6IsieeDNvojIrznoeRsuz49v2VGktSh/iDU4pKg8A+lSgXxZUmwe3HZvFwcCkY CS/1WQF8Cr0uGw0V9OZaMwlYQ4uwiHBE4WjvhGQH790HLSZa8ATvOFXkmc5GHA+kjV+HAtGQ DkBwnaBl4fmHQPBkYwfwHO/k7sCwMFg0OJ10XF8UUvKyoosMKRrjrxOVCIxHYqdyhdodJAtC ABwaC2YOS3oMSPE+BBY6ZQyniwQMbJhLiYshzcQ1x1+LkiPCfEEHpfIE/n4GHnj2RXngyLeG Rg/jywauFAxXjdtgLEIrYF0DprRe1aE9Wx8ebiD1uXQRz+IYclWePvo79s3g85EcdssvBfVg BQ0Rk92uKZ+Hzc5zA/9FE1waoAcmIMbadMUgOB76LmXHxuhgnLQJVBiomFMMz09BPy+KBxsT IUjL4UXP3U9iwCpcHyyOE3wVQWl5QivbU1ATP8gXV0YcOkCRoyUe6CcyEO45F0bCjpG24pKD PbYnue/5BpkIB6c+v6W3Y2zto4cCzz4WLUFPhAF8ne46L13OLQZWBiWPsu4OA4rjClr0adaS A2oD80G+HuEhdXVlik0BIRo0DEXyz9kuEw1V/jNeFImiR1cG5tbtB15Zi3zpTQxbEMZu1kxP ZMGATsnn8tYsKsdQhIfmfCZgFHxVAetMiK5Swxs4rRy1/AxINEKUBh7WisD9dUCEjtKdl2ji RMk6mI5+xkqBnWZAqc7xKI4UfMgY13thsdZs2M0TiRM21jIIGHDWUXx9GWB59iQFjvZYCzjn pXw2egubUg1tESRb8RonLkWiXXXAiOlVDQUeBDDmEYAAkKYBvBTqvPp8Zs+OsCHkPA5QqYE7 h2/xlxOgaGIKLKeTsUSHRZCeNzwxddImoGiEvB+FIg3TkISzbvQtxwMBpFfFlfpf5g4OLTl0 ITRKySERg7Ib9rDu6wB0R7o7gDSdjFGqZZwBMgUcED7pxSE0LYitZkELU+m9TTYsdTIrLofn Js2caEmUAJh2bhPIsIAHdDk+BIQMBHV132BM52zV2yIbT0Wljv4AWF3BWQODPCf+F4FSI6j1 CB5S4fJw/Y+FiS3DLJcnG6mQTkkDTNyDjJ5O/RwrCrJiLwX6CNeIBk4aBn5Bb2VJ6RQXx9O9 aK+jMYIcE84APBPBsdgXeQZUgKoaQXIkRPoJ6PVWSKTWJN+ehG2IJS1tBNXbNbvKd18zLANW MZihY5kuM943Wr8Uw8pcE1bW5nWeAenGvThnxb0KcuThSAvDmWO0AKS2W9kSVIQVRVUohVUh uOrF+1KTtfDhTWtDVC4w9ofU4JQ3Og08IdAfCY6rfc6L3khFI1RF0DLfq74FFss3t2y9spvV dSsTe6g9ijtz1n5E9E1Gj/QoWUUVEygccWDKwVEKA7C8ZDD2AYIChGFUKXvFHYOUO6TYB0GY 6sITzHZoNrZmEts68sQjLWvC8FMOJ2uXmzORl0MW8eoWZQtEi/UQZgZoCcbDnFkkAGBvDA9f B3Zk8BKMPJYMak3kCVx3QCdgWjIwNcvQKZykStgTsNXD7HZfHUSOJgMCYKQMP4EHosmcrT+7 NJOyB9RoK/o2rRoP4PeF8A14Fikzp0QnAsOgXDwZApf0hY1Kym2adscgIBxGRgk3BIUHLYCZ sCMcewWX/GJ8Ab0eGE2iL11QBB1Enm9gCVcaV4gTcFdoqZuV9A9MQRgQCNOPb6JrqoczavgO Y0Cq87pYwZYFUFCnEx0AOqjVhazbZgsKcspXxVEmm7u4Qxr6QYaybwf8DBmvThZkwn0BmARW Aet2AaovQSZ1M/YYnvRoT6yVeSYPhw9d0tnBXIP0jnCiMJ0ewwU82lm3cc2T4s3C9bTB5WsH LJ7WTLPOBwsgeGiH0ycQ1BuXTHDDI9HyxNg8k3p6ytDun+lpEjMGgaVt4JYMnhxaDVoAxnZU 0MGn0hV2OvUHGH8XkMdABzvS2HT2KAEzISPmGnc+5ovAF1saFigOCll4NA+KdBWXJEBPkIK3 HzKDuiEYjW1CURDO2e58HTt9iWYcnSZFh+CrcQ71RXybeHhUUvOHJEYBM81WQWcnvcNELIdn xgxcLsQSIDFZPml6VSRRm8B7BmugBZ1GAasupivR9BwDxJNTOKZQW8CSQCzbdO9iK08zRRzB +4ze0DX7KOtXOgvvl3oGbgxJYD08RWskLiNTYspRK/woFmgU7jEuhMVFxS/SOymMuwjZz4xt ayzzRUPItORCooNKFrWLqwuU4lMgkkZvfRXUK0coimswP1F6LNF0zl2SNRaFAEQVRCwob0hb KWviEsL/71L9EmRhyyoKfzxSXVcbHzaWl77HaxuHSGgZxb9wxVSenvPpYDH++cdSloFKDKrk LTkOx8EPoOVO7s3q/aKIweu22Ca8Git0gBJEq9RzEsyfbBzzU3NyZfuUvQ8Phw/EaBQuajVS 9jHl0gZiEJf6Qw+TtEaIYE+RYjUBMJQfn0gZD9CErAQFnje+9cFpS/+G620MTjei1oYqZAqC e2ewmk4iBtt1TxZevXuJrOtfDEsJGTFFgPq0qAQMCkdWmUuaJCbCakNkXyGi2ygGABkvbKB7 xv65k4dkb8wZbuTVBrr5ErAtAQ5BxgA9yoMhyN5k8WdEQwVvUpdEFhqYrKxD8BYACUIBrKyJ uhogwAn1Iq0Uw1TMoKcSSgHqHdtuhCx0ARwJTtiT9fYIEKhnV6o9uXGeb+16HLpqUqgqE7xd Am4JWUcJYAwZ+c/UJsVFkzh7LwrCWhUcLJ8X5N48ESSwiAADPQjxHF9L/tzXfv7hTJZXEE65 7TWagwZIsQahkwPmi0ThVVRYxsJKIlVqHVAoHjpGPXUAriXGVtn9QgJq1u0TTouvu/pyBbAJ AhEQdAydCTJCugIzERrBJvFGFHQYfgSUNVLrDWhVwutGwgcwLVhZTjwiAGgB5ExdRwhUW8sF 6LcDnv/r/IcsEImfCbERRoaVO92iFp9Gjk8qM+1oJmHNzG6ejVZOZGwJRl8CEOJdLM8kTkVW DkPoBLBqy6buUvAM9oYQOclC+DSjwJ1sqrVoonUaiCQj8qkTTkdGrIEYBaASrQ5J3GKK7BSW oxvtKRlEStgCFAeF7DEeffaXPzIluWpnb7rEXCGrYJmOFUvsCbORAxX8gfVHlzxDw1EvJwmu gGo2pA396zoeAyO2CyMmXGWHqIZeKeZMJ2ni3Q3jAhVefb7piC4rlHKMRbUEN1qrIvvs47Ki olFO7jwkgQIHAlAzl0wazR01ixY7D0XGGaHm2w0QahABYQcQtSSuTthWiCWwOYPsCYQp+MeR Hlm9gw7zSsz0KMUW3MWJkxFfEB9ajggTn0NwAvrWG4oInIT0jlZPUlLTweOyDQwE10DgLGRH G7yaCmxSRTaLNDE7/MCJIfihbS/rHMJPzW5uQTD2Uh4KnXoaF8RoVlhQ0PjaG2j0DttqNXCN sk+JPkNsOIYJX2R0QgZ0HCAw6x4QZEa0pwn/UCIUyfNkxGK17ydmH7EiZOaL7LGDRu4CEIn8 GnhOKp1AGrOTiZfA8ERuILoVshRFoCHRvvCRdHcMbl0/Q58qUCdARisgJXolPMQaAZOFxAif CuZFBZQZZtVkAYP/N1Z1GACfYjNoTnoPw9MT7InxDA5Ek908WG4Op1AzHs1y605cAn1154tF ZPjHbUawGPyH9GbTdatNYloxM46RFKnbFBl5pmAESte4zHRiZr00wgLoUi4H2QrzndNJIkUH DPaA5lbBKmD9dsKidwmdAZux0nIhFiIM1vhEG4tAyfUCxsn3ymAYkyDe+Q+1amowOtYIlg/I QcOogztG+Z6BHaXHcv9YmCR3l68UqBpvdsaCk16bik+G1aQnHx8pzMuuKfhsdK780yOBgG0K rF6EU9ZsFIpiQJwKckj41EUws8imjsb1ZInEToFHmAjaDh200WsnQpJCrsAZ4oh8s1+kbK8m Y6YMTL9CakKivyoQbRw/ZVsp67wNbYR5G++RSYtdOsW5JGUyES9DfnTdCAuKfV36JQvSrNiU uzd0Wq/jJDki3lA0rabkbYDO+226zUV7C/qe3g+JwDJ4xLME6okIGIFWrQW4kflL4cCmPsFw osqJNWGvI2/gBTygHwI5VBZbtr2Vd1d8sFDJRMczkU54VuFuhYIEUhNkysNuZgAy0RU79shk LUeSO+LUipg9zkzSBCKisB/mYlQIURcpCISICg7LSojBQQw2IIOQXdfURYoAQa0PeR2S1QyD HZ6Cfh5G92ApdCqtlHjibqQxsm6IiO5BkUYxlFhiYgeKMLbVwP0wzh3+VmZutkuVKPzEAhFU juAG0Ws1S0XZMINoAXGKDw98czOZONacJGPEQDgmLDFA7gSlB5597CBbdVMAQiNDanGK5iZ9 dCnZAO4qMZ/GUAgO/y1NM8fPB/rDLAxjNOpGW6MxA6iKF+nRqruG5sC2d29mlQiYWpIKpgtX RjDWp4HC5f8SUPfEYp3A9rFe6yRWUuvkP2dIUsvLI55oFNuQI/JwVB/iYQB2Xh+1eMzDyORO NSItWJZFSVRVHcGSRwChE+dSRvcCclGT2AQIfFM73qjudAVKzvnWZccSJc0XpoAiOLfIHwUg Ca4jL18gaaITXt8GS/C3ATlWtgbOQ2uuS5oSrWhSHiR1X+aQXQsDYV9MPteMBjDlEY1ahwFd IxIFSgUX68B8MvJKIN9M0LAUGwvrLKTdzMEBTg1bNeQbQZDXAxAyzbCYeFx/MAWaI8jp1qMc hkEAyFb35p4AT4yBCB4Sf/gn5K2yKHXBiUZscpJ0WaEhE+gfAh89mBDFaLb/T3UcDjb4NtBb 4dKvG4Dm24//oLNeScV7X5qq2iUFHwZeVJdCY2ZorXYcjarDQB0334MJ6mRXdv+WdESiwO+p jnaSDajcmjt8yYa+ojOjtu42QJFgNgxIyfjNVABhwTc27TsWhQdlDfxLxEhmSoxxDlOroyPO ST59vjkQMn35Fg6Jv5vvxuA7OSCBbgS5/w94Qq0IBvYQPUqOa6VSk/ZW7EoYxMIPAGRATm/f S0SAw6zBNd6j7I6WGEVGu0MJViU5ESz/DA4tP31LchjU5gmgQgCxVG2f9FQPzbjWxSRIKdj+ RwQEzvKh8oKWByy8iB/pkwwS1iQ1hYRkdoWAqUANFuHMR8k5eMSp1iw8dH4fOMk8Ed1DYdi/ hYIYL5gVDNUcjRWWIVkSpQ7NkG5OgqL5AjhzHCl3ArwbaDZaCpotvHIXsOcPy4REPs8DqIpQ p/Entv8pbJmEFvJifSx3qjGKy3A6ULVrJgQXXS2Wk2APzopPYTPhahMs/vJTJ9ArLWAEtzMD EwhYhoRsw58KDkkjU5cuekutd5fux3gfZYCDAF5nGbjHYwcxHkWFHNktA/cDMp0GcHYBlzYX HwBPgJmXlG1jLAL2M8COFCcmEcXUHR7Gvug/GTt2vhHBVwoVIA9fS4OaM2cSgwbwRtdIJg00 85CCMh4PUHMITEpzVuS31+iCjOqvf4PtA13J49usPH5LC08Qad0iFgt917Tx7Akg5jdJOidz AOCCnRHXAXBYQQ1TGBiQZCDcMY//vhpV4Pzvl21DMZExHuxqEKg/8LWeenwz4lJOAMUchgwh cNwL8WzyWzB3Q1AV8mz2fiJ+qbkSZhBEouMZvziXynAMMelVwlXAK92eOH3ZQOtXfMDBFkkf 2LmDb4LuEABsGz/UAXhGgPaS4OheQa/5Tey4uyFRmousWImJuhya6qGQEhXXGUL/iF0K8VHP FCVh/f+2VfYQaT3ptEa4B8IAbF4azVgAsPvZqtwwAp0bThAXix8EASIqH2bKSghWIhYDMBO2 aq9IWgYMHzyc5AwkS0ZYEBnQC093SgpYcxcDOgIFzs4CBdLGpZRQWjNfFPClGS+clC9A0w8e FgjQpER6JmJD1mfgsB4Rq5zC4F3RqOAhAFfGmAJHeQZlTA0HiBENFwRLMNkiCKDVQY+ErY1e IK0d8pE4PGQoy81OtocHA3xozwD7r5X82h3xxcDwCkJyIOkhagUiIkEgJB35RqLXJuEN28Go nlaTGYQTkLpoTtJyaQaSRlS8JyuyaguvB250HMv3UDcXZWsANiUAHk7XkBSnHkyK4gIxDB9k UQ5EMi3Dv9ecIAmj+HD6wUQpjghYCFRCRVCMQ3EMAp/Qn4XntBCN2mgVl6KZD53eggdqbCmO LrexatkiY8lIXqY0CUBm3GMhRYQCM7gb4gbDLnd8kFRAG+C/TG3uxfkp/IsNqtMUGdKL5HJ6 0ep7cYPCsA8IDgGDJCIwRXaiGl4zF0P2RUQXy9t/U+oImUXrBookUvAoUrEdaIYu+B4TARGN wVe7WkdhewHpKL21Y7481vjG6gKBifZwDcc6ZDqwB2EZERdYGnYEdASbbL0L5DE+Z36ygaTL JxdcdpgoSG2sEQ4AbFJro+GEHsazFD5DpRy5TGSKVvnG9YqiSNKJG5GcI1G1oAA/oM00LNrp IdSYVcY4fDA8Q3T/U26AB59Ds5GfVlA1l/QG7F1xPNXgVgvWv0Npwok20cNysoSkLTytNBVy fz00jDZgFaJyMJxWyJQ+UQemqG/OnmomZR5X0bA4GaUNM8b2YCeNmXTWhFvgC2rRkRWaIsS/ eljre+ShTUy/oyPKI1SzGz9RAJITqb68J6qvNpMe8arpVhfwS+yGKLlEGBPTxwUt+VgkOCpi QNR3TyucQ3GInaWOQY0B3g+XIgARoqlswoTSLDlDxla+PmJozDaTdhhDH6DVkIp/i16pBKyi T6x+XTceWGkdA3H2RB7fEEdKAgJH1Bkoxd2cDQhvej2DeklBUEQZBWNQ9DZNUMtmGZi7G8XA n7rkX7HJsX7shvA05AHHEgBOE98P1JBtBLIHjwQyXTtQrtYTs1robwKhP+RwR+yPWBhwBusz GcS1rx2TxvjpXg4Xd03WODzJBWEqrQcPYjnBnhuDR2JAclaoLClv0Kf0CCUwWsPas1a8kepk ivOVTs4cVbS22PfO5z/2RAIEkfYkSl0pUA6ZUxWHncBXRmb8ATIQR+5yVk0dAe69H0S3DYrl iGOLroPkpqoNrRWQdO7iJFx03yIwZCC9IU3GXkjknDTiTh5QkZmA/78RPBgEAEyKtyOzCMFd VhdHJRLKnbbAvBHMt1gbEjT8DxoiXiIJBmIAXV0fCchxI+FnsEkydFgAcabgr8v113e5m6QK EiGVEDlSDBJ6MzmwW8tlKXZeblKR1EGKbfrgfOI0QOGXNuQc+GDF0kBZDnsG0lsBaVQFHJvY oR22jFErllZCEQOmSHjGitNNMCw4DWSD7DAHHWY67Dsz6DBwvJ4ael+Lvx5JilLt3nEftoTd Yln52BcJO2zJNFAj0+8VzuyGFRc0CUQSA+IPKAaKdCLFxrN0zUU9/xbnNBxm6Bo231oinwX4 gwcaZmNyA+MEDarV2MxYLrB7W6qoQlGCHKKnYrMI+L47licauGESX1X6EVsLXvSUDTe8Sogy CNgwTHK1ftWRXdVt3DTsnXKTqZKyO9ZpW7AA0ScObFYLAYc56sLMqi/luHqeCgL79a+5CV0W xWZCWBf0yUZININFEDRMAPVgUNFfic/cQ3MRPlxVdnRSlYLcUhNyETTcXXMCZ65Kb9GrradW HFpZmsKA0gNeVP/MZRKfHcf2s2RJAAAXCFyKRipSewJzSCSyQm6KyyYTQPUHcDzUuydvdHen VXlrLoekw2/8KtI7OYRDVr+4HNn8G8rEW+UAqtBILTPsEfbOWLOtjwNJfmJQwAqi9JZ5j4gV bxVHhF6OBElM6Sd1hgcQPR1yWY1D0R0dSFIgcIbbIW68NPGhMRIhXVN3d0GEFw8NPHNVqQN9 YNtZXFV8DxNUAplWuR6XD1LrcAPIAPNmyAHLFyA0BI+BCCJmR6dMzCvcR52nF2gHCFFVa0Un oiMdSXZmOjZI2IsvKi5yRh6Q5AZD+AfgTrEAKFJz5L4RG4IkIQtMuKoCqlPm98jIKmYCUGTb pPWbKSqb8klVMCNk0s4jMwJMUAIzTVNzI7t3aaCRoL1c1Tde8qmOfA54N3hwwB/9x5+Uo2G4 Gy7XooMRO8vIqg3rbAARhAJB6GW74OPFE04JRf3ssRTCCbF7vj0qy8NGp68O//9cBLYnk0xC ulebgmCRIWWT7grH4FXa8S+WDpODuR3kZ7yUWAvtsEP0p4glCOS+EvUAsEWQATJUWqjKBEE4 Y8nShr3GBgEAZfWjMWR+FvGeSGGo7L/cQ2SIyYHL10dd9t8Dwo5kBltuYEIH8mEPEPv/AtKl J6xYf4pYA7mA/QjI/c5Y/gQXnQyNMmZyPxP3y0lUSDPeS3DtDMhtRBVkDrRM9ws8BNN85wS+ obRkFScxAjf+hDI2QP0ZUucINeZBiFccEDJonuHOTi5nL9W5+hU9Lol57cwgnPjgtH/VCLSQ WWHTWzs4INXdnOI+AOSoFCoZUbIthiH0jWn643Z+g5wwYMHOAG4LSqz3hbggNKBXA/bfmIEO 4zUe/pyJkxWhRX1gdiijWjRiXXh8FA7A9f4iC18O7BzgBG4fsEcK/stISSM0hQMWio8W5Bz+ NkjSfzBo9nCLqDnZkJ4bFRpQT7v6sPbVx5sQVEQGT2U8lFFSQxW41mqEZdUmndEHImoRs0Mc Ykp0Dy+5rxCAKboGgwUEnlIB6V0shR3/c0m47IV65IT6vkMQ+o4AZie++HHCpU3scP9rMAfD 5DKS9TxjDszj4rqClHRCh3DPiYcgaEKCGPAklzcwO+3yDJnMU1OFSA4UpkrrLfBTSBGxRCgc gRTyEQBh6AiIGVJVsv9oYHSOppbDzm2Euy6M0igHFFzR1VTkx64wfwBGyQfLYe8WKklhEhL7 bxRNHmFF0yRIBCXt8CSWIhQoAgBg1yoOYDMadxitFEByXDb4ArXiRe8WK2hQZCYCKiBdBMGU yuafF8HaKFXwYgI9N8TBrgB2O5WCEVUYhm4uzQrCgjZVNCGDTgTYUOLkRNxCMINBu/66bv4c FDCK8CgCot8kmCJe1vQlJ5FXDF0XMS5qZroqIBbVNgQOjcJ1MCQjAdhwMskohgImyTxhbKJT R0YYv2iL5h5SFhJQhSsZOIJOuGVhB/TnAGyEFik+yxAwNMh1JB6gCHCOkBiKKqzckkoyRKYC cAXmNZQ99iIJVHNkMjMHYoJmBFGyHsJCZoZXaAJsTSBmja5EWAJZ5xSMLZ8ZAwfDFfRMBwdj B8ECLcUiihm98QgIKmCIXEomvNcKTEkQnUogU3ReEzgyxI4ngm6HhgQiczOsHQs4MkSUcEJu tLZs7aKYKpRUHswB1SkhbtuV7hC3DyqFHwQpZQjiKk0lCw5tZ7WOzAh7E844EpR2rDeHE0WS MEbShAn/sBpGDoGcCf9MZLRW0doFtmpOVFUGDNdiYFe+GtgXg2hDbAw6iPnaw3SvNspKbAwi +zhbRDO4Djp0t0cUS0xNRAgS0ruDeAUcumB9QXxsDnTINEoCQCbKZoMwKjaIWFJLTIerLAk9 +lXU0HkbJBHvVgvSKsQfvjNOsdGBA5xdx/FqYjrCiBVjhTcfDo6AWE8KT91qj4Baxd5FULEF jofb40IxMwatflJvk1miLNM7QmsUtCd8W9eZSsiUGQJEDFeWbqlBGjtXVV2JEArOJA/N1MWn bo8+NloiZD/NYg1HAkYAcyZW0Tdz3ildAphsihh7ecwJNYwjdsomYI48KtYvXa8M2Nv8OBcy AGAPMioJZn3EKqqlSEgNTeKECJhBh+qmrV8IHS7EVv3qrf/DagW8uRyX+al8EQayfpmE7qv/ xXte/5NmZj6iufU6ijgEQ5et/nBBxcYQVoeEkoKM8BZY7mc/XRZkJ/fwfDsODfgdBq10EJzk HGEwT4sQYoZuM1tKi8owM82AAmhU1Xt9wqQomgPaLtHqdUd7uBhDFVClUj4rKnJCiR+JFqhn jsRzt6K7J7dVxO4ckHU7FFhEVWkIWhQM3ldUFANtG1SGAC6uiwQswfJzWBU0BhssZGUfRfxR 8A6oXDEcWDwTvOKfDVrpqFiPUlOEFRy9NmP1z4WwioCFvAdYjRi4ydCa3u5MVK67BnQzQKE+ XsqhkV1C5Z4fggJDwHrIJvW+ABUm0Iqy5Qj9StT89PHYh6IQdwkc4MAGLgCvqv0e1s1DO44w GM0Nx5tgng8wYRSxJAU29DgHskt55gB0/gmeBgTizvZt9PLp9hhagEDu7rGBtpfJnARabkEs kDwHJ0DbMtcUF000bBEIfBM2XCuLHxSICyCxgwJebEgIGtF2bQOx5f0ncnAiCmFtbTN0Z15u OL0qgAylD2Z9eHhfxQczynRHLuJPVlIaZq439kUXcCY9Qo5NSFy4V/E3MY+D7v3OSES5bGIV uU9pL1PjYEfvQnXhCvpIQPr5Q5aHD0jV2b5IcjmagqLZNTiHZM8FciccVJbV5n2v/gXbF9ZO UHQaokFRl8hEgSaIhg8PbnjoYqjEtil8Bd2fws/1TLKYLVNjytXNaG0OPjtqNBStExu9DH2W IWEzwFeW/wduYqkWLbtwKhfDOJ/PMGoof1bEn5w1ElkWSPiGI5yKCjrQTTbg6usFclQYJ95s 0ShWuj5U7EkMlrB2jZAmXhqEXyKyREcyFsgCnyssOTpcCnpjbo8HqjmEa1mohE57BdEK0f+/ wetXnrFBiKUEmWrjFrcO4oLEFxHuc2gACUE9t2phfB9oE8ezX7n+3+Lg6R5/RRUwKa0666fG 2AM2cw+Lw60vn0hy2+rUpgNePm0FRD59yhueVBwJZx+ecTJ2ESQ62ihQlHY4xVxTi3ADjX40 aqUBAMowVMXG9YM/MlgJkUTNul8Gu+kT7+aGEUPXX1WfyeLoozpzwVP/CDITQLUHjgPckNFH dTArRDjBoFas1IGP4Fa3Icd+P4J7ly9CfgNQRh8eQqgEIMUIdsefQ68MAWg0/0VmZFv0SVXk AxYE/ztLKUQO3ue+Zf06/x1LASQxT0HaE6opZNOpZ1kC5lNy5LFhSxeSfLwLbXWRC25VefZv H3xnzFtXVsk7dHY4t6t2TsQyBzF06ybTKCMPck3HdkV6MTQBU+KGBNd0WG0BCisEpWb0WdhQ EkdCGOl1K+ScbwX4dJ4nHwPm6w4OTSGeknI/HrpCoOwbvu5EDbZ2V/YrEzgqvqLgswAI4gN3 uy4JJy4fI97daogGSy5BMyAZzRAVOMdNEYoCmSQWz0zwFx9hHaPCw6hToZZnjLtGHVwi6hR3 nQd3dYgFW037SE/gWhWbWWAnRNu0zL4vWrJ0KK9Ho+w52EHVbLd9Ccy70J6uzSMh9r81ZECR HL9jB9HnbgNEp1nMdZcW+9mUnzAphlJflr+z2eFYuA7QTTSZoRjuTzWDsUfgD+4FFdZ+ctXC 1mYimBIKG1LATmWfPQ1GHTDsNsMKZTP/zs5lABoTt5+YgCjU9kxVDRAEUWc6imcRgmRPlBB/ ohrbKDx7Q8ZZHABF0fCSBQQRCo+TQdpEOb03yujUKaqxj2HDhn9CSoiWEq1Nij/eWghCyjo9 k0FeFAlUMMyxVVWgK38kbwQ9xho4dku07Q9IODPKwZLn9Wowg0Z4QNuJ75yPRRw9cltbMOlL aHzKQbtkHKIOyAbuphl/gB4IB3Rtnb62BcQDrAwcpkdFOHg6i3Ywnvab4lo80MfWRNFBRloc kEIpH9xTGftMhpBKUCVeQVkoDKKhT1U9FVPdEMNiixfLGgxKNvic4QqY32eLTpUIASt4fmYc EZvsgR80VnsCFbSFclCVVarUOTMIQqf37xQPbPxeBBk62BdWc9gOhgIxA9a70yNwGQSpFxYE 2YDGdJd/Yjv+Thq/dOfIBLGSO1AFHMaK30W7Mia6IuwQ2GcDDoUaCdC+j6nWp+1SGRIXKDOu AxRpE72XIayjCaoiWfVmQXQfrGBaQF5mMc0sB3Qj9lntB1bLwxE1KPvKy2C0NQxMHdQ95Cxf 4kov7ArsOPBBjgh+Sk17z0B6vsZbwzMQ/eiBdltpjp0zBrzcZ3FJMipxGkIVqQIo+i0PPkcG DJBVEBaF3W3nBbJHUMjCRCBhAgORuKodQbEEXxhKFTBKXE4iEYz/ISpS4/4EYMUFTAz8ZNoI /UBomUEqAR3qP/sCcklk0As+3SRCDn6ZAkYAFWwlBSNu5j5oQc28n/dywe9LQlKTbs2DNM3M 6jRaEMz5/bgszANtMQrAVQa839XfBicYskiyX+zVdPW7mI8WAQcTRhQKjoU2jyxcFBfEH0Ct ItFqZRDL6Fn9uEYhoCly0NVYttl0PT9w2w8BF0gNAfWManhUdb6DcwG8D0YraU1VSwhJV00I 6JkO5pcqqUzYNMgwAuEfQjHYdluAqpbmE1COahS2QhmEPTOAxtfrW34AxMBdGamOwLyAdxZw kPg+omMQZlcuXk/QiQCAOC0Dr9dRZTylOEZ0oQuHkBv9b5OWar8IN3ByJDNDW9rUluT+poLm YtxnTIhoE4ZIs12SQRpUttSRQr88gAc+hcRQJNDmFYbNGUZH+hZGQmcUUm5oy09H0AGS0qMu vCiJNADWaBBy/oJZVRaAnQuSVFIEEyfA7RBEOAmRUgSu0x0VECRRs4RWyReIng3+FzDKkJHO gLdeu9/YNK4h1NOfDoAd0lAFANwXheYBwDUbbYxenp5kkzVncAPwVOpVvzHKZAiJkzGSS4wk WUuyFJAyFgT4ltde/AcAmUeSV62oB6kTsw+/S5oqNwlafgkoNF87R1q09wIftxnIizVYGV4z DmLKMXZIBCYieG58r5qKilCvic9bl8PFL+chG3HaG1qJtv3XJL6zDwFIoCp1UxOkCEUoVAps OmsaiCKZTYwbRi22BiiwTM/wgmoWWXKgOQSNy8ytBzOLXnC0S0LpswNXmwEJbcb0pQ7PNIH9 hEt8zRodoIOI91eu8KTGFhh8KG1K0YTO6Ih2HeB4tSAHa6vvNDChELM6AcEHvxq5Lx56jhRn YG6nlHIPbC6gTkCQYFmvTuLTGrVUnnSSGHnAPYNVQcDB3mATrosHo7YyV6QJXbD5fAhqkL15 eJAP4oAx5zMmiQhw2ydY1ZAdgUyPPOgLDs0VR3SPle6iv5dEwmE/pFBpFsMPJ4L07WwBSlUP DlJKdDkWLIosSXhMLx+FnoyilxYGzHfXg9HklaCWK5NWSxNAhu3OEaNcstQkRvHNa+wmUSIV KhJUVl2gVRfUhKi5IiqEuusWSB7KGOXK4GEss+EmTEOpdRGmnQPCY4Cx/VF6FqB9JGPrzmkx hEe4DwEYusRDRsEPB3sSVL4uiGONsnOvg0WB4RQ5UR7ORPA2+ivA7Q9LD5OjQ05grf01E69F RlabAQMfzsM1O+5FRebYVTOs56tGDldbfwlGD7sc9N9tcCJEcnWcBRaXXtjLIx1HE30Aexui H1PBa0pXN/I/R5t3sToMMABDzus3QTnM7aAPlvZrx7rDhwMjL1CZuDHdR+I+VxYLZb2OCCtC PBBsVwhyBIOwy8K0kZagPMYHnWEqlS9PLZLdVZaeMVxEXrphSsyF12cYSR5VSHofGLzbxWCM XWdRg7/1FzCTAK342kozoFt5KAQhIuUUJRJXBKHew96KVGLdlPvsM1pjcCdWFwQWZJaNKVP6 XvuSpQSEjnszJ1oEjFkCZiPPsDwhaAMlDC1ZCjGLnkhFmIJGF04Lqs08NlWiQ9MtFDIZUSn8 U/pds/ZDs9XcUFeQb4NBLrcTdvu2voHYojWwx741CULKSg2nJ2WZ7tmYhol6zoOYGV28PPPd /5U6EkRH3LLUWnWuRDVJdqosuFj5gpI/uhTG/tj0b+FPcCNu7IiaWrPHklB/VK75/VA2WXgN wVjU548DjWEvHlHsYBTMqtqJpKr9lYs8qPHFkr9mKSukHAxsudwMqEtORVSD/wj0Yofwqip8 pP5MGOSYJhI4rYnYghDywMcIPJmEAP5WthV0VhS19pIzMBTKbBHYbeAVUG3jYe6qwDbUoFC5 BvxZ+Kama3pUWDmQJx7ZFZoT6mqYIUD7KXXB+AKuBvDmhCf2AaKigHYA4HtNhllNGJ6sQWrD vVcW7cdd4pUG1s4G6qpo2LAVggdSEFEVFBGcezBAd1Pm63IxgkP09TA0TS7rYRaC65jzF5mu AVcbtMfePdWxrUY66+SHiPlQ6yEaNlJUBOsg6R0NGDB9mUCkwVg6IBBBCMQJNFhrFz0MHgoP q3sIdP8LdCVsYGc1dCcsImx4W0N0EBEjcvA273aUs+NTNAJyRmQOEhIKx2QrDFjKXAdowJIx OewHnjr45l8dJKGusjO+LOR6ajwCEbRUQb9mrM8Q7Bc2dlAPO4gCLI4sHuFql59sM3EUkOlL uhJb7A6MryWsVfBDg2wksvCMMCfnhZ3C1owkdIBoFVFz5QtGKeMA+gGxco8CzBCIY8RiwgE0 41P3nEgZThvRHP0eJN6gbT8vqpwR63BpD/+kX5AX7+7+ynU1G75lP/EMQgT/Ex8LOTVyJ3Qm pGUUwQkEiMbYXASaOuQGznx/ArkPYCJcwrcaq4VSoAO4Nmg17mDGSaP/CCV8KFODpGYoIb/0 Pziyn7GBwA0mviIGdEB5SyEHp/wrfjrUb8UVpSp3UXR5Y0acXNwLFmLGukER9MOU2nKGTUwL TBFlk5PmZd1fSCCePRTQxJkpCjaIGn5Mh91jUlqsRg3tYSFoIbX28DqdMO5On1zt2uMUXesJ V+F0HZz8zkTzOwT9Mq80Fol2AHF03i4SPV4Fc1ITZFzEGCKcMwYtfvh7th651yGLdDMdOm5A BPEAbLe+hNR57omucRwVZlLgplmR0M1XrBAlSU46VAecQJWsNQGbJCMdvEIrbsnJO8GJwAQV lLrgQl0rlAZ8hiOjb1NJdMXR1SJmBjdhZP2vM4oVsrZRg4oN2RLjUcJD6JxItZ3NVYZqYYVa 7JExVHRyhIQAwyvYezrGRsARziDmdGGbY1aRehJY8qCw8rJpH1QgX8yiAji/AWtgVBEhPo6S AGQNM6l1Wo8HRyWdamgddFk1ToDxVxwDC09EpYFKVZgiwakzn8rdYRhsQJnUSAn2axT2pFVr iHSS68CM1gpFeck2J51zRcwOgnHQNf70CWCCqTNJkUUZjV9HSm8D20R1Pm9wILUNLdcSfWhh I30qdIX7dQ24OcwxzsazNhmBbDPyPgTnLd523IjUQQdlB94WHEINXFBF7yx2W+SmRFWgYUE2 upn3240DH46GqHX+jFEznxb/IKZSJPQ1UXISJlACWPykll6hV6QWS6w8n1FBLOiJu4XM0Aw0 W1fsTmsmJ6AW0xesgBmK1XYmx1HCQEtCMkRO+AtWiy4iN7BE6YRqzPpOANRGbcrF++SoyRjW 0c7IFw5sWgLhYcBF0FQXHmbpNeHgHETBHORshlSyAGgrlckOqiHwAWYWUGtTzRDGalQBFJVm 2ibfMDb2OJy+U7JIyvK4pABg1bytdSIDJQE1MbzhK9oBSwP+Tb6higHsyh0mtGEVU0ECRvlt qBNMEAS/YkCFMxKX6eqC/LyTUkZeRIpM7gnzQ1tHoAioYg9xdRAAPA7haFZ4a5oXLvhOwouR Dkm3MKj6CB0NTtSfWzegRwDLKzUgICpwFgLHnufIATpLA46QqW8ynK8BwHJVwcbF92I2HQNe eEjYbiIA9/qaq5BEHlSKeBXIKU5mK4XSz89NK56Dki7Y/yRhvt4CWndwaWes2MpGJwVnzqj7 UuKBTQNxRBYhnQMwOyAkJEmwPvUIIBIbtUNs3QVhvAgBFZlmupaBrnobKNxcYisvA19xYD/c QAfaAEAuIF7IFQEQ/zhq+zRfB1sOoXJKXDXgT6yfyCmDjAKLGrLBQ79oWlL43gbGGy5RPtUh uFJY1opu1gls3noQwsYfRC6uBpqi+PhHTlYbIQkyPVeAh4l2Fxp7DTtCCkTCCp0kqU+sVzZq hrgMHypgGRZ0VZZ1qFbKNoo0s1+3GzaDjywUv4vQkdNQpXlw6tGcAPYGfcpCmbRu68A+E8LF dEvLKAboCRcUfQ2g+8Qo2KtSQygeJy1Swm4mB1JKtpT7H1/MikAWk3a2AhUNb/5CfR6vdiFE C8zRVnG+EybNLvNsTgGQ90qZ1kRgNzj9UOSARgtyqNScWPbsV0io1AxQupwA3I6GkMhunkr+ YkkZd1bi6wHzdxY4BxBsPpJ6CYwAEIZXVBYQy2tZlgHmbJt/IWQUIpORICxa5is1aKIvOasE rNRcF6UzKwEtzjdi7BbD9xvNH/YyQo61pJcqQMNQk+AmC3TLQ1AilIhzDtgQwKqWUhssCYqj brJtzIBVngEWyY7kinSCfssRtZ1EQMCCHPqqsHIPgN/4nTsu6/fz3zhITYxOBqXjd3I6CQVQ n7gaTQL+T10thLIfAS/7zgYgAc4t433NghNY1WzMFXaSNVBaJJnThDcdZmYjgiIDX/V3XhIH UtD0XMJ08h8lEcBNFqm1vfjLsUE7SPU9SA87CFqaiv6/G9SAVP2xYdbDX89FPIhLezt/bp6B hYeKZAVfZO84tOiDenKG+7Oc9B+iNmSBE/N6cgYVJa9sOjBeCNQIjwgag8ag2MWHagGz6isb iFJEW1U2ii+hABZ5i0p4/QbHCHC9RjtKUjMwXkw68/VtUgOZRBIAMX46ilJKztCzDEpkEQYl RmQndFsDw0AHfKADO3wHbDauQ73Rp2Z3KTOBniGeOOoYoK/OQZ17JL9MqSVdYQrQXExY2S+W tGonRMxKAhUNDaT2UaaGdVd4YJ5BP+CLY0+lH7BJWijpSWipRQcWwVbp8Ko4QvNnP2tNHYNF J2kg+H6QjuanBFAyD3QkhhFOdSQHH8LH7G9KDEFVFao77IVhUZWquC/w+M/HTPHoidyLkQ8+ hEcvfgy25h3E2B7M+7BwNEfIQZoZKs5P9ItDFG6e9O7mjgi0R1HJF9+rTyqSIAJPxRvwF1++ oylxAtRh8jMxTIL7KibSm3dH8cwyoRaaRp81sl+C4kiD1h3F4vSHlEzWBYfWfBeC+hcu6xfS qq7tae4D9D/dStf5Lu7O/aKFde1XkgacRJgDxmk2RKQfVuCC1Wc4wjRLcI31eAn0K+ZeBoKq o9RFQq4snLZtTyJWczb/WmxUgMToB+ZKJDMC9/bKgaQxvz2SJhuBM2IJl1RwzgzLkxZ6Ss7M u7xNdlprohlKuq/0hudc3N8DVdnGz0KnVqYtG/uhcOt2uY0Ew06TNiLyoNXQtEVJBiA1YQFC k5fuGfTqU7MBVUrEeHIKWHL5U0CrH1NuVtTywRtcSiFHouFEoNEYU5d8QBZRJiCcmq+pFol8 I0OoVWlbHkOuInMTlClLAipSsDxO8vZQx3AhlDHAVoAJQAHPguu4phk8BVBmqnz+W1SgJhEe JC90cAJ+DlnrOxVEQ0K3HlCmG1yBRwJbEGURFtXkM/wqpynXNkNhhitPH/5Bz6vsWmlO0PSp jUQmSYdUVcHK8HncCjrM4siFIhQjfEAbF4MaO84yAL4IsHyFMGCGotIiBxERqNDAikHUhxcb xI7eFka3MliIPAoAd/cs3IIx16UvEitEWG7NTAEMLhLj83HNDsccagwVCkewHiDa47nkS9Uo /lCIVkqKSDtvO165Y/zYHSdtfELlxoohlT86Ew9hAVV2H9wekkygn7EWEVlo9hPa9C8n1K4W HrwrS4M0YGVzBRJ9VI43elBROZk44a5Oaw9CuikkGjpJGuPebaxU0414L2RvyQo6WJMeZocy whpg3dzlZ3JX8tnexCx6jeXLVYS+tkjEA8VrF2FLAoKaHkMBH60pdNZLZJcCMBs16UDycFcT fxZdvWlWCDQCcP67ZQGRQNruASCwntef6fZiRl4hqFdjvfbrggeJDqN6On39VpKNbgqHqxvR 4RJBJgqDmiSKhOZgGbPAM4rIFZTxSZU2DFKzmRPEeLwmREAoOwScBWUX2ayozJGRDJ5LuKr/ 7FUu63szsFeQhQHysBXzhOO83Vx47AKCl2hLxQJ1P651NhJZgh2norzEmFOcKBy++MqTeoy8 /URhrl7ut1YDNRWPYqJcfNgQiSqJ8ty3VmZUAKquL3gxLIWWHFGhEeWdMhaJXGgfZit/pEVS fx9OI2FiZ0wUUbBhTXsIVwB+1HYMHgqdC1V2SkYGVidyR3ZMBlV9IdQTEKWaqqZmPxZlSm8k FVMEzwFOG/bGK8ivLSQEEwpLcFyAGNZUlU4lEgLvCioGvwK3EovPQUNNEwpA7IKHNnbN/J46 7UCoWzhAB5fIlAIjQeCUyh+YHB2iNq4uILjSRyQ+yA0AEqrsOqL+QiaYcjYk0yqbDQ0GQQf3 6kEVExJaBBsUNNC+SU4NJtJQcgxEVhO8fSq3BHQ6Am1GeswdPmG36wguQBxhA2F3ahwZcVID /DpuXGP7CkILHVbOcOMecAkzakUO70N3pJQwoW6jZuQccAUlcFoqQfZ37fslEz79Y7ADQVT+ sh4BZQB0eyQME3yoAUBUsUvA9iEcJbgSZQwFEn9oAgS3TgW1F4j8FUYKYXhQUcE6UAK7U2YK kAtmE4cWZio0Os+rIRaASgOXRgaBoGrerv0NUlwXYqLpGlMKAht1glVidG7sKAVGd66T+uSX 4sWQF77YgzRsKhZA6sUrrFtWxZ4t/osUO78icXoGeFtc8LuQfcIsn4Z+hExOJqU1oMHYD4I6 kXISNmdenHphyBHAXJEOrXa6w2Unu4fyJyABTo/MpA5oG5U6pwywZ3tybsWYG4a/ADgAfQKD fnaszwJRqBp8jr5NBnpjExaQixRcwTyrFFe9RtWVfRDwUwJzckSaGPC1F0TFRJwIANrI3M2J BxaZVgKPhkSbrMqJz2sA3ewUANpEFp4iAoiGRwSub02oSyrcgHwEOcOcAU8bUAc4S765wgjJ E3+IROVTMS8ZBPzjvnVbF3kTiicAIpTL6ftrAwQCK/wDj60NV6NF6/0DkW2DvWgUCEZU7olI J3wSRaTCk48izVdFaBhA9GWizC1Yf0otQfpkS2t0OQoGHAIs/MpxRzBbYkdQ30MDEohG4S+Q s1F/e8rtaOyCLjd0CZ4D9CLYjJNCvQKNBh0CjMptcBgqoZnsnDKy+nKfgmc5IQcMBMo2go9F VXUGhH6R+MBcFUgWAb/wi2B1C9B4tSFKA+PPRCcTCmXlkg8ONzYSROQmItHsUmsoFBdSV9kY AS9u3SJpd7MAL7RZbTMFRhLTCAz7w7fNbmMMMlEuaakhFhR/O0BVFW6HKrZaxgpNiY/HkmEs GBwNP1t0F5flRlYllxZNLghrAEWKDv8CkTQCsQEXGcCoYW4jU5uqTg80ZYeIyUZEdDKAHtg7 2gPBvsB/LJCOR7kSzJ7YEZT9BZAICyIDF/cKEiYX4bQngdm1IvFvf0rbbwy0VskQSdJ7NW5e Vf3uSySCxk8KXlSerD78zdQcDxLsnhSfjEYvzACM6atLeCKRRMNZJimXO5lTeJdWZGCZFZIU wE6jTFfSvnjuThEPq0+lpMtSDsULKSSgTCN3PglKAOWCeAERQ9RehgmPXKdvDl6qk+sSp9oF jBVS5aILecGQgj+bCB437gM03mcRGTNVsrTKEw/eluyIYBJOwd5GZVc/7ELiU84oCdtJexav bEKEJC7GmA6ijtA80U+g/JL2ww/a6pCkxDNDSmZH9HpZJggDVupkuyMq2RXlJXY0ZmgRd1Fi daKSAWFs1ZpWJgJ0m7fGcHYUcEMKJEZEsQaE8w1FSbRvMFffc3tSThaUC+YDQXIC3j5Zxz5x YWegAwe5RMbIBAgwVgqcMAz27XtyigUMMkELG9xaPJAXg3g0UUS8dCIcgIefgnnUasacpp3m MINJNVsf9kW4uKr/eLHa9iCuNnqtzJ2Q7d4L/Uh7rd4DqAVPgZ7k55y8Xbi3Qrg2DVAZSgIT AEUCEgBPAp79lNYxAkOYFh1GRxQJ9gxLqCSpqQ/3NaQL9qU+/LkjpDL2CqQR9hSkHvY6pD6P quz9v3sU8rnv+P2t//79r//8/aEhlP3Rw/H9ov/3/aT/9f2mm72IuX/K/Zv/yP2d/879n//M /ZHpPhTk6MD7lT626uHrxP2JA9pbKN0y1/iQF96Jv/jC/zRJtfj4ExZFZKjDKrkgz+Pk1gZi ZNcWGWeOpHpEWB2CE0CY6LlgDfrJxDZFPEBp3G5zQYOIC6bC/BtxnXW66kETpVXhXBe/zs7I mA30p9YyB98SVebGd4uktLZh4Bfy9HjZtC22TDXztWfFRlfcnK3Mwzf5i6q5ysemFSBrYt/J oDeiVpRfryiz+bj9t7cJ9CwbstiQF4wSsmJp9tCuwTTQ/q74SGc2YmvUTce8XsGNRBbJLhg0 TWIC357gfh0uDMdnUgnoKSCkSXlngA+4IkLU65X1UPuUF/wPfkkMXT1EWlKwNXnp8vQQ5RvA gdYwJqNk6ktISVopcwt2AJsV2aV3fA2AVvhcSbI2OCn8WwCKIPCB1tgWyfqjtMlwb+zW5t94 Cr/5FtnuAsjWSOgIWSbGBfBHB1ha0QDOyDgPr0xGCP6B5BW/O2zQwFxyKxQuTeVSZCltr5gH IAIGRwARDEcSFbxrvO8tRhAWLAGDFIBG3JE5RREXGMWCOYAxHqGCGPpPeksBGgNMAuk19i7J 97Ml9wT2B6QrSysvskkSVElG8QXtsHdh/2SwDrJdKTA5Y7AysmGwO68e/6vy+wGpUkK9Er9q sCeycrAssn9J4P2Q61eyAUXZ/Yr/3/2M/939jlXRLRdJ0v2D/9BuE9Ghn4RB6aGG10kJQuKq P/v/7jmWUhB++v+v/fwKrE81+xEprRQX7jKUrJjgaTrvTihcbtYu2acvtMzsYuT7NtzLsWsu fOP6vhjcdt1mf+oB+ej/JgOUb/wGx7bTF0/8uCT9uOC5HxoOrMRxkgP8zHLNsfq2fISmaSv0 COP6WTllBBdr3K618iwEFw5SHMde3KZgvqIBdCIb12FP1tAHThnwI0JFsCBP8TMzAFYDtBpm NINJlSgkARYEPH7bG/LUjhcRJsMC9O98c8/ls8wX9Pr768G/tK+sHy7hFxoLErGyy+ZSM6Z/ bEHzNO5FXAPUIbp61VX6D/k2A6ghHqeOCYttAZ5xECAWcfd8Oqpc42JdSAu6XYccpjDdxnfT JCeekY8eMUiks9V06ltqa+CzaqQ0pAVUyHgC5silrgnE/txElIr6uQNrpioLMCrYS+hshl4c GT7QH7ZFeTY7kLzgATWsFyFeV4CeTgM2AQqlecplaBcmpO2QS0btB0pInnwfBPYkCUEUOwrJ jMwBIgkjewJHkN8NXncaPAwXIrpHVlxCcmOyXTyvqaKpFxniHB8cThFsaygDCyYWHRABS0ig cf0SPxmmA6MfNgZtIMVObnptemwmZ0mgAluL1dzseNiBhpIXKM4HHQqKk5gpPjktkoX+HIVC JNcOSigXO9YDABqzNy2SZhx2QyaDhkuoGmMLQngUKtyulWl6VBwBTBR9mODryodFjYGf7KZ9 mOC30NOY6/hEVI/sO41DC3Zn7Mgib5AYNj1XX9/VI0t5tngsFjHYF+Yyz2wLDXfgfWwsF3qe bNluHSseCXU2dF4ms8hVfqAuPc4JKU5qPnWxbjcodRJycZ3GfIVyOkjbfg4oQjLtHxdIDgbi LQPUQT/LXegQ5p6tqEiYgA/GXFFmEeUeDgMIV6KkQRha1G1Q0kZAJfZXSaKzxP0cLbJLwSAk RpmsyZIXO54SRBRj7gQgwFXR/mUU7xhJBTfFQ4OEKOwhbIkcAyIKFjEogkhdn+DvGpt4Geo/ KkAdrBnHeiuLRVFGUucQ84pnRAES5aBXKCVyzg1eECVdNEFmAsxlsnAEDybwRfZcDQ9CcWMr ClJD/iKKOD2XaIxnExxRhicvjaIhQ1EDV1GRAM5yLRNwlRFNSCwFPSFxRSphkwRGhmxiaJhf TCn8A/Bpe18RDlNkbi90Qq6nLDVdCwR9Ur9ia1vBU0VOEWE8YUKFlIdD06AlRPYET0aXEAVy IHW5itdPCnGwT/XdACNgbXoXEXUVpiZxCo9P9g8XLWXgFFXN1l0WegB8fQ5TXUZH4Bl6n5CW 4KvrBCONSa76HsUV4CWyJwrfsCZ+BYwAwBh9mVFHuRVBB4KeEWR8YQJ9gA2ACGDOF863F+JO KhGjTwosB3/XvjLEjmJtSbk5Z3mitrZ7jQKL7ygEvlsghwPSPKEDgnXrglIGAT/GWATlf6JB PESBCAIhxzaiQRX2DG5o3bHqkRtTTQXUETxyexnk8uA5PgQ4/UUUL1ROSUARzHzfBVrVuGDz qhDWytURGDL0hC3uCWv5vod+CxctDIjOO7wB0YCAW8QnUG2WBJlPvuaUYocJ/CNOyzcN7aoD edJxjAlkWBBLSaS3gkgIIRgDEjY18BRAsSUbaetScdi6RACIEkn/2BL7AipPDnUZV8Mi4v8f OP8/+A7QPvUgFMatJryTWSp8F7OFEJJGfFF1bAp+APGqo6/kR8j8M0fTWEcDFmAinjjJ9GwR DkoQBBb0LN+wUhgMImbLpi6NJDAqbiw4Ft0AdtW3gkRDyu1AAu1TG/fOZkW9DaI3WESLxQGs CcCh43Z07koDIAYs45cy7yhKw2QENiITA90HnmBmgVGEAbhkV0H5ORhgRGsVt0CXXLZSMkMq NCovT9fF3qlSDnTvdT5CxUbkQyhHviNbBllsmyLfKpjhonf5Kq1TSgrUpP9I9gFV7VhA4X9C EWE5ahhOVZJm7CRqU3cT1heiRwIKLR9bDgGxT1ReSWuf2maUH2mNUgeFBsSCClZCsxyUZa++ uLsbXwQguOD9rQQR8bl7HnrVSwszhQuRggcwZIhyJAS6fg4IwW/ikAO1gaR01KAewqgMhiwG UCBBfiMbAkzWZncUASlSHuIKkBbBD4e9V0UWZr3vcFeTJSGi1QwhLCEtzZkgxWKHCC7NT3Df NFXDF2iUEDgCLggpSulhEmpwDicJXMjKhPQiTJ5ZQIy2BAjXLicFUAHZHFR2NnxnQvyQs/pM iA2G9pQVEoygc6YWch2BBu81TRjCaIHKZZiocBXVPyVUnH2ffp8TFlidUR4LeG4QjWRGy5Y6 WoJ7UBxIXEgQQm1XKwYzNEbedRwdybA+CtWHnuXrjDw6xavcYh1UZRy2i9doQ1YQnS0TVNuF u3W0RHLmOErvHoIARhgKOBQ/t606ttIhK12QjYWYAfcL3m9eQwSxaxltMmAMahBKXiLSkyTU aEJtG/Wx3kIqVNGU2B+6kjVNfrd9Brv0Co6EWRGZiiPax2fDuu5YVQPFP3MHtkXoib07YwZY RqUeBg/YIrn3WYKY9tb9MRAWDkkk7dlUFAp1dtMvcE51HGpX9GvEBBQV6Vc7JndMIZW5BqNJ D60DHWX2JBQPLcS9ckSg5Fs1+FTyhGbgiJovnV+qgJ2F0IbIEBuCXDZWUfh/xhwFqQVjnBpK rC6OUbFZAjgePTjzO0xbmCB6f647NgcFgqwjQQFagnMVS/BaIMxQT6OMf6LrPipsjLZm9RAA JjoJtGEdzuxUFvRWN0FBpFK+HgFzj1sQk0SGZII6UFsX5oO51tiaBOMfCDxKZhpPKvzEXPJ2 IgTrasE3+E2gJLlvE/WKy52TPzIYBInGny9eQtS2YvT0UeL493kBK+bhYkkSVmIh6qZbyhwx 7uL2paIf0DHN10P8anpR19meU3V6U0oThSsVGKjST5SHQQwVpIc8F4CJUeiWhArWDcOWokIl VGgNRQkoLEmbERvMjJDEUxNxisKu8UOTYEHGtuL4gtwdFvbAD5AD/0GTeE3utGRV0XxpznBJ Hl8mAKFlHh6xtvglXbJsXHwCkz32xGsZQbmGBMNahLwngErMIr/4oku8gt7aQg0z7kyAS8aC NahFzyBCFMlHBbVDGAq0OA0IgwoOzbeEQ1QRagmEhJ4QHjWAQfwTuQgzQlJ8WjInwD46MxH4 oW9BxEle/ghxFi2WZ3ESVHdZEpAQIwC0E9qAvpQWsgbJqFEAPtnX1VQsoJQ+3BmUgRJFj+sf BJIPSj54R4unCO7GryAAbDq+XIeIWToXDLd45TpGamm81MPUDg3dJRRYRFCxBhI3CBxLWQFT 4s1BqS9R2566d1J3D04MJHbk6dg/z2DrfMLJziVq4ZZ4mokSNDANqoK+fvqwQxN0eIUUrRPf yR2K8jAE2sDHPcGNUJnWR2QBKzRBLi4wwTFUOVAr1srIpwofi8fmOLrXG6kzwTs2fJS8y32w KM9zl7wGCH7DXGYFeRdfHsc+zVJvXoYLwC3QvJg8cq51Fye8D1kiVyMfM/dxbNCvgCAFtrcO QHdXm7j/CVwElwrIWlT0j3erj2YEsSZrVDApuP0kgUCikDI7GQcqbUYQOa9S1BYYjBZ7UvZ3 DBgfAIjOi4eLKYsB4XYDBlFggXqmngLUHw77GpU1bOO/S2oGOughAETGuBTT6YvAxCA0FZtt Be+arRNe/EgZ/iDs2Bb/iUtD0Z4xOIkeZQzItBN0IBC+CYtBRTY6LVSHCFAuuLKr90IGQxDS NP0Q0EAwIxuG6xRpgmDtx9Skos0LXAS7DgJLo5fVKQAEShiMd/ddErJEWPUMZziQJUxO7Acs k0qALIISTWZ0VWlfqtN8uCDoC8Z4dqKyEhrDAiQaIq0wxWbrVFyeVvy2iHmsxwlkcBu9kbAx Voo5kRZa1TUn1oXVr0nrjiVc6kaoFjiGrAloy5Gv60jF0rlYeh4QzloRtDAJy+8c+nUmzy+b mJxAEusxF8tAWShckFAREPanxWB3rDqQUKcfFFNIlM6CQxaGswWqhzs5DUxq2staRIoLaqHf II6Hsnoay/sBYVTn+0aJISqlKTxgazp8cXEkStOyERvxdXwT7E4o5Rmwo6rdRTN2drYONIvp MEYHwowreyiUFHyQjVZGOvQ/+6wW+RVlfjSJPAwcfGLb/KjwBfNKVQhm2Sh75e3/3u3fHCCP 6U7aW0haW0FyLXeGKYxnNxOqC0HTPxA/+HPwiG7/fz9SEjZNKoaplR8GBVIu7hAQaLDBEYxL 6wkNfUhJK1AcHTmtBwFKmSQQNE7JLIxg+ZcHawJr/gYHbA91N5u6bmye1yNUy+LUI0Ql2vBn Fj+S/9pBkQ6ivo4IArDGlHgU41+PieFBckREjnf5gvaCIpI4ksMsOFSBlhXM1GUQTgiUGLTd ATKTuUrx21pWdE8AjJB2A08RL/Q4CookJMKgArP7wuTd1nOrL4QSSRVTKeCL85qXGvZnYwTo U4NGQ0bsSP8qGUIUSUfga+LLTSQhJZP8K67sQP0rgFlRDhRkOkVWKLChWnmbRVs5Om0ksGwi TEQMEQvgBsAbKM3MiUOMbs5wRxcWwMLGEdoWv0AwaV4v5D9Hgh61EHRGQwLgdDMzSbaAHoEd BeQNCRZSjNFjb9RVhiAfDcBc1v8g3uv3D14DPAx3yNbar9BVB/X3D9kPYFxD6Y4ktWvILADF MBqHb8zRJIlSgPlaNQEDBwENzPaHILS7AWgigoIsxnxbVuhlCpkW+qMCxhtrQsLOQ3ggwHUd 9GznDgZgpEkRaxTwqsaLBffvZFIEbSoGDlbBpFE5MIY2H2poaFNsFSMqiAMGxUNeE/wFT0CS IwjHd7+bgkhDq19xdEND7qIQcK+ICinGEpg5FTi82lApCwn2gD0IVBv0OPaa0lpAh+DpZvAY LHZm5LdNCzgTVw4Wxh8GDHAHsL0fx6CbHvb8Sbtw2EOxSgcEcqLcmVO2BORQFAaXwEqxhCms M/OQmEueYLxZgNcpIGcUT7BzQsnW4IDjKp7tggEcNEUML+7InQAHXROZkodo1u7GS4EAXUaQ VjcCP1oPHnbEps//GiZUlmJza1QO24p0Vb3C/NZFIiVGT5S/aqHRW2IPBWHYBxRfls/7LPdF FBJYk+Av4g43l/JKy/dSbkOAi9pkJRSSEBPVfeLUoDbhbwEUFToCttIQoMFIfwErCPuDLgNM CUg8bDHOtT9FpU09YMIgOGbnjAm5h23TUkDGRBekFViAT6K3kknkBpHJRBaUgsmmU3JPePa6 kLxi3PCfR7Zu3GLFPymfX3CGoqYCjE6b61BTh+yUs9CkLu7IojGkw/RhnWISAc5Iy4qnWkDS RP30g2xrQAIXCTZFQ6KwUraytkHwIk8WlQslYQtWENaroSBFg11dgyBEBwNa67aYdwn83Otx RgFeI/jcQ2ZYlJpr+8GP7EwQfvmWBC9fVKSS0mDSVjaqlq5gEPUcpwWcqkZy1LzeNPoPMAgk gooHl2mFipyaQWmdy/hIZXZhyQvR0rGiL+TIilJFYF0wTGiamNsOI48mCmw5NViABc/lJILu C89azt5khl0fpLbRCZVJElIX/G/GE4MlVGv4RTBeoi44BQQfRUuAlx3mg4W2fH5gEEJk4n4E nRAM9xJKqzZkV4uUh0cESHVDNL9RbQ1gM1Pwku8MdEQAN5+N7X1OSaprW2KGzwjUdE6tIQLu DwkJCIq8NPbGXhdiz91U6iEYFlKpPMxrN2BCgNxW8Pt2EzmHIxw7Mhw45tTNNw5KHyYQF5MO HrlTS0QHtQwXaQJ7/j8iNCMx5FpAQw9Z5jqa+4asU1BhABDngO6DMnLQEAVCm7ATExh7CZbe BL6nFxydaK2odGpsPxBAZ6qKgFMHBBmIACRFWKV8R9sBUV+iCszjZCQMD9px4cM/C7IA3QhY xSRbDFJBmOIDEECBFsEgFMvOi2tjR3DvJzUgPAFvADNLQxUtmTEq1hITKIdpFEFh/mOqyPsW OQCpzkaYAGYJBMgVC93JZptqVXPuVCjuIwlfkof4Ex5aTjgWWTUVJxTjcm2MlgjVVjQl1Ecc AwBBAaqtczyq6RVtXhYhrcARcIV+xlEDAO/0GoN6ORwDSgGdWU3qvQoBbJp3xNpA/tu8jqPE khAPFR2t2eJY9pLmIhNTO70aBplA1caYBdDwYmQIpES4iMUG22O3snOUxAVHFQEOuqYuDTJd SMwKRAKr3voBCAByJCz062vxpCzK5Elh3eygro7ME/gAfgBQDIY1HizHQVVnvkAhSidDNj8Q RFcUbNotHAScQV0mi7D2+FpALdl2JNMixxhO7kT/C2mtGYnDe0hjTwxjgSqRcAUeVJkDpooE S0QqasHQDFiDlq8At4JGHArZSBOX7n1BodMIMnLJiHSFcG4cFkoEdnlumNFpg9d5EjqaFvLG fmJZqqN88P7cu0idG5aah+irNkcA0BFT8UNOQ2Mztr4HnCJaGvgxGHR+/V1TCRxSvA2uJtY4 QpeEN0UaLBeIx7MTDZFoHsNBEtkeTkXgoHZaPxS9DiojfYFyQrnF/1THTlTCVYp8QZt+SDui pK2SmFxIXm5WPvtExsjMcEFEi/iQWar1/d3i2WgnihZN18ViCEH+EgaX187Df5AHsfDgRs0U bUepNycNRBzmDjhACdnXD0BDECUo5eAfeiVE44gW9ZgnxeAdwUkIhA6PkDc3RhN2y3vDvQ0n UJMmfX54CTp+FlI7qoDpUp8gf3dKRMyPDHBSgl+HQRdgnkQNNgBu/shjivheXy7MkBsC2h0n KQJcTh0HXxELQJRao9GKGOVmD4bC/wIF3fvC6YKsCtY4hHU/HgZVAz1iLBF2ZnYIKBUtYL9R tSjxSYDNitM0YH7EJKVCIcYJsMYuP3kcM3evOUSPjwsImcfBv643mEVncH1eJCWmNGFjbGgP zEo7Qv79RWRpc2JgWm1WUyuv2sIY6f8xi2UhnQ6BK0kdzxiH6B6k7TIXRxTEx2AmFE3sidZ9 6CEOWW8SfBSzKbVCa6o+bAmgVc03ZIgYURuhSjrX7YYKtoPODQE6nZv/3U75aXqtGBMyKlhQ uoQfBc20PE8rTgIofnLog6Y9Bz0+V4tKimkILpoPwleza5EQ8OLUPSZ1ivz2PUCiV+U+p25P DJBNYq8RsWlYAwl6GQhLZkLRSbBRCSZkj182/wMjIKVNn4rhJgyym4QLyFhTJCNE2KZB5AdG QmcDzIILBFdQWQiHhUQy4+5OAVmKqqbKEoQ9KTn2kIlGTDx/YRfpA7FVDgYKCz3U1o8OLR5I 6U5CvB+qhIe7RkmhQ3KDDkRpk8UF+KbUMgV+U3QAH5CK8vUzJ59yffBp+mIgm42wulyLLx4l WnayPszmzAcJAgXf1YaJGhyBw8DFWFnPpt+KdEa5+0URTEKOnV6SNktxNhjyB2T95BXDPwkm DYpSG7sIpUyzNruopQCVQ6n7lXCGFFepdB4B/rvFBglKEAhFSCxCEi3MXkgIKLgd0K6ZVREm KYgX33hhwxcXiM8Ftj2uvWIFCh4BBz4iKpjHREB9C+QWyGRQjyUG2pRWn4iWGBfaFuHMY6Zq zKYiQsV0qQWQ+gL/DERDkBIWVkuXNPDWIpqkH4R4BjOP0kFtIglYnmJ3AP5EbzJHBhBJAASW E7Qyd6QmC+hkjYPBRkADM4sCDc6gQcIXuFY2nVAJXD+IUDLcKW0hH4r1ezWaM6I0FGxsVFfC H913mVicw34kd4n1vlS+EkHbAzM3WQDhVBfHi4MWpR4hnX/JivzyRCMgKtTAK+WNulayfCFB 0lYSdwVBCbR1SiSIhkagxDlGrup2rUA558ye+ulAigkoWNiUJN4iBhPWgTLXER+kI8SYGqwo MJ4kxT0GFl805MI1mwnpQQ4cY35o3LVqq1UwAhk3Ctg1FS9txZ55YBn4GQU4HDpO1/TAhnsG MXFIIWHjChMNhBf4O52GbE96ez8RydFFz2unCtgUoqd2U8IYxIlazwRkdTdOVhskXB62mIJI keQMWopqaASoiIp7ESFaBjULq/DwMS18VlgezgSlgcSBkC9JTxxVRmD7qxDoUodkHuJ2fTvU ATgkYTfLJa4LTW4bsgEIC3fadxBhZEwcFvEKvIpzKx7E/MwSiUSXHg9OXgwDiqlJCMwLkDoV 0rcEr6j82qLW1NamYBFSVgX0QxX3RAheCBw1xLXR+FPDeDhebz0q+KQDP33ef0fgkQiLNqER ycURvwCf/ARGQKP6oEoom1wu/gUCvvCeRAEwUHlyeUPQ/RVx7qxAUgj8C/aVziGfnXysBYpd soFpQipHDh3JiuYeDxoCFLoZDkoV4OvNkIxtlH42DCJ7EjORE4A6rwpRya1M1BBm4EXH6wUL D2oWw1DGhiFRTHtKU1KQm0JU7x5iX0f32s3HnwlJEIfJ7EvNFVJRG2RaGdVJtJTnAO1lQBIH iiz0vvAZieTAYRn+IVtEBisWqSrfolpON1vozgTSQhYAFWyPCC8+lSBH1/AcFAEAqHNTvqE0 OQV0Fh9WQNLIJxOd6UiTKBODW0yC4oqipD5/EgcAv6kMLrUXc3IKdrs9rR99To9ddlFJo2aq KcoM1wgLGb0gdpLPVJwFgEFzSTQWrCBlijsb9tgOikFJNzkWS1qU8WDjixZgXg/GPZduzUpe SAdAim2PCQtSFlvMDCI9cmYuLXJndgxwbi4bG1lIUGmg+zvM8Ba+ECj5Arjq++ilAUkOa7at CCACt8AcYbDTIAPUQcwBwVoEni5sUFAukJaClW9PE7aatjL8E80mEQL7PGI4TT7qqOqzR880 CAJgA4ZqA5wNOgtgKvK9bKD9eN3bm0KpGUgRn5MFR1636ywwxNwwxgqF/6Mqf0jprCizF1Y9 AlHyataZRtYLFyWaCFC6WOzfjNccpHpkagCsM1kUZ+4nNxpSrxw/wJwVw32LrNQexxW45yJN bzhOWoFLZkQOI/qcBx37V0IGdCa5xcOqRkFhlmOm7OTAZBuW7kkj0hqChkIh33+mlOwHP0rh iFnphkFBBRinwGEJItJ2LwhVBjNFAKmuBo67q6yWIjtIle5X1nIJyYKUf61eAx1yALgy3eph CZuuaBVm2W/Dx49R4kPhGC2qGCMzTAWA1+8QAKVkTM/iF6VmAKCA9qXmgUQNiDCjR/Yau2qV IaeyXgRUi/EJn0MCKK8Fp4Z4LuBzyAOiOKaXRCgbFwKOb7LTxiAE978UAxv8F0l6USRGheH2 2o4OLFNOUhxWQ2ICSJjeFeEeT/ziX7C7JAsZFc8q0vcT3Tn0GuIH4CMGuTZNjbsxtUJyWxVH dBZJ9nUcaQm0ZhEK0BVKu0/Rq8bPHIgUBMRo+ihcZQx1uAD4MEkixr98itOcUIQybCSiwTO4 QU8In1vz1Z1nH5FVJsxtUD5+U9ABYE8X1voALHbsguXdB0dAEhzvFkf+hhAUEYJCsrTAEFtu MJbd7+gLkirgrBzO03eHUvOeNcBVa/yABhR3Jzuw71kMFcMLEATTXRSZDhdWwZBsZmj1Zd0f BOI7INBRInQHRkKOQ2qj/P4uII8ItfoUHoolly/eSxYDJMnzl0IBFAMjAtqqcdpgRBYNVMZC lic+p3phbzJ3lKJP0FYtdo78izpRz+f2/8tXmks02QUMyuObHDCZz2wHKhbhA5hWXHCZy3NQ 3y5qcnpRaESLQN1iCCixwe3LPp18TgN6ZyggR0bSAe6G7Sj/Qkx7zYMT79aIMiLY0htgcEpf xkBQcFIhorwsy0oNWHEJVBUby2K87wspstTQkeNPyo4AZvCy8N3Kw1z+7q4NbajOK/SASWpu M+zYXhNigk6KXVw1TUfpilytDwRGqA4FplU3fABC5NNhB1DUkIX6oAc3gjJQaCE2XLKHfI9A qDlzHAL8YAt2b/mmK9IphRxp5hGBF8Fjgs/e4OI2P23HCiiBGxHW1x38KWdTP+mAYr4VqgVC Qs6Icd0D5FVVX70X1AbXc7a6FZEDspreXTPIBq/OycvoxIWBCswPJH98C+v40G8cP0QMF4Of WU0rGsxPQsgb1EoJqJ5yftzBQFNHPgKbilMz8Wo/oOVcA7RAT0l2V7EVd2TtRKqkNWQZVQhW bk3xHH5Kht9I97kQdGchHiCl3VsyTk6eGkrrIVNfBg3mfUgYuV4wzd6GGCQblpkwOgKhN85A uwo28r7r/QEwGomKwls/v4xCP6I0P49Q9GFCecQzFiwCgWiXvhCAdeFY6XwqTUNFLqRUcqe3 h59E0d5FRfTB58Ip3F8gUzcLRK6yWcbzP4prsTj7UB//uRc05skFQGDLddiPO+RBQ/kXUCfx +KkFGLfn60HqGpv4lBEPihzCn3rX1MBkemCU2iYaAis21aHEhVUM+LFdinq38xhP6iWJFkTS fVqCt3hQXQVRNDs+IECQbAZD3FKPZC7HVk7tSQZsfBxVy3hQyuqg42ODX34DcQAmtofcKzyu EmYcD1MAtRO7o+yWhpiADYrZPCZZRabR3ECyBFEuahHFXdNIvrkVsBCZA4THB8mTYcAFglQh xsswdwKXMswHyXgLoV6ttaF4lhRf89dNgsJ0O+lXEhALJNHCf9Iko+hqCkMPLhc18nvkFRoX PEUAQa04iFmnCTZNIuGsDRcoiKQFYE+q8wd2JQ/vC0pFGJFsaGug1zSeVA1SUKn5IXyCh/2U 60RzBbmXOzy9aIkNgqyHGom1ilWFmzGdCEw7e0CKKLvqabO7qPXXWDLkDAXCyqIbKv+kUwty I5ft9BsY8S5ZALGKxF6Rg5BniRYOhXnnil3QMAXCiKB7Dw2U3QcSQCDLcX0H/wRSpgEOSjIm yk4IHA5i7FqaRlIQEhQOUONGqGPzU21pSDjTF1dOtgLSJZsX6VR1AQ78ZqxiC30RUFUoGN9L p20ESiES6VMWEKByjzgMQn0SBsWYAMHaiw1SF+lBoURRFk5hBehDpNA9KBr+8EPVJ9z8tQQU XgtCSRYxGDhZQokcOtL+WgZ56Ze5kUOUucoXtBaG22mBVxsRF60K3wl1AoZ+sOM1I0d0G/jX sRMWT02IiUyJXDLFuvGjNjQ/D34P3nLObz8Sekzo9AbQhhUYOrUaVp2ce8jUkCiM7W1AAycU gYjClgGucMdg+Yy/YMqoOL6yA/4FEj9mMX2GchGwdzhL5Tz3Ab8OYTrRny+U+QDZmURoKQhE YQ2CMxQ5AZFQIVYqCnMHQi+I7wR1vSxEKTlnDnQODua9eAB3FP9IHjdFxjkZx1q66yyCPU0V NZMgmSGorTr0R+sKomXeQNC46wM/XHUQOOamB1Aq0LiAXAT07uTstKL3pGsoS+B56cBKfQdE Kv9lZ9tScQMWwr35iagMTBZOwD5JuOoTRK/VIQAo0A21D6I4P598YTIT3iLtPw939w0naxhU 6UZjoEArDhFTbrLaAvtX8UgYidagLkg1YQew5PrOQ1p9qU7Vgl98V+a1fZzCf7o0mFKOClL+ Jeu2vjpWTFCOHFQE6xbijubdvq686L9CvWhC6s60JkK9pwAIEodLNZJ6ExJ7i56LChV+WORX ANk0Fp1yCBVoDQKOZIDkDS7EzUheRoz4nkwBO5L3S5rhVAEAHFZ2OwAY24sk/AANL+19CohK ooKu8AS8hpCj/MLK3iN3QN0BvHNKgyRJv1ORQgpEZOerflZeJ4AWXHABb0xGZvacCIcMTddN 4uEdk55301++tswW0wtGURq+Dhy3cei3ScgCKLyeUDxLPlZAm/hI4BDGG3VJZu9zBYhIPr7Z aFKBisk0xAB1fZQb5P9s+UjDxAA/iRMiQI9CKsM/0x9UCeuEB9UaOvAnRyEE/tZKDmCfQESp Z36JAjQ+EJOiCmoprCS3GI9huMw9frCVATNpYQgTEgIBZiIxVpYM7k8zp38TPuA4p0GCbfFP E4ZSng8ShyKzNTqGEKUDZkcmgmE4VNsT8kliCQKcJQJj0hkJdwzzLgrG44SARqFfZnDBxnHQ wms6gjLCw65zWeNSFnRsw01OatyS1+TN4YwiNCERzNyDyjFt5c7gME/Q6CSI3CzMWp4sjnZB sqhv1fx5MZREGjnVZlD/TiIVdm9HFTh9ERCA2zZUGlDlNo9X6HBOgJ34lYcsBpBWsiN9jwkt wBwjCwBCSlYTiStEHh7HgCP1AQLPREMQomyqFPQ9XtfHuF5LttyHeF2FDNcSOLqkA3tbuFJL pmlTbgwUmzIjj2QtaQcWTX4SFonyiG5jCCg+ThAch30nKBFnqLnBpHQ8DlkwUVPH6pnPsEAM ygJE3VeWJURjyD10Ba66uJukKYZztwYuK9ioToTQBtHT3AXRoFzACuMIkcyeQWwLAlZAXjRl PVcdA6MYbyOwkmQG179iSMt1HwIBTy0WFWQHy0FFCLoqNtEDKjVStmarSSYLRndDaSMRMydR wlE6npw9M5yxHSBNXMk23Ct/Sb/KHg6AuyILm0sAm120Xw81egDHVsxMDhU2fQ9doH2KX8D8 E32aHjJ1FVLG3gLOBAu99i8y9nX2whUaCpduV0X/wQ4ZnMcnExmn5nZMfwc2n4PlDCG33qkS C6Z9P8HcqJcP42h4KWAlMCKcpbgEAaJs4VOLXYGB/CWinbqNBf00EELQT+Q0AYQA+km8cAhZ QhSvy1hQO4aunNoTQ9lwYmhV00wcE4A7GxUgKEtvCUVOLMdUd6A3bSpCNkX2P6qDBrQm1gM/ H1acgaSMmJgWQgAMG0WBRdYnNPYQDdTykMcxNVueRW6FxmKWeVVF2cRsiw0UTtG4qoB+SwNW i5FzTnXQBiRIZyjGqIchjcbZxXxq8MABlzP3gMjiFjO1Aw2+UQeCaW5CQ/7KlwMuAr8OyRgE 9xfAKFtHUZMgr4hO8MpJZHJ6eYYPWUcWq7IKFQJYk4cKR3cYkmEp7gCA1FbB3ABidQeCG4o8 O+RAkNGhEmSFn2S/gLwR+QdIlkrYNh12St1SdDwckkEkvO1EnyAkVgttANk01hJiJJYJR6Iy haTI5qhbXjVR0Ex+5lQg7HK2Abbe9N0d7NbNVwQBDBUKR3kNBkP83GJnEVEK8YdJlucT1yP4 37b4Q0FqCpvVye8pbsgent/0nDUKykRUSWHoPig0Ug1T3NMUNx1CBnBMelF+1VJFImsF9QP9 3I9FrdStL2sG9QT/e1Z8H2jn3U+kKzvuBUTrc+iidlCHbefk2UPpXsZN+hiZz5sYLuPpLqpS HCQOdhzcFt3maCZyNDCZLQB4sWabz2adqlQRnQorw0sCfl8xexrpSHn/CDQGfgAgQkRDWGcs mHoXVRwyGFgTtzIUJMqin4J0GywRYDOOIkCUeasVUhc+KCFUJaZQJP3xhr2z5v8Tc7fFBCrE Ex2B5B6TOTJ1J06YamlFYTgFut1Up3RBx1O4Vz8XFMnUl31KC6ePasriEk/slMouEzjvOxG5 LIhZYOl6tdKikiVJvkoDsB5aIU0eUOAa8OgG3kfvy63CT5cBgZYQmSuuxARptO06gjogYWVc 2/GM5DYMRd5Rlrj3B73Q8IlnVtsaXyYGbF2qbVQwGwcdnFjy20sSWIJZQkbwYVqTQqYL1QY4 DYkC2EosJw4XR47ARVfQ1IFaLNASRugMH+rikVdpmhyx7ExXtgYgqZBPo8MeZjuGolUVqVQ3 JEDXzQnQ7jMB8bJjq0AytEWL+r4b5gZENhbO6J0zLQb0iPIKAvYmGvRWIDZLfbF2V1CtVeJw lv93ZwkBYBXFxXDiAq5VQbFWVBdrqAsRh/9xGY/FWAYDpuBc9K0dNUJ0B4NEyoUKebFBue16 MrSVkoiXIE1zpjfdETcAICQ8kNEUKCARzKGsBhIAFHQOHRjtD2dTV9ik0uogRS4CQZy3XvV5 ClUBFLQEKLVKx15Rkll3gInFQKefDQcXcJ50xk5HHlZlFziIaZy0lLHLBr0rW0oZeioMI/QS MvQ5Gfw8IFqyiXeRYCSJORIgDk5UOswP0Hso28A6wRBA2SBVB6UAcBKPgstBNQnEsI+Ijwe0 le3OZEbk4A27ailBPeReDPYy6FUYTGgsyXZ7/zKPgBWSt1toDX0vv2L2bWn2jjNU8D7vDW6V NwjUXjGXuJkrYT5KmDflzsA2JmnOY/Vs6lDSOeQDE4262MyGohpu8Re0LgnHXFPDjO+tehVh yosRLhNNBtuUQeH0UT0chVKHh4oqQXKEnJ4PQTPOpQUVW0Q6Q89F7/98yBwFhUJFwjPQFH80 csyUSYSSiR4wGJNO+BFycjryAEoV0ArfmDVohIsIjleoHRfHhyJ2SIAPP6rrAEZdeBBGprZD 0gE4OxP1FuX5F0ccoQ/EZEdLoc1ZQhd+ehgrxGatlXY79EcMX56Z46APniN3blCIhsa6XcY+ 7Ib2f+S4T4EyZQpEeYJBQIRo7rYcol6eGGHyNwI0JWGDkO469ZMjjfDkIIBARgOXDS1Ak9Ez MLYBdyITInNES8bN02g1FGS3CohWBzmsA3IIbFBTnRb0Ogmkhl9kykfgyUojE2DvSm2qdPtI yT9aXUkBuge1ECN1EjsCNCsjnRCqbtpkFuAD5Qw1HipLNwolWxwR1pwUO5Q7xkBOSoGxoDtL CHZV5BYdN0ESb1FL+cX6Yc1ARQaE0z1l0XJNxwG2iYmzhndC2BjQUjptX70rnnNECR9TB+5U wnRZ9kYMIZEwGm4nWyQDTyAbQk1iFq43p7qmTC7McAInvYDohDBcMxgr7k0iDCpNQRB3WlIR r2E6TO0iEFCDU/hdRl7gblE4PhfBKh4mN746S9wT989GLXeUfTcejNYOI1OIXP2Cv1MIL9Ix VcS3YbldBzFDH7vWN3t6snQvHu6IBVZVgyzOkxoB5YlvkSBXMc/pRswIVlUae3QnJ8cv4lAI qrbsO3gSHttaHz5h3FSc9gsqARC9CiCiVkrwJQW8D15O7H40Gd1sTXqvUF8eSIrLyA8V6J58 UEVxkQ4FA0SOm0tTBLchPoMBAuHSiCpFMDdhTXwIhEk42gVWi1HyxgA4nC02BH+SSGrHWyBB 8pwVhTD8ZG9CWNVy0LJZHADWQxo7RQQRSexgZjGGw3LuXcnBb/ZosA5TPIZXmJL2El5Jz8ww CZTDbN55oONfpBpmhhhKAgOcy02JQjuQE1d4FDGEiwvs33qqhcSRzlzCGAFgUO1HMQ+QFOiA MqpFetlmARN8PdFYAyh6rDOiF2VgAktj185MDQZ2H+AiZoDoAJEVXMOkssZAEhcaElJoQSsG AN80syQCrM0BxvKyetUZTYBTBuM5BgqmJTnyooBgE+Lkwx5iMXWPbfTTcOfSpKxsew0DF0UG UMtIRS6/2swJfYNBAT0uU+ExFIIKXmDLZZMjHXrMhtPdlzR41Z4S69EM20wBTfo8R7yatR3p wDV09AMcCU4kOk4+FGMYX3/SWkoJ1++x3rKqwlzMRuk1RS7dkOYXXjWQLJSprrSIP5ApWkVp EwRQ+UQxdeEFfbmqAASiHajGgKhWqQIValELPVi3Pezf9P2eU8Cmk5feDHhTatlK6UsOIBT2 qgYQOUcvso1WLsISwFNDxoAfwquMEY5WZuyssHQXRspqYcn8LPzaY1Bf1E7YgCgNEYEaoIVw SWCL48RJqjFBdCMpA18bhgdfIAVbDRS3xZ0I0zfgWSaoio6OQ/ZkZ6vhNnwoQEL7070Lje5z Ggt2hWMTuu0U2enNxR8EpkDZTJZI/zgpA4iix4+zA/cGojsQVDjLdy9cVEdPuBJNBJOpKh8R g5wAOVitL+N8i1GkH+XFwulJCj83Vpsg0Uc8zopmW7eNc8lgAUVIGIKCYAEyhKvmGPZiQMUb IaJb6oCREcjo4QOXP6guuVU89kIOdl9CnU5dMkUcDocPo1gMOZTqygUcYmWoDvZ91FKlAo8E C9kGlQ3bQdoeKBDwQoM3dFfTKRrNBemGBjYjBL1zKsQwUD6tBFaztBTRt9TjZVr+/vJXRE7Y UcjEn7pVco6MUiqBQ3fXaQBHjxUoz39p1bw+Kd0agw0WFiXOTKQETmwWMQFMtBDyJAqosWLk Csa+YGtJJ1GzKhutQUoFIBJjAFf3wBS9ZG1wFcc4JC6eNZu8NFZ/kmZ8CglC/5uUJk1Dp1pY SFFuSCijQXoVCCjYWFQjjQqUX5qV6AtD0T9gSkxKVNp/jv7LQ1hums2+gJFKZEE+Q4oxBgk/ Ek+A3dwZFZErJED5lYfdI1M9dWf0w3sBQjJqEMIeBY0hFhxdDXkdHA7PqLkj9dlU2CS7GbPD RAOHDgUfj0rJ3AVswlT9GvyABvsPR0faiZI+EAFzMWo4WFQaWAEy7roZ75iqEUSTO4FSZHQl rUx4+xJlK61TV+6hxQIfG8d2gOzh3lAUGWYiEckiTbR5h3N08dK+xCFfggQGAJMR73ypHdSu MlJa7LaUER3IJIM8AN0n74pKeSIwgNwgyf0KCjgEmquXk0NoaDVWFj0gT/F0Vx5eAwASSoC2 45QEF1KoULB6w0F4QGaoi3rMDiXNi/BAoe0qUA0aG5uiR4MYRxKbFeq96wuPAAEYlrXI09+f FmgJ7r3DNiYEgmJCSZzOhCJAJ22ib5BlUeATRP/LVxMS0tzCkGZaBwZtG4TfSP8Y8HJWuzdg NkqaGz2ch37zzdkD1AAPpCmYbEbDTFIawDPwXhWbbxKvo66nw8qYF4wmgJY8VjPbCrVWlz+q kAuB9yX6FlYYNypnzTSchhKUt/DffAvmdtQkYB5IoeQZZSxT6p8vV/CSraiWg6DewB12c7Ed RggWhyNfyGDUg2BXPKy+tNOfKAyaJUwIKI5JyjFl3B8EO3StEutCOMLqook5Uz2lpCbTt4Sh 1jUIXwTTL8VMVjabEh0Wa6p2CnhJkzpn/WBKyC6Mw06AGY4UHBJ5UeYwwwqZ9lmPHLLmUtUV oNFHYGJRwT2isA0uZxRMivNoLZySVnz1vB7JEwJDGU4yRSAAI+Y3HQL+O9Qh6gywNZjrH6Gk rAgsOyhpak2pDux1/6UV9QKMP/UIThAGb7YgNLIV4DqdnCaBh/Zp6UVQOGYU9nAoIbeiRe1+ KtMFRfMiAM6mybaQKKRnEGZCK0c2ZFjRwxsrVz8DKgqidVApdwO16Si5cOwAshjXhiZYRRVo rvyLXkq3DnsITgCcdVYJojxRVw+e6TDtogWOFfMAMQKdBAfHCp1iXpJ6PGLjVoIbxKlYqsee W0Z9QooL8yYhUEBEe1mffEojZJQvskwAuUQoClfKAP481hj2mh+IEoh1trsipBogYWuQH3lu sDM0cjCwoON1+JJlCgZxj0RUlQfP8O0mBamXWzPPZWmhE/NQgPQ5PiQsH0wFaOPmYt3xAIhz al7K/EBIVlAP6bMbvQ1n3NJbi38LTDSXICZEo4QnCHzAdcycAc1TJtGmW1AwxFfUhuaIm6JG ImQApNuvw3RIYFtBFxuGQgX0oAGl8eRDgYCzjUNl30MJGQlmFCVBHyA6zFkKY2lwLBz919SW KHrZXmKgRuycAsMubRcOprkCO3VsyAcuh3/CiOg9LM34S42Z6lXDNg/pPeAQSg/XRAKuFxK5 aK+kv517Wgkc8IafFb+AAWgQNU0hBBRxNZBBKOWl4uKsFMH/JjzGovivzpByZgr9f0x3dwgF M3EfDxCeWyJcl2A612ZVHloXWwqBPhxefrKiDAK7O1YeMz2dzkzRCu14GHkSEUQfPhUkHvZD ETcK8BXi/wg2HlHnG6ML6oJEEASFT6HEIKSWucUXw3k7l/09dTA8WJuzq0+whET8iX+6EUC/ Dk9MPnxWgjy+IXIYB0FEavNdzR1dH4t/ChMplcVSkToInVc/ihp0A1z2wlR27iuScb0uT0va GeA8WZBzCUDfCFV5Bihz70cbckr8hfpKs0VuB/lH8w2qM+MIxug7+lyc0AaKB1pkPFWNbhsP 7PQCbp1Kgda2mUGIFhIp14MkyFyF9tUNFqqoT4UzFE6gRwm8A55UXfxknRbq6o5XPn4zweiy M774yqgs6jVT2gR1IJzyJJ5sFEMvOQYSRzezIjCmNmcMBCF3EgozXSs4GOc2EHZjBEbvoKiU X0A0RqEnJZRKcgQXMVQ2oga7rx0Pyj3HmsVWPZZ1GBTg1kUE6vUwjLCH1Abx8kBnd2NjyV2W x2daRCoxguSlcAMHnys19JW3gJ+7wUZdgxQ2WVACnA6+m6p9q5K5kzs0IEc1EHE5GFZfa7n8 DfWqzVAjz8L9ZN6SgiBUkd/LtfcIjajaFpGk1IFOFRtwuHC9CkfBtAHAqBWXaioaFOymAAF2 Np/YRBNlBJR89G+H8r2wZI5CSMaNTkEWSF8E7xfUg0/MdiTiqmGAzZuWH3B0EleJza4fIS5M AyUyR5bdgcttD2NQfblHoI4NRfiCOlD4Ir4AxbKqWiIxtkTlIpONeDHkg8a8BiYtMpXcoO7i mlwQQmC2ctwFaMln8l1uBMMxhUMYXgQOB+nHyBwAIZ4uKPz+FB0FcJFYQgtBQChTr6ROAf9e EgcMnvcYpIWAQYeAw6xMYAddPP8n+gSjS0beNkVHdQ3NJtOkikjWfe4vAbTaBwTzikuUHANL BD+mt9YwmWXWGZbaalRNTqKx+hGQNmpEropKkqT+/ltdscteNOCiqiH2t0+DoDpGZzi1wqac OlL1BkoHtTzTHCwUcCtCGXGqDaa0aZs3nVuQmm72bKC3qm0VBx2yvPZOAx+ABVB7MjZg1NsZ B8duxg4IeG1UZUIeoZVP2h/wI6uTFBCNATou2UR7SwWWMBlEuAQv7lGmuGN2cmEN/DMkVg8C Ch0yM5H1ZB/uEkAQtmXd/6MD7s7tZu0/Y0aC8XOiMHUHk1DMhKIqjl40xlegzBVZFZgQPXp2 a5S9fg3IAuxAR2DFf0bjhhAL1BMaDwCHCDMMRPUEYmUVk4JQhVbMRAYuI0egLqLQh9ASu8iB WYIKHovpCfwIUbyicQNVGJomg2DNksJ0K191nsbiIM3CdJ7crGQIB3WpLKIAx3n7MrqOUiLw JXoXy05zVNLDZtMoE3WNxU4Cm1VG4E+bSh5Jha1ssSeKNQ2cQw4iGv0iwUZvMUIFN5Ci1AGX vXQdjWJ9cQ3UBhMFGi5a6kIyprZHggkXswsKNmUeHmwoZC9BoLl1WWheHSpQSsqCEcNlYKbS S9Hbiq22nfn+KGquczTZUkNvdhqDxQJlBNvpQlhsgQE2aghHhSKxA1Ebwy8p+6Zmksz2vgbu z9CKDrFIGl5ODuiEks42Wp70hxhVtshKEbe0EXFDn9KErxgOQmrrhhFyvwcgtIUUqUTxv0eD sJw8hJzVYbuDr1r6gy1jQy3srLqLpg0TNCp2JB38Wxb1JY6FdFlKXRwQGjYwClZVFvtPnjIz kQSWP4v4CS9+UxzDGl5yVeJvYBUoslaDXm7enpEPUVoCt2FEJtayszmeIS/wBOlgUaN0J+Pn YfkqVIfayopBpJrX1MiYbvoQ0klN8MZD8ibptEmGuOTXSmhPC3OYGZBzQtqYC6DGM2Yi4qCS Yo4io2R9BKOCCdZ8bt+6LOdO6JSKOh/cA+ACjphWUHJmPbpZjs6hB6gPDGeQuSGOB3bx5APa sR2Wx5DWgE5m5+kKAixWvLkHVkEQgYgGSUPWe3EL1ZbKhhMCb1SNiOiQiDbiYFTfsfsGKc+8 5jLgGqa9VEIREeAtdlYkECBlWBQRQOfCkPgBteCOZKIFZYsBc+Qi41cP4JikTguwo4gCswMh xh2g9WIWXNajJID4KeUxENc33/E9fghHVh3WkqoNZvaxPLJO17hZVERyqpVV/DbNqOSsXaI7 2ubfy8lc4HS3ao5pAwlqUgL6x4JRysmeWQ6cbiIIPj3LYYCvHJgV6i4UTbD9FiTZ+kWD/o4z dVD2KqQZKtUjmlKqOhrUsvzlCGIhfDwPaLxVBihPSarv3Esj9as42HVgcs4HZAB6VC9mu4qe Y0sRzCKDLPZaQuEYj8BfHDoCPP81zcf/j+qGM44Z0nEvjs0ZOup8HOjbA+HEC5AYutSb/D1S pR8ODGzflm8oEqS+ADxtE0kW+OsMlAGni7dWooAVLvj2hXFDtQM8RFWDg10ClK9rsFU8ToIk iQP8MC2E3QR2FljyiA5UEQepAbnYJSGElQJ0QBqW9owXywEYGEOQECoIxbHaZWgc/SB+2BNb dgN5SN9xs0pT1LSJBIGGjj1P9soKNlWUdVqjBk9ApQHu+IfdmCj1CIeZSgIK9pN6AZTTsV8S cQ0IBqH66hLXBwIFx8JLF4LFSiHyTwD5JriKGOkLqA0rYLBOaR9R5HgvLWZi5S1ldgnzIbZT HJ8RxrDDpbGMnoBF1D+kbvpVv9SRA4+TNu3aBstTwjN/ASVG160GFxmQaCplp0VPHw0u0i0L zYQBhpNtxNRFZhPd+hq/7IDTLYZeWRgIykFTrgP6jdmL9smsxb8kJJdEIkEC9KTNgljS8wP4 VqJv9g6dHsbMlFQ0wr/7YgUSOrOjhc84oafAqqJAvAgGnlRClLCjRDjSoO77Nb1bi0sm9BYA E6JAcsE/WOWEPVg4d17EyC+uxom4LkQZlm1eRAxLk/oDGe6cXDS3Xeh9AV6zgTnABhwGY6J6 aGEVKhMv3AJ+hGQNVlCYAU+FMd69Uw4El+QWC4i2CiYLOqA8Q168+DpW1tfKDlEV80QXaoW3 MbzMY73bXYaUjidhc0eebAmtV5FZE4qWyxgYkne2gG4M61v/wQRAuGxY/zYo6mp/dE73zw2w 9KVwn23wx85g/xZTxItCs06fjGnAl/o+YFygq32DiFJfk/OSgI4rNcCJGkxeQZ0TkZGCX8KT BjoYlmrL8pzW6iLDjpaKOLkRyAW0DdrIkmwlN9pZojIGU9lGR6Mw+oHvQhkiVXRPQhTxuRwy UEhAR3Q3JsxYVB4WJL2gTSmRh4tU4ZJtFugGEcDcS3/7m77uCRmDCZeUKBBhSuhGDrzM7QCw pRwiLotOIEGI1FVrC2t0XNMTd7YtTjhXCmlwMarEpDqyCKh+wtgWMhXSdd0K+y49b7KKrO5L Vbp3X1JN8sCpvTVHvOACVUxnBiDIWHfrzfsHRHgkso4WxkkVORgiT0MehCpC2gzgEwRcdSLo XEK0DcTA/udXVwF/8UkY4gyTCeoaN1VLE4eLRPoqmV8FTseKuptHlFPSqNIIGINV12o0NyF0 qGYzBzR14oZHJQ+SJpxc3pDT8mdOUAZfol5kHDJxMlXDcidlsgpCGgYwXSAkZKbmcQEWGHOM JuQ616JdDZIDR6bjcA7VcNtyPddZYIGuLm1VsiRC2BoLZSwDPyQIu4ogPDgyMAOmTrA6/yZj MAMyAro0Ig3JTpQiczsJjrNaUBKPdfSCaDhHfCI8UT/ZEtrNAIyyVdAU9EzOE1HVI1Fl+A8d MZTDFYpDOS4VylEIoBMDnhkz4xW8JxRBeiICOonOUnSChXpEywnPPiRHKHFelh5QBi3wc31s ScBJfDHQIegXJKBtOtdK6YPCLnBkdcLiCYMlpgg6mQZcDHwiOwdEncMoCupIUA5VLGeyzDg+ GHXSWQLFoy63UUKAWpRHNEyxRVvGR9yqNTyXSFQ/xkrRGzbWJAl0PBRksANuwimC+Wjk1wN2 kPmtV+oVor8TdANp7gYfQuScptDQFJxTBGvpVlQkUXor3hMNYagLpT4fBauWQTad128KZOpG VswsEHAromrIUusuUTI0nFoDW0Npa7V8KqrOJho3xoMGgKy2Pe/pYQHPcxjySowQxOnjcMyL GrkKzC6fF2AF0OjSiKR2bqgT0ME0XVUWR80tTNtAHRd1A0lXQBzIF1gNutcAdEJR0SqRM28d /GM+uydcVGmhQyfNV0K4AgqkOx2JMwVjAlaaUcn6NWYCxQBA9f5rCqhyx6cZw1NfjxzSRIBo apEJ7M6Rkp4iFwf6OQ99VRjLGKoqGupAjR0GMh//IMRt5yDFwM9wSAQW3EmiDgn53xi9Ks5Q lk5Lo+VExh4X+l0KZ3no1Kx385MCVQwyB4b4j/f7IMXadAUG3iYRqBoY1ctU5kF1LesTOf56 z83F5R4NFknrNQG9NpcHMxSezc8Ih7siUkdQezBmJ8kstqrGBgIKV1JjdH2AJNQfXyZsMyLo 4PTZPvnhI6QW8NxDfEIchzFTkxXCPfkRF7hIoDIzGS95cg9RqI03uUF+dRiJBTwz9tbFMedq pghoUhosWhLkQ1QAg0fSq0v/Wc9UnXmawEvUiENaSnjHUdZq8d+ARvhHvstV0IjGg1AqM8Q+ XB4ygSRgGEwEF7M99kbBhgIegMUmJU/sx1yTvrOPIAZ6PZMOmCpE+cSlKFBfVBRf8+lo5pa4 AxLPwsGPFkLQH+YPPhEK4VgXBJI18LJFkLP2sqq2tW6f9JEIUVhbMgiUEleBFmeDZcWJZAS3 sJJr/ZSD5njvASKajsQA0gtwoFRPQBMkQVzE6tf9nlc2rTFxRUcntBuQMVITn04pQUWkEzLk t2Qja0UmlSAolgaSWg8qGhWnCTMqdhE8zLikqYrbxHaYTb3WNAJTzscWAW1yAXrpuRtY3jg+ IFMEHqJTIXsCAUUZmt+Mng8S17iChiAFA6Ne0/uA2iMF/n0oJ+6LVL3LcFw5tlszRTsRmVRH 7WIOYMv+6VQUaidXUhQPPUoH7kIDn0o8fj5gHrdML8LSPC6T6+CRJOJdutKxk4Jrs/X07CB6 BsgD3pwZVemAQcjhTkccnwRGy0hM2ktus0FoRlMnX8tgJgXhdlVqBg5+DngLcA0aAHUlNyEX 8UQKdFap3dVwnRQUXyAK0eQSYdk6sJRbOr6l/z0+huVimGxa1ZU25cigqL4IEzStJPiRCgwn MvKEGmQdX1haB0O8OtFDEMdcAA48lgseLINq67aKML8DrGvUBdsVZ1P4ABRZdiAKIr4YLQIO 8uMUcoSOL/4XYeqIAUp9Z5oED65UfLLO9hWyX2sbV7dAHLGtB2mFV5voxSENmRbCKjRQZWdj wGeFfhQUBVhc9sjNvr+MaxcGlxHHBvfs1RKAtebukKwGdCGpgmHocJ0NChIWDkKfoQu3vhFD fhG5zxORWJWtfgZ2fhLSzwre24mqG1FOfh0Iz76nR0w8Bw5MiRWRl1T0naHafhdOUjDODigN HnYaNyilcpsa1oY3DZksoI7pdScTPBYYoNARBOK+YR2OkAsvkmp5Fog7VgCLQf8vRaDIHTpH OBUvAGyGsWAQnhfp7BZ49S8fCSYBlSKPgQUNzpbhG2KGeJQc1n9nPODBzWOgDzHgJ6vCGFkP 99w+vjNXZqdtYaCjG4g7xWBP/i/F2wRAaj+wcdVAsTZh/GyseQbtvRqjCjoTNqw4nTZhjMES 7CNbpXTVTs4HliaHl60pLPAiKAdkFKNYGrYkTpUZHRZslemGHDJFeihRC82SQ8vdJ5tXRQ3A lDovnJQ6sLx34v2Q0vsUAQGiCRcPna1N4yBtWTXggg4Jzdh3KcOLkQNyKxNTQ4KRLmOwEYRC fhxWXYh0m13C+A/JNaRN+CZ++lInBlYQE6daCde4a0wSqaqMSZ2Lxos0BrMQLEiB0HV5d365 PuioHZhDdy1uQPFwDhQ8IERGCkjOjAANaOQOVM/m40Y5v/gK16q46y4qpLaDg9RrZcTYtmDO 7e4RVBWQYYjsLyF5VEABSfKfUjAAuSdNQUOM1wE0hL2DwwyC3sgVcxjrK1gMAotGZzRQU77e H/0QLXe2GRlEXJa+FOO3McVNuty/YEoSKJxA+AtPCtrIvgW2veSANPxPgKtu+4qFmVdWQ0VG C8QIMJZffxO3mRzCvC9jM5wcy9VQ0wFJ+ZFSBimmKUZKBK0bbhxFJCv0UNwO7MIDwJSCHymX gj7Cu0qOJUC/Z6o9gcat9lByodcI1vtKn4KkRr+Cw6QiZxGH4ixSr3DrMBO67mtPAYKxQkQi 1GKzGI30VMVknMxc64BEeGR/B1UQBItfGQNYIlkYDylRnR3wG1AFMF3zi30ZHKIuhmJI9BJE yP/o+QWJMwexRmAW6UgQQBBKPS8nT5J4YebqDdfqC5CrRQA7T0yWyJhI0LRxA/G+hE+MqQw+ MlwcQghmNO5uO0P0VbwpZSvW2RkK/lQQk7gpC6Q/0yXwvKScHIwHrnEs2VXAn4ufEBv6xTzf Ir7wGA70DOYuqggc6gHku4JgAwEE3M/nPpngENKazMzKbAriPpLE2qp+zyc6rQHwJWri5Om+ +KkD54rIIvUJiKRuLo8B8k2sPgCAnA2tENTVUCEcFMSWEr09u6+/rVXSR23rRwdE61keFyIR qmtA0LleigEHPjA4livjCuiGzBshA2X/WO0/EZ+GFKgHjLWHGUVpAxF46x7frQo7ArwFF2tU BOq1qwE22UBdpGUNsCIhwWxxRVocOrKdZfXrJbhBexNTKAf+992w84kWFvIXF1fyF+kU7TcA tq0GX10Ts16CrCMTj7tbTOkZojAWsgbPvB3raRhPTbIIV+Cis7QZnwvPtzsVSp65mzy8Cwtv vBhQFsZq3jgTHYsPmfjvy30VV5YC2EpqZ6zlmlbX9UYIrGVPqkI8cVgEE55nHYv9+2TNcC8D CvJnH7ZvuOa7oQjAZU+Jc7rzqh6LJwLQ/R0BTlqZT6gfzD70efGwOBqmW8S4fQJqCUqapW5h iRYfmiBi2zXLwt9e3Ni0YwxNtPcvMdoF2AnKvpCFLZ8MV9ZOmlmUK9Qxxk4M4LPCCJu9S5AY y8MHFQPFQB/LRw8HuhILXgBWXLiSKkEDCEYfzcN8z7YTBhIWuzKSvmIfF1MzYkCIx6KVAlaJ DXw8ar9ECyFAaA+ehx9d3XLRSkCQkC5rjPgmZceoYFiTEqG+6UabRo6M3YoAFSHMgFWwYAWW t/R9tE5kJV8HSoVzx4Bo4RJjzJoSYUDbbkfc9Kb2YRU+C8xnCJCQNNSa3WVMXjUtFV9Ue0Ti Tli0AOxwcmwAUowMRJGGRnSvo4LIVNZddj9/iuauZ+8Btgre4MQMlLrNFOSYRQF6ND/ILl8V mcMrw8y5Z20QRLYTm0MDAyIs2U4KSW5EwBM8FTrMpCNcTG4bmZr/aiSyA1U6m8CDB9PU2CmH i+gDxvoKDu+3thcNXyndhbo+11ZIOAEE6Kcu1Sz0Pp7QvnFjz+AAsiKGFoVImzJLtd1/APaF Ll8rACDx8RzYy8UbcrhXyYL9JTtTFcGFr7IKNwRFbD76BrYaJs334tZEs2uVR3QWA0AKmgHV l6dAowsQKwAI0INGnByZgjdiYgdDrHAz+TZ6IqORLsBLFiFCpbCZAwMkAsTIDrXC2DeQk+OI NhHSBR6EusDal/dIeb0ZEUdSZBaCYhRT6icFKetZBJlFVozKC8t90N7fZS/O+KNEO3Ug8HJv 2IbWlhAcA3NhDFLjSt0VJxciAd4+ACbvgY0IbL0DsIvDh0zGQxVfkg5lQdRnFtorAUnekgBZ FsggVhb0xnUCqwGUJkd5imVO4AQX4HcegqYfMVHhgPR3T5LU+tw73dsIjAQ62g1w/OJrZcx3 I5wlKkJDl6IkctYDpn0UWCNqXKbczLIiYYbWLD3QKMTJkZuSIBlaDsZCzt1gAcN9GqoXsiIp IBxmFFsDMrwtvkF5ouY7YVaXi4ae+EOG4vhocZJnFT2f4mgX9j0AtUFKARMrzEr3y74IN6hm NeiB5lvkIP5RlAKLEJNGd0VgJW6YQOt7SRwKJApCLdcBQEkd/R3iJn7PppKAlIMNHlAMHPm9 edIdBNJBFRyCRrEwA607iUyGLbj9RvP8m9VnISY7+PQeHYOMQ0YzDUFMMiQ9+oCYcrBqG2hH FuyhOKhWCqkcdhfl61FCBhMYtElqJlo19l1D9zQSNsWsFqrGwwepxR36hQUaVhWFe7QPVvPx GBdyitb2SjYCxRCG7naVBBKKONKQbHqrbLuNMv4ACK6SGEIQdEGCqgc7dlo/x/kUsrX9pzsD BxU5x3oQFE4yomJwTwMrVwEncGvuzbiU/q86TgceD12CB2GCoBSoGKRURwKKsCBJC4ZFRh3v BkiBFDK+NCWmx2JckoDEH1bBN1cxxcISkG5mEeTKIIrLmgk3ykKJ9iFt/hccRC1BhaYASlNK 0iYbNfJFtR89PHg6MAm98qoSe7CbFbVZFcULLBsw1MVcEAamU0QN/RwiLQ4KPBftEjAX+qyX P1YTP0AiGQ15qiNAOqr2cBv/VCzuejsdsAoW+HxMCwEyvkAkdFow3mgWviWDZxQU+dOQHKJs JAkSxAFMHlkcGQNEkvVXX+SQYhQb5PJkBGkm8BgVAlZJHt3iBnwmXaXbRurpjJcHxRhR0UtX cIC4koGIBg3ybG4XDkRJc4tfEWXq+GepoF/acNMAH6OkDjyOUVqKPw7PBnWnLnNPBaruiBaC LJbFgyiUDWlg68HQQMQplQFcF1fLAi5LC1ucpnjSAbUguA350BxallN0JylZpcDYXvXaX4U+ gPWiDprqm+FHQQp6O0gBCTqqgISVZrMBPM4IVQoQlO4lVoovJM9zZIs9aDbg76cYbtFXZaNI pPcwr0N2qvdgQuqNZkcGq66ADSCJEUwEOOkieh/8pYFoC9QC7dJhfYBqKisDToKoRpxMLIDI 2ZhWZBjhtBI56qBiyUsPNXbiEhrvHusyKMrOnyObq81jZGHTbSkJ7Dt9d3BKgT/I3M9fqg0u h3AsEivXZ+7sHvpWNJ9FIio1RgIsd7md91fBz4qRkhNf52bsg9qYWkMkSCRk/mZNqX8uYlT7 R3X3xCkqGBAeJAVoOxaVUW9Ni1EwIerrrGJX4icQFxT/YIJnCwkvBKJ7+XbsimLSRFGG4/JM iEr+EEExEsJzYuf5ELGKHrCk5tYV5vJHIgJLRvsAE20pi1ZXYISWxYZQF3ahNW5s4HmqIP/q rrSACLAh8BUBYgZcfA1e5ANbI/cO5nhLwt4NMEL0A8YtZeoxbl1hQVooDV4OHxWkWtYgF1oG qwhNEmUMajAIQC8TE7xAXviuKqQ3qlJaO1ZmM8YXNhIFywlSil4SmwtimQMEEHuawxtH54fo ADMMrgCtE3pbXRkUNR1HkL7WQzFKY0iopmYivulcEVFnNdReOPDq+dmTGBS1XgI06XjoQhos KtJsmEsIlyHAplrLDNDFB615Bq4JF4SX6UCzh+sdB1cttYpIj/uU8AeITB7DDwXNcHA5zPEF 9zUUYUT9QNiDMpe2iDM2fUEiAk7KBTzAJnxIBOkAJFgCaQHS8a0cOaqubM3HFhBZTjFz+hlO Wj/ArR/xejZ1yOtL26c3T+xwBx5oUEABFDmhZrc38k9QYYgBEMAQrXYatU7uQ3cPRf8MEYVv 2Y0Pn12q7hm4PhAFbbhan8j5WLdgseVqAYDkH7RGFPwlNk68JTpbsGDBWAw5eMUFPidvJfxH UzJ3n10sqe6BTyLNXlQ2EyicKEjABkRGarTVxEohCizGf0pUVETlhzBGwlZPefo6BSDC/lgj 9mIRBDURZq+/OY3wgu6x70FmPwTeWolkOisDMztSuH6+dCYDBkGkGxDwECwlBsiUCMiKRDpo GZFrkI8G8WWILqphEYQu+1vQqa0HBCOpaMJC7msZCkOdPohJLVAd5wkIgTxsoR021SOESfxG Es6Q3nR+oVmXd5bMtkh1ekYa8PIBYTHHBGHFANNWMh+cXwj0Hm1YUwg2DMRy5CrslROjl6A4 qV0WM3+lRKqzcU1kEJ5LVitWWbq533oJEFAUZjtcw2SyKQEhW55Q2iFGsssW70BWdD8UZ2Vp fxdtXww2iEJmNS1n+voEGQAupLQFzctOJQsR2FiyTVc7ZsOYTq5gJSkPBLA8DbQ2QIIJWfbo BISmznmdgJ9I1wYvYwhpK+wAEDYQAB5eDDwb5IpTggIBEyhfOxKE0aBWHkNTbi7hAG6KphQi Zl4E0EJ5RdqHU8QEroXyUwaJ3j6KHgM90l8Rk1h4r/7/zhgTs0WsZ0beILCtunbUel5k5PLQ KcNZ4FhWD8rdIBN1DgEcAr8dzVEEJDbmvkQuwgCsb7IoVEee+DCUVytnEYyt8JzFfiQpI0RC MjCs2d8jViBIQ2SFOAoYepMGxARsOW/kSxaQEIFHS5dDQm6AbCkE60IqA1xucv5rCFdR/5wj bFhAVdC14sbfL0HjIlXWEOfsgFr0rtZr0WERIyx0HfwAFw5PoE0ZTJhYME4IFw7zpCOz0614 A9f46DBzNnVBYwpBZgP40LMiREOGy3A2dW8Xyle5Fn7siFQyrHIsPyYfX9eKLGEEOV8wQAMd jgZ2LLYdwF7RqwHI6A9rvk3FdoaIvMStSpUgZJ0xwadvfdv00z0TWEOe1t4lGBgHsD5aTOng 8AoufpVQMrRTBU8F5+QSQ9LQAZYmBYu+LebO/i1LuplC5aCm60It7ByuVy0TqYWy7qYG3WSW D6sI+4BcVjl9/Ck74LU8zIhy518fCUPm2r53T7Eseeyo7ABMDngCA0S22pNXAI8wz2riI1EZ AI3Qj1OVobkSplsZFcLUXhAFLYc7FYP8USLyzbVRFAyK9KCyeklE1AcYBCvFrxFQbcyau8oH MFfm9xYvFoemFaO5TrDXThJLHyKyyIZtcT9DX/ecNUM0to/EOptM9EN6bh+FaiJ1GTFIagu/ BMYBjUL4JjMDRBBEbCfN0HEJNpyFTvj/BHwHr/cWgXkBp/cuAN3NQHMzGn2w1KxGWFqsVYWR L4AuNniV31H3Rh9oDKZG8qxYBHWEpWgPE9zMHanKqmDY+ooFEOI6t0Vkh4nAfPvMvqIDbCCd CVpGF7q7CWNCgUZQHKY/iJ6zbfoxZiYcBx5zGHjNwBw6Xir2XCJWjxyX6tY8BbgJYq1GOs5T GiYaStA4ggqENb0rAviCCh9VfurwDwkNIDZA3htgLt1bLG/mINoHUhT0R4KyDBo1SzPJkK8Y DkoYFhYlB/+UfXUeCstfAOVQipl364lz/gHXU6iwvnQ1IusDyFUYChrEkIl2SsHkhtwQAUuq T1S60Kq7F81EDIgcGUyvM+ZPNY6LVQ5IGx5+nVlntQQCXhpVCLRS8VGmLp0SfyNSDAwaO7bM cEoYObkOUBxGamHYD8Zb41eLEjdYDbhtOKgKDkDxmtZ9bFsvtEV+Xf5D+D9gVHxu4rexAyCy xxQQTZLk2mafeXN3zlYAMzkUQ4rWvVZthCcB7TGk4sjhFFOBWlU+voCp9ib2PowGICYNyfjr FrOSGsKCA2YafcbUbtFtDdxuOBnSj07iQhYD7BnKtIeyCSAe8IqD/g1ZbHIMPRBpE/0U4xI+ 2BcW1HlcfSlkO2UPBpN4gX9Orn1Zo+45T/eCthhoNDvFK1hwx+Y2xcIbDqqBOSRIff8OPJMX yg4T5DJCVZq11PAPeQoMNWIFX7ySKkCevi4VngPHKl3+DIMRM9QBfzKCE9BRw1ejBccAHhD3 Q3yCQrFh+tmBhDtFBozdTuq/yLau6BRhVaRKUlXuvLBQaTBKWZsuSJwvL0Mcnm+b0/QWCsAb 2tU9GYXEOSIDbAIgbrYrZNM4CwqbRbEzDDoUk1cAnRAIfoQs8kmBNl9DrNekR8Q0gNmiIfXN FxtFOBrMGBYN1tRkZOERh032EEZiEKmmqnTbz8zCsVBJ+qpFNWQz+Ee+MQVR0optNUdkISUy KD5FTxBGCc0NpoUzBl2ATVcAoEEIrK4FSgAzOFtkOLQ8kTfmLVyWFKRLIzIeRge8pXDwhLXG c8YTvvAaTDMBgbL9swGPFmh7YmfbTD+whvhl74O550N+oKqPijsOXBBCjxUQ3S9enRHrgFM0 CnFkOw3wF7lF1Tu+IUUm0GlH1DXgrYkIN/69K2weZP9UMoxhDGvPKrIq/WdEkOtUFzgI1JHr LBwNdn08wcNbeFMztWHua34ELh0bJz7LFvz1CEFXUDHuOEJp4p/xr4KEcEHkIFNzWmOAEgQT lFp3hKIOYFQNX4omNjrVFKidIEt6KccXx7le8LatFNsBjYP9ALKYKer5SQJaVAgiG3KEQs0i 6wHC/UEYdHaKdhLCO8gQD24TaogOVwInBzKZkUK0q0lJA5BoQAQgkBN8FKrLXRBJYC5eTlUz X9vuyvfU+kBXlUKfAQbRIX4f6GQVrg0YYERSACBF38vCc7IO8sXBEYGGAzXWO7JYI04G/2MT bfQANNEA+QaFJjKqXU7BUB1exvAFLklbNFgkv7bZE3kDKABj1BxXQ2ReBGoBnEuzE0bCTAMF bo0ODOaP/CyQEGkmKqwVY6gkWVDdZnXykmXyhvB+WKIK5ExCQtYILGUAb+wZ5YR6YQYdcmZ9 GGFZzIMEu1zoWebGCyznszWveNCtqYBFwD0FTOgg6jEzBZuvbiQphA9ksGrL+D626OQzTtcH k43P7aXMrVn8vv+nDWoxHQxe5SxdLFETNB90+hw6MKSSB+UIQk5yUQI6TzyVVmPND7JsFARu Gsb1KSI0APta6wBJjY8HhoS7EzmxMS5G3hh9k0pUMWlIwj3fHaFiF2TfjLRprqRavNpCRVQd G8u0vR+kOeJgTjgDmm8qWxVEhAnKIy4YDlHPRwJ6BP98BvzsAkHRGoFCSAmJxA1GDg1zH00o g6sQl/9tGMXXvxfmMhnkWsEYngAJABHoGqi36wNhCUd2DxFaUXwQOvMV7jqRlM1Z+4z4hQG0 DRhqFl9yUTgrxpkMYsSFB3WjBMpAWDoMEsaEtGKG664wwT0vSm8HQTVedIlb5NkYylIOEuju m5kKIgwMw32CmULT32pmHwDzQ/9LOxNL1JTDYkoT4WLAR66tzdKEXoC2Y1PeRpKaw7/LFwC6 ZFI0JXt7PuY5IEQAJWGkhMoxAhZnVqgnIMyGXVrm78XK5vxyrQaQszvW9ODy6nA9OyLw4KiT QAGzOycF/+71Z6mXCNJKHj0MDMFgtxeZhdBDrqpEg4nYHfoRhmwIQFlgkCxWGXKWdTAsPoJE t+nNfA0SlB6EmCc83YXrAlHKlfXHSi92FRlYpFjehWgWwHWGBP69QUMzNfFF1MXqXBMznXwi ZXtq5CHbPgRsSFWya9TlrrIa/hhSAJVznNc94BcWERa2lZAzLBgJcnX6DOg5yiFvDg0KDN51 yiaoRDXKGXvAh8f/T2d+Q97KszvqXv4KeUNcLWXmEVss2oyFEp8fNAQ783ASU74XPwMxNRQO BNto4goqczEUB7/1iPQhLWQk2FxCALM1pA8QC4p1/U/uNjqCPlARy1cbDm4WZcamdkNjm0QA OsXHNLgxhUuovIpEErjKDwFf6zgG/1lA94pYQK/BSFNqcf6IcZcsA0dQbeLBhsGdfFi0CUNy p5cDXdR4rRGR04HSLC4xkh3IQxlUf0FGOlJKAyr0LZ/bVyKaTlQ7QwG3okw/BT8iQeQBeL9w q7Ql7gYnSCv6kgUJDhsI5HxsE1eoQljzB53CHnEBxh8ADllomU4GEQFMSn5w1mQreeqXGOSu CG0QRyCYXChkMQ1LcxgACeiU6nhQHAziaars6EIAykoNMyEsFgfORT9NR1OSlglYyHR3qg/4 Qocc3EoLbmQKk4QFEl7wdcDGnCtCBuYcgiIAVZFkUwBB/OUkb+6vfhMsdB+WVgSdotlwVD5B kx/sBAlnOyPYYsR7EyHdsk8KV+UrjuLETrPqXypK9ESs4EIxV0IjTzcvCtvQjAI0eSe4D0HW XGkg3gRSIW1Cjpcq6EUCHFg+MkXSEhPejmFgBAoAUTsMc3BQkh7EKS1KzKYIUiDKQoro1cBI 0QSPzQogIWnXw74m3QJWFsHWM1dCEo1ffIO1mzUQgvmEAjkWy0Yh7JlUTA9ID7vEKpQeZlFk SkLj5ReCrHMxz1P/2wciLGzFSuQRXt4eICtcfBBrC4xHQ5zrs9enfFogUEB5Qgw94gSkTUk3 mxHOYUgKTR5QuAp2FLc0hkZ44iZplHhLEsPDxMomJBVUXm0gDnjpVhFELwHXplobSkdGVEg8 CPwAe2IQAWRP8WcOgPvZpExJU2co5oFXC1EEzVLegJZSxsuQOOxqEmKF0fgxAHzAYAUV0ifn JrbtBWfZnE6ivrxCIU1WV6JqYIGwO6hwAz7IBzMJoMY5RETS0NjiwFQ+TmsmQC99xFgPrBCf 2kkQ0UNHQQSoYD50Kqyn45uMUc3LKMYeRo5RRiXEViUZhSg0Sdp9L6IntBb7jftO/nyFldgy SY39eIN14OCiLlNWm8YiwB7Ur320aSUkV5QtRpoQGP4UmdPozVkf60OEer5cXFxO0FeaViJc AH7goxfo7llidUs0lTbF9lZZWvXDJNBDulRV3k3Kgt9oSdP0U15qvuL1Y3QQ1WgSEpvAlI98 ch2sfa1rBqgCdSOjfRg8jdZAt9R81jJd8PRssd4vEV0jDwGtE75ZVtrwAU23AfY5ARMQ4YWf 9uJgFzC+KF+PtqPs03V1UwIRNNWqLABNLh5oVp9CGUpaZEWkC5DbR05c6zkXp0jcPcXrH6iF qCcauKg2S3ZrYk8CvUbtXgRsYmqgidMZnyJHu9tJRtsD15USfBEEz2erp20nRAQiFD8bOWCb 39c+/zVdQHS6ftlGcDRQRBs5B1JDdhOs6lcMEk3+eINBOAqbAQ+pFn1k/hECDU2P9WYPkAEe schfa+AZdg9IwNrGxzziD4RWe2stevO7AvCHRC0G2Q8DlARGnBO7ETyPoUAOLkrjiT50yh1Q 1nqRlun77nQ1XB8NZbrUN0qDvIZek7IhQ8dQEcISgNGEuytRQh8oVi8yilO6TLPmCEbv32FK wYQ3hjXh20+3afJrrR0dRp+eNSwBMETUDOKKQrha9nybpNUNDVpwAhKqHJLW4B+yysaWwQeK x3xcRAAhaAGYRpF2BllETVZ/AOqqmIRU7DMdYhZNEbzAC6JYCFYRCceGJh0KREPjqgsJ639b 5PXeFTPGQ8l1T7RcOYC6/wEAKenItKI2EacezB19DjwZAMinsyOGFd6x50psG4ARu/Nn+vpV w93ej0f6UFfyxOF2ZMaEpGkFsFcDRiZMsFOfBy3oOdTeAe8IEPIEVE0mOQb4lQ+iR5fED0/5 FFH8/tAd5NOKVw5R07yHMAHQRHKgJBskRx4lhQB3IcyqU1KFi68TCJ3kzlYVl8J+MziiaRYp ftSTI0RFQV8LlIFV8xiVuJooR80SiQ8t4m1G9EYANJzxwxhSO64rQeJstpVeD0YoSf76Y7AF oayDGRy2el6NYV6WHbjbrQvYX0yyCJJr5yRL9rhWgOwEB7bM2KzEHgGPLszAEMPcBx8Ifgow f2qglK8mE4wcqSC7sgQKaURLWD4CCBDlE8Ut1O1pSjwaIlEXoZ6KY1Nx9QdyboxRDhyI8Fqw ELZJLEsISZb7nxfOXjSHkUaUgkiABNkuANF0sByXUwpUYtkUI5wWgyQdHsDgFAGGRpW5WRwW wOQoIlpml9QEV1uwdosRFMJJR9Bc0uu+SgRjh8Zl+s1tQfYQZTIh/1J2fJR5S3bimk0MGMqt OhyadrWjEvMXsClbUGYPRNKJQe0KQtKfKvoW6qhcFDcQ10ZNjt+iH97sgggCdwau4qFOoG0b FwrrXH1atQdCshPg5uJvq/W9C+hRStS3HGJO1E7D7hQcsD4rAQsMnKFTG5DQYNsaQ70QRD8K SIojvxQ8UnrkDZAhVEBaKp41e8BclGLeGYZlDmSkamd5kuaKbMx7tLKecn9M+R2kvrVeSpQR UQNSJzBlBMXdQVddTAhMR4UP7qpv601lAQsWOkYKTDdLK20WR2Ogn3bNqOJuSVJxJHkALkke Ezd0Yqi2KW1vXqAQSCMVFfSmZssCBSkrcD2gDxWxaNB1RzRRRmJDNWNQF48XJUNkZvtiDUln yk0zlkfu9Rs6PjduRVj2zhmUfusXSEkRy+4TxtqoBpiK/DSU+UUIpQFBaTiQSNZZ5njNcAY9 TsewRw1EixARKEclV1hIOsBBbqquEFVQg60ipIQhDyrkpBDZFEjpfaIeMksKQpR9FrsXG6r0 8szTmXOwkvvWTcL/JM1YQ4MGsHB3FueKS1bnuCi0bHG7bPaUkk1HvjpF8gBKDkaqSXyHEAZW RHJPgMbsCFRfLglWQWAbwXAfmAIFurywq9zwSmg6r0oQSa9uG3IiPi0OpbXnAcwZBFBPaGa3 CPemL0deLTgyfZDza9xuIDpqYB8h5g4GAaSLAnr3vmijPR29ijt8XbaKMBW4h35PUZIt7xez iRYXR5SFz/2oKO56ADkKGzDEOlld4/QTxK1POOiuBr5Xd9CwCLyiAuYsY0cRHKIRKL6zE9tM Ewf1ysOnZmcNRYdb8GJ/F1L5jxh3Yl09ojCRKE4I8K2ReoRoT/a5AgEWxpey7IKrLwQBZxhu quzS/ZNOMQlkl3agg/P4QfvoDnTINP+4/ybKZoP046TINIFK4/Dnq4IYMKDnbVAm2DRflQf9 alHq/wVmgxgwqu36gUoy3O2W0cYOdMg00ZLVJspmg8LVnsg0gUrZztlmgxgwmt3KgUoy3N2G wdYOdMg0wYLFJspmg9LFjsg0gUrJ3slmgxgwis3agUoy3M32saYOdMg0sfK1Jspmg6K1/sg0 gUq5rrlmgxgw+r2qgUoy3L3mobYOdMg0oeKlJspmg7Kl7sg0gUqpvqnigxgw6q26/VmsPCJB U62vBEZABRXAbw0Ol8kcR8Mj/xF8YQj0QxI/xstABgWy/1ncfCslXzxfJ84nZMtxeBtOPAiU CLykB0WhIERrxijNg+MPnuhALCgCe2SbRke3R0YzhXFxR6h8nXMCDWJPZAMm5F44E0+zclNW bhwL/cAWipghtAVNKHaObHoXX2bmE1aXpL51I6q07I0n3KlkRlSzIGzPWzGkHBoblAyebfoy 0xj0GlFzJxzFmLKWMEAjQRpPohzKSw8m6PWuL0JFCFTyZTwTEmWo8oAW1hd1bbkxoiGIP2pB DMqg5iXrAS4IpPkBdjOSSA5ASyLqWWNsiX+iQjltnOkidPVtI6AE8aqlWVEeEQ8xKCPKZhRF AU3JEPP1sToBbcQZYCLshgFUzXZmUg2bqhwkOk5FQIWyXhQczVJEEga/x0wEFuVCMkeNq0US BqmQXUwVYIUItguNfnJTMAdXMSIIn48iJLYLR2MPifpXnApMIRU/QUQOqe62eWNiFBAUF64e mEcg/hcIQ3XqahSjY4fHE0URGDQdYgXjAREY5aBsVtkOY5uPi71bYHZ1P16cEMwZRwBD2RsM vk1eHdDE7hc5FgkmWTUt1FtDWm5YPCp/5BdrKmVmgjSsHmDGq0Pe/AmbViQIQ9pwAg1Inq+X n0aKtq0fRzQt9DBDW3YOUUIBpFGyiUYlljINMpIdjJhaEFiVcU1ZlW5F9APHH6BP1SeVaR2K W3PGP5EphiFaVLEcQKascAJDiDVXN5LnZIyavy6PwlZFarfWX+ymbGA8+mEwhkNMpjc7tEVi WRJbT1ZW8EQoNvIeEzJPFYFDBSDz6nMBMtJ0T7L2CiYGFIMF5oWwvEtRXAQMFsWfXmZzBURC cbtSdHYsBxKBd3ZEehbmMiRhtk1KrjVn001VitFaglrMGHUGq4MyUe+fqWBDJ6kqdyYJGywX OEJTdiYTAXfPiwRFr6kNbqq+SNIEUJhnlhdtEmaOsKoOS+wVWo168HEnXWe7RXtEfiZYD67F YzeJm3zReT70k9YcGAXSSQ/ULr+vNsxyL4hxqnvdbx95v1wWXtQBUWA7rqbLStD9fkUDjZOM gu5/xg80Oy8FxSwgAcprOpWghxw6zqCdKq43bXT8rtwBqjMELcREern1nTOGMg+R/cOsK4Qe Ab6fL+wLip7z1TzyLe3SawhA/nR63bzWxxMMoxDcLKK2/10KX+971xxtXZYwSgbMcMdeKAMX jpqNBBZht/pbXvuaXkW0743Cj31shbqoNYr7F4kalFJasazs+ct0F6696mKsrScwAQZrM42i A+DK+NMk2B3LExKDKb1sCsjIESZQ3AVfEMcBJmA6y8MQ15I+A65iQ0AwYfKViR8MxBwFQmNU meB7hi5FAAQiS9l7Ylbw22Nma51m1hd1Mi4ilIyiA4cGTTuAdo33c4reEMeOi5AWNSk0/ynv AO6RKhMnnzuRYG2+YhgWMTznWnGUw5JF/HsB0qyTg1O6EyoBbVML1kPNYC5vbBoC6yjb0DDL AdBorSTkzpIcK8xgwFihnO7S/3QKS2RWJCIMBBZgZFYkXhw0QmBkViZuXVBfnigQI6p9Zspn 7PgBJSKtNgvTFy5wBwBgz6Z9mOCXsbGHz0H3LJrJ6b+yGt+OYK3CADtVwgJ1GwHBY/wBPwDw RR4jF2ZSGK02m+7ZRYggF4q2z3zRcs2xzpe01M6eMBzQDeTGZkizKSLNqEmFInAz19sA7QEi gILKRfCksZWBCwQJY8BNn+w/GbpjcQw+G3fnlJ1XnsIH8J9e1yCVjaAknE68CCqqAz0p7EvA qQIvpnHpWrmPyPNxZnEB5kcjbDjAxbtNTibClAmxO2wFQVgkYkpkx2cXJbfA2gqcplKZ/B4X E6TZAiQcVIlTkKbGiM9rm0sKSp1mOGQaD8hBJDM0bIwkzwFnQQDBRQ8wQI/HoJkjmOUARjwb l7r/7/3PiHzAW/jr9bn263abu+z3ufTr8ZXy6/O5PXwBNtcgT5V0mJLenH24iXVZqhYDcGM/ lBd6fSz1ZUmoHi5554o6QqwTEEH9FqqvsF0A0/9X/IcQBKL61Hq+DwUBV0W3kBJWuVNjIRMN hD5j+SEhhLQgjqgAQSlkUKosfxAkihFRbROvZoabtg9SRVhQ2SPg0SCiRdhenhZMQyUDxJKd i7756bQYhMx4I6nPAZ1TTg62KJJRcrQ3VnSizAIT4USQnWAgMQDzV/SdSU7MGLAtA49CXYYJ ARMWYYmPU+HKT9rFEkS2EgC9TzwgVrbna2Ipt4hliUnjEAEpkv5Y8ONnKf5UBiunBu5kVY1h NsYSl2yE+jPUvJhKzUCofl0Asm8lARd1sINDp4D0BhcYTxYyAk9TPtrQiaxzDU/SM2eR812r flA4BRp9LBP0Tjgw3+DUSEoFRIuSvqZeSkL7vSfMsctralZhBUpoYpEaBhBVtvD4oggAGmEs uY6gpou6zsdiU8cRILw58hZStuX4XQ35HhFDBY4Vs/YLy0bA1iyeRsEN3YHI5FSn2u3yrgf9 0MQ3tue9ZDJKDXXTH8I7N4pKYx4Hqj2WXcx1hyTz7YQWUw9+wrr5ghfzZufJskwK8FcL6Gn8 nhg0Zq/kG9vrZa+iDBx/hZWXCMCJVhVmcFm+w2L6+rhYRMZ9DLoXP44lvhZXyN5G73UWEzsJ 1PYWZwI4644b0xwEfDVQVHbFz3+mBPKmiLxr1RJFCRa9Kv/WUB949R7OSUd7v4to8LsMnnTF EFIfLMiXwfIrHGyRdee1G/xKG1VST/KMbKAczYBVXS0tfh5MhuWKFc5CR4EJ7eYya74tQNT8 oK7ktiJeJ6a4yiHLrg8+J9ZwYAO0BwwORgKs8IJ2zQJu/SLNgGf4629HRkDZWRCDAuZBMWRW CnY+908SLp0GgXZKBRwK6pVEskoSorgiVdERQcuFSYMxBm6Cunka64S8hd5nOHXXDt0gnSGd in+rvMsr8J0ngw9UAyb8YQ/sYqYIPSM35n9gLWdkbeOax1UAK20HALfOxWUE76n8jx+3F6gy G0uHRLeoSbsKPmqNxv8KAQj1Y1sgysKNwzlHgjuKQ1hGcDlFdQSA7EVoEYEVnOiARhQIeuYB AixJBEGJN3JGBiykh+6AY6tIah7qfUXBw+ceJmPJROcG8U1DGx1iCJYy8nVXTAN6/lDyJqrZ uIWezwZ9bUVIUNcE2o/GQoo2flawlIwSdQ0KoLFnro0bnZpMi5QG9khLshYLAliuNc0DpCU+ aWglcBKYuBvMU7LjMnIxGLydj3z0U7DMsyo6yF1RUNQQWm1RA90yjeZWgN3aASUETMtyFhFE XFf+eCs+WgIDZKRu+tFDfTVbdhCRlBirwGT63hKMB8ZYwYU2sxEwTkzSL5u9z9w37BDzlj+Z SrpYL2zCCoB+TxQ6ATatDBdSpOYlYoLsSpiE5wBHRYoBN2ak4HE3SwE3dBdzPpRR9MZ94iXF HR3vKQggRRPAOBoTFtgFqrJCA2xoiXMISQHCIxeMFAWaeElZbYL2Myhk9vOKWLxHeg1Hwozn EQIsGIoVAMeHD8t8cUoRbqPXIO5BYTyk/eYERAP08RJDfig6XW2iDW9wM9MimGEbdq4IuBXx AlcC5W1bfkmRojpC1xHMpI60W5ZylJ4pzeuv5/+RQTfwaRttxp/Kh+EWj9Tfs91SsBFG9sVZ QjyxFq7EFkp6cwSPB0c/x8MPRES7AwBgoYBaFI/siJcW6VmIJsQir9dm6Wc21p8T883aF3CK RSOrfawdzB5bXIN6SUBtRXLH6NSlNTUFQ9cLaDY3oaCrGkPbCwdBCQSkRh1UqHXF+lTDjIX5 ZkME/xNUCLyIihPAu1Z0rcDHOCh6LE+CAfwU5OlHQX1/TkssBxpiLwAz8mIZwi62NYeL7XxU toYDOLmgVd4SmVbBBrVgyjA2j1cPBGXgCu/z1oqeZ0dXGpuEWA9HTNf8zHPb8VtCFKwQBF0V 06kZPHE2dTiy3IOQJzVOR7AHfAzY4rJWOpYBFW4EOqRNZigcWbd8HS7NAG5yfqhQ82C3cGli g3Sq/TzQTQfAsikyECuPAgT5jQWuX+bPETRBsJazpHrIL8AndmpwinlqG/gmvNjUAJYhYAgR CYLB9CLUnQnmucIDIwuL6im7fxpNzdVZRRJEzAgnbxwVbnKAFh0ItC3CAozEACBVjtQIj0dq RkL9d0E4OwTKYhT+rJaK+98QibHAtPQwHQAbQKu83kFL5Ap/qzTlogAFVTCLznbqinaE0Wc0 A8d9AbeqE8FCMw8b4kaaYSlYJ/2JpgrigoodN4TnFdSSRbMpoMaBfW1SdmSe6PyeFd1FVQGn dxsSVMjfgDFiYxQxAxWoCSU4A07uH9wXYFFsM20aHUUgbWdT92OSgwmYV2HQHPYXaU0Hitu4 CPBO4USHu3YTtjHyBkQjRDfM5vt1HkXUjyo1NEqZ1koVvh/V+kOu1eVUDQGjbP4H6oflFjmp dFuRZp4i0SPg0wvyRJhRQg5mw0EEpAI0JgbW2ADQFCt3kIUwlrdSAvdN10+txYE8S9hJJI96 Nk5FKDk+cxtCve06ZU7JYKHtENcN9QM0wN2+AQJJjA9VFlJFQE9sOAIY30zpnAPMp0q5wqdM fHeQRtG0P5dbiXq3aKvXHK+KD5a7M4K8H2MErOlZUvKjw3BR0xGDL2u1yUU+1pCx/88UeRIc 6UhAKCIz1VL9SiRhuyQJQR9M9+uSSwmdXd+boIJIFbkG52NkggIhbRpNVhRPSOwBB8F83P5F ecYfVsEBVPHrG/rue6osrvx0PjVyYpyq8C0Bwwh2wsZcEIXOYoS8R2BUtdSbwAGzkHXbTwpe YlETFBOqD3prKgCG2j8IWWIJ+v54y3CbAnDYUtVLLJ+gi9EnRycidAz3ImReAOvoW86I4lWs U7D9cTyHAgIS2sRFiRwUjnqAjUYLfgF280Af50Rg2josIytCQluhdrrWouzwQgnGkbRwUcj0 Q1XuBXFD66EomgwWLGQJDdvMUxAKZwRWV31/3UloGfjuOg0F802CZD4RCIbShvIAV4EOVT/G Bal5cgg8AALDQPUTOUfB/kAwAR/4BBGtGtXuP0nBkKpLaBYvCP4ARhsSF8Fe6VljZElUpT00 YQNnEAE4aFpeQAGAfCspYtrXRW8SacO+8gIEnqxdNwO+26AMoxY6/GPL5tLgaq/cDCH1xLxG HLMKQUkwEjOKYY1F3lNW6Hn5T00yVodNZlN/1KW8YMvDFblq3TtaPX/8+hNINNo7DSj0QgaC UhE6mOxOXccFc3eA5iLsB9MVBEQuKE8UDrQDceIEKyhtTd90MBZoiAZA0TzpYQgmcCIrEhJ+ UdsKhn0Exg6lsIh5J200zShA8zgBABvdNFdBgSk8Ws59Eskg8qaiSBA4fE5BJAsEAp2BGwIf BuJ1BqCDJKEXv8lrgsgmWVPtCJ4S80KfEvOiEUvI0XSOSi1omo9eVtc7qFOzRxXYx89hUo++ Nv0HEBRbiuazkheGIEvy7Bg3dra/Y8xgDw1WZfmwgdQczDZlJF/HSpgglhkAYkvYRWu1x4Ag AmTJhW85mklW36TIL3vTckVEeAIbslAZswsCNLsCWjQOFADM1N4yHgR9f7VctkbUYMK8a7y9 hQnwpcN3XEJFpD+Zl/iCZ8akQtP8KAPK5JSExjIwoNQRfOVPrxa4QmRbgqRQvc3DIIo61hdk HWu+HxnPjNKWYRPCvXsEPC7HBFqCtQH/EoUCNGRXK1SxAVX73XvYR1ApA5M+Ton4V2M/Efbq THsBxuxuMsRyEwq5SBAy5CbNWEIwH0JQTiAGvOyHgiTylZ/UAFeaU9fmMbTwAgZ9i+f0dvAV 237I6PIWB/gxZIgWzusHELjACO3RFgGeg+JRXgh0oTAKTkE/ZQYONYXHrE5OAYIdsupqljYS cdwmgM815g8+zoP2A5Y5aWUEEjmb5gJ/SSOBWoLuavBkdSyyCZAmSbPkSpBVqSKLBjQUDhXm T+wm1q9KIPCCcsnsJhmDFWZTwZWBZZzkwANI+QXNC6onAn8tf/aCAPZrmQjaA1QYgOIwBsrR BReBwoPGI19k/OrCY6OiRBcHFkJmfYAut+Tdb/RMxEUEifY7VQQhxujFYeW9rQGe/zVymYcd IsRF64HCXGYUB0D4H1io3O6WDn90vWOhH4kaF92AAxlBRQpXWnCUFzSO4JBoJIcGVE6EBEQl WBUJn+T1us5lKMhlJxlEQpOeCIYUBAlyByTiSooarhCC/HBsCoKnOQQOsgWT02ZSh44bfcZD Oa5V+zpQAkWut9c5BNeC9FxNyTTq1ggwxRlkBQM1A5GiZ09mIxoDkaUOyTQKmWEUPwYOkkjA LdPIxkRsQk4kPwoxSNPyywTaV03SMBcLf1kudAQTkEWGIIQXWN0QXs6/ESxyTa7qru2ywGy/ QiKyyBaFDBfmvrEfi8YYxkYR4eI61hzMrKWHFB1lDLzZVenNCQ5QRmxMkTT0+G3ZCS0A1isl GdPGweCavtbYCPrtMGuF/d8d4sPrAhFstyh5V6SseNgSifIAdnRPat7VwJjKLLKHZiwmof4m iMZH7X0iSHqO0IgjasZKNAXOPpXCcBInKtcOzEXqa1zKH4ikWwQIVB/eKxNHVCDjsOz79KLc NgSPQdZAwp6pFxVMK58WqQ1+6NWN0pCSiQ8qfmDQA7DIbJ+riTaLopGAjol6nd6E5EeH94mr 4Z2GlArc6y1urYoJArMBV4hVDZToKAR5CG7qFxKNKzVLcShQ+tSM6hOf2hOCfQ1hL0MKVMTH bb/A5cb2DtaC9oulUhuOUQljiCSyqm5lJQMAOR+lzBhAG7w6lB92TiETjuyKfbRNA76RZgIw J1OMvqiYUbAIpn6Ai0vUuQMca9yjNJI+6H1U6ChWRRSph4Q8Ae0nlDhwIByUUsAW03QruyK8 Ine1PrJP11TVVxu4IZEAiqKY160Pzd6owNsTDTva/k2N5GEyCUH9FS0Fc45CQDNkJJRiUHNw cV00XK/qmTcSsigsQokL4rQFUWvRU8/a9mryCEGFJWRZi5YIWt0QsLtwyYNOywTkalVay230 qFkrRSEA8kNEHpgLiuTNJ4kBtMq3cvJMyTFfOHvbI55BtgHKTEEu1Ftm3bVYYY4Gnf8Gs0KR Eo8anQoXAAOoCAidWPKylsrwj+X9YGKofzsQWzm4fCCPWjfF6WZhzEMKBMyMoyB6trx9EY81 H4T5CVH5ZexdJQPG6R5s41qxe3V92GZtgCrndnYcO8ZVguHRLJeg/mYA8E6E2QNXUBcSxUY5 CeVUnwZmIEscv1afUlLykfSAA9X8ANjayvi+WdSjXiwK0fHrpEhGkHJHPSX76haZerN4wUzo E6iJf+MfCiE5YL6mITGBY6tqq18j9TOVF16O9XY3NAUUeSd6RWVZ/uEMGMtU5rkNBhjzhxkn vBTB9AHXRGzy52kMB/GNw0PQMEgSRAu7ZO+MQd0fskFAhFbDQBMkuPLPfLE+YYmcZw1lYfbg jgEHTtH8V0YMPwHibShfZRqlsFdOwiAmi5N9trpoxhBL35hEO+J3VQBLAhQIbL6bLlQBQ0Na ITu3Gfo4ERCIHxWFiMTeGB/I7AQysnyROSxGBHQtshePZmLMywUMAOnkVX4GtBhq7MXaVaKS fJwN9Z/aYCOE/OKFe58OA9p+mo0wktN/HQWVpkQHjYpdlNUiRDyVOCK0eTMNZgM4HEKcD4+y r76WAS/BZknOgutkGN8MBAtNFdgH8jgLwyLbWto58BoAEgXXj2n4OdVFCb5LNbe+zxITCyQF udKCHFHkFCW9hX7Em53mfJxYcMI3HOrK4VmA1uMp+cczADMdpN2IRI6qknKyOor+AdaDvVce DBnjaguBEBzplTAWOsdtoBegjjrw14+TL0R+EYlD4KJe18n4lPcYXxTSC+j2xgMG323eYNFv kYJWQ0Q2+nchlINdnAXXDhZ7Bv2dlQzXHc1mzkuCfqqobBNPRYXyWtjvkDSzyGGxGVlbE4no 9Wwq6qhnA+meh0wAY6V8GwZC+4TKSbfdEM4hoOB1BfbQQBo/KFliCx4dGB1XG/Sdcjusnoc7 CHKDjLXWWcYO0k9So7YqcBX8fxtkMGAM9eREbkRvtNvrI4WROCyLPuTwyDB5aSZ+9JBHFBSg FfySNILtBNxgBWDl1rgASggCifaSc/0QJCgza9I9DDYDsq4CrU9zHCmxYddQ+zgDOYjC5RtF x+VWUo9ULkdzGATm6DWDhWaM3hq+6QsyDHL9jwT/Es9QHwNAA0QoBz1FDQZTXCPBjKeR/kQV JWfrh9LsE8kjKgwDUxDZOgxHOgSRDQgzpu4+wSqOEE7JRmKztY+cUtBvScu4ffdpD/uwZ+jA igqBfOAeg4dtwLnuJJXjRuC6CECtmkBs3C57dRyfuJD7KyAzl8uC58ClEkJG/97Lb7WyzZyq o1QWQMCIyk0Rgw0HC2pkLQPs0AFKq/g44hvyQs6HgqsDiags6NV8LC9MDRMDAaq/gs0l3nxq cQWyQLV1SfjX2BCA1RlAkQNmx8iJ/sRX9dYG9SIwChQJe3hPRC/GjqGxBlQi/peGPVXC1lrc BZaQJeoKOoEiG0UnFVCSEg3WB2ZOH0CBvM5glAKQARGH6o/86wKc/VR2ZgQFg2u8QRO6pwTW 50wSXx+AFmYQSyZskDekHuCMFgs3zW7BCT0pUrs5RH7KFIxYSuP+wAFWSJyDlQNRHUDdCVh6 1u0ALEUIQg5mArLXQm1GwJbl1rwJzVOdix6CAC0f1YP9TViUfiIvg1hesB2J5AcEBTFExWRS CkDjAGlsIe1mwHc2U6rIEKjPiwjjURZ6BQRjZIg57QDfQWafYuQIUggQIFxhzilFtgk3TYtj MphflABbME4sWtSrBpM22+lt7p/Py0fRdEooiGCLQRgWAzoNB++wFQhGWlxSAVlF0g8hjKwz yZTtJudzibjrT8tf0BX2ToDW0e/x01FGfA4ojmQ3RXeD+hH8R9yYC+aeaMck45jmzZh/hi7J L0M+SB9e3BXp5olpv95FX0tD/56oShgRdUMD3j/OZBMpWFJFA9V9CmCfSdISvnwZI1bACggE wyMFzBgEzCcueFRHTVB/xgRfTL5jANPhgmSKRsGmil4FtdASRGoi3Pv4nksVhQXc3IcNnpEF 0sgiSv5ghzludL0IQS2omQBgVGT2cC29Lab/AZYeCnIT7JNHKClRicQwsFSHZUFbIhpTAOre tm+9+QQLSUKRNLYTKQDOH1JiAJdhG3pNG9TgaQyNngA7Ywo6i25iRlZmmDSNFpAyFD8oHgjU jq8dUm6HtyVlZn/rYJ+FXVIOXo7GeMU1pj+a957dArCiDgmAhSaEDa9bwYg2BxM27GacliSi gY+lAgEJEwUaZv7GiHJR00YcJyADxjHrVgQAVi3iAwMeUcS0vL8GLmUTrIyzqLDVpbJ2LaKI LSEL3IdvnBDmxlx0hZGcIlBlFB9hjaKi2/NSWC3MAIg67/tBTvgLEM3pwCBWznhLY0MTRg9R VgVZtiU/YhDuwVRSTLQ+QATwwRMDgsZNL2gQXCqsYnzYcv0IEDRa92MZu4Zhz8BV3gdgFXAP g1Fmg6+ewPUQRoiX/RNRWZgGrGRmHsc02WJUpVJ/w75aYogGP8aPGQN8figIMhpHQ6ntN0pW EZYoTgFV7jIBnV1CoNwBRZ3MYEORdrVqoKhjXSwWcsnq4Bg8D4wnFU+j7kZyVG7b35fCkW7d VZMXBLNWUDd0ipTUOh5Q0QsVAJoHaqj2DxKPBIRORFmhVqOcVqFAT8oQUOUKSdGWXxfQQM6B hVY2QVNMkCSRnnqLey5WaJU04lMV6lJrGIWpRC4ZCyRVHJ0twGwXOszk108gjD7ZAEiNVk0S L0JXEHc8EUq0UAcYDjMOFR9/YDgh1tCLBR0GQQABcGYuJFYVPOYgbWRcXiSHudGAokUmW0ZB QByg3AiIiv/YOXc6G9yCxcJM5yaNNBSXITSo513WTC34JQbYjImHMxy1N++XqLJsUnR0eKJf nl4EIsrfYxpoS9icGHbVvrsACGFA2Kx4okwmdifp5LRO5icL3fSqPzXOHxDz++IQOoAEACNs PpwlLzCfe2cncCkFMFcySwsU3H6nsK9Lg0YmbStHC4TjhsQOxruo1t1Gve9qSN0VicOLjYnB bLGl4jTNTif+MQqd8l2hHAwdqJX9f9lmAM/ZQiuNiRdeRx1C/blbM4uMwf0AuvOxi5eD9QG1 pEoL5HgRq6zGT71kzLZyyPGSPieBn0DOwZqQIBUf+91TBZJkcygLnY4ILsxNkqOIshIiUCrS LNpg62gDnWS1E7xuRNbbtntU6GQKZ/katTonRK8BVVwM59WAxkSBHCXzrC4LbKKUHNr9mB8g dVgTOqj/QCKgAS8MEDfrs6rVjFCqlB/KSCmOzBzDAOqc8LD1k1B2qhwsE/VISgBXebaFZIIR R5WZtnrkXuvJWAgsU/tASSbmGELJxHVxRgI8L7xOum/0IaKcW7oGBSOsME8EXbPC7kGPr3J/ LwCuleEQH/79bw9HniQc5fKmUvpupiyqQaksE+GGQ6UUVhd3AmoZNMc4ihhw4AgwDVbWY3VC ajJxp4pOt3P9Uw6Yl8R688oC8KEoxb1cIkcKlU0guzGBwsa5Sm4itAbAAACa3KUwIAiXH1p0 AhVebQ+nQWAjRLB1qKzuFwEDNRmwB/QMD7CQzFA4WeBoBnP9+R/H4r41vq4UDKBaBRkxfBtg Na5/FjkD2dYsMwzknSLsHOPjN7vK0ug0YQ+4AICG83RPodnk2M9w5xB3IK/HrEAMAV5COKbM YUQXmfjUElrkwluyTJceRe+zJ6Lehc5w1l6cYgr4+/D9km5M6AlCajr0CnPkzTBa3OylRaUx gFfiHPS5vEATHUMdnkWkrNum3ZxITlkPuaibJebfObLDZDVMIzTsYS7iGBbyKzOWajNsEgb6 dtcu/iEWX8BiJVoRrAg8RLKNxXiIKxYXYDT/toB+tG8Vrap9bHjQKPp4CwsiN7BjgA82ZrEF aidbxDJID1249go1V7+EQAb+CEbV6Kqlb/kKouLqCBLJOr/IgKCQhM2NwbMu79QfWBBFnml6 UBULZU+qqkQCn2B2G9yT5uOzkUkSE/QqpBOdTnKwje4D30RoGxQFPwCX9q0KWuJbmCN5QWr+ 4KcM2Ak7ljjQFzjaUW5wovn4yYdt3Sy8aFj8iFZGTT0qKGN3XzoYKhp2KGcxlAEPIgmlSM5H cALO7nFy+mJAECUvKMd3DxQ2BXQFv1xAd5PW/wrK6VDOfyLcgWxdnQNv0/jRQZmdLDA6RT8e G/+k7A1CCLTnIAQQ21rZN5U6M+w9shAcNVUyNB5OCMwPUvRgbZ+pVN3D3xjmhJZ2OsxGXxOf 7l6kUN2f30JFloSLqhtCMF9V06f3ikPMgHqs5uhmqbsGrQdPOh8iEAJRf+jbjukLPAHTQQsG DWpcxwFmLm8kj4qMFnKKGN6qm6GoQTp3hFCesKidBikU/DlEoqLk8G5pDXQjNp3A5qITaL0c qb6aVm8TsB/QPoVdUB3jOk5hbirLyS9HW9sI2iAXNK1ExAF1EIjNSb7Itx4E1KRfBq0AIjzf gvkGAQv0CN0oIPh/ml/a0d16E810owZ1SvQPu5sXGXI5AkoSiX0PPEDj6K3hUjC4eEGPz+KH vkmpxogSX2LwKOZfXwwFKAcwDVH2EjVOoHBCcweIg0NgqgmatphiENS4GdZAnBtXnDYgHkT6 E1oENfhWvTp3MyG6BhR1IjNGhz7IAfSdh5pr9DH0Na2vvgAH5q6BBcfO3qYVUIC9GrncxZAJ PRcizAhQSggZtq46SjGLY3ek2kyAswl3DEmRgpJV3ao8ukbIAIdmzq4Ny/UhXzO+GLnwhSC0 xf1FrhLlyhAaBQW0FwlL782VAuMQ/QoLgjqDOne3GYyp61gsUpDPrzSmw5fsJVA2YaVQQI4T UAP+tlJk0ZKblZw79Rx65rA/00HvAN0pJpQ6QXUZPLZjASbEbGQAhlzAbd0YNfjqgE3UBWO5 A+yNXGMkRNuQfvvjLyGw5OlsvxR4f2Ij7kLRqno2g6iuxJKHMR4E5jfaOhg8fgOVqQHyOYtt JiEo79eB38/DeYI+hUdlezJ0Y1fzVwLMEeasLdg4Lz+L7DNGbWjFSRG8U4TH69GbNTRLAg/w xZRAniKPA24oWsxc6OqDBOLMv2KUUIehfL2XcO1bMChnA008m1WACKPwAEeq9udN4hWk0Y/M w4UQrY6UYxAOn61xA5cs4OmurMAHpgGDE83uxQzGv3AXF27ANrJr8GQnAUYUMaKXQaZTKjwZ LXR3CCmna2QI9pmZZtevjTHCEqAsPWSRrwKIdRAgiQeweWU/EO50yV++mwfutJUItp/0y3+t eCxkd/qIqwbrc6BVRyv5ZLX4tij4/0709odv9NAMGK5vLOl36FWGTwYwkgSC29np60qgJVCk eyCHzGREUCWAMGXygpYTFLE2tqTsbXoUQgzRQAPFBW9uciG8hq2XTbQFAboAmuCoks5l8OpS s5RdSQGX9mkKjRIuRCkgu60vyiPpDQFWGxazFzdna/yucQXTA8339Bx71HJNL1sz4zcR75LZ fEWzUw1FvlDa3IGLPFhPNRMNI2+CS+htVws206xZKXUDfc1aA18oDbDjzNCjHuoPUaKEaYMN CpxqBHbcRyUsynkDDENDCLLQiUcYiZVbTfQf3umqop0Ib7TaWMsuSyDEFOkOXj4EZXmD860/ G1GFpbOVQNvemiFBIC218JCa3O9vgWFZCxoaWbsULM08H9BGsfbrSEae4DjqBStEGgYYFAZK qsOV26AJZjIuMj9Y+xAV+VV7+h98hO4UUAu2WjA66uWzk9pGUkJDFgMcDGrnQztOEtA6hcNW qU9Etz1L9OGJ/FFmizsDnXfugFcQurPgEFcJUhJFazn+SkjA0IkFSycinNFDA9cRjiRY4FO/ 2yiCRXKijPFYxBR/JBFp8GwZeGyaGC+v70cSQiFrSXCcaMJzy+jqq2nIhH1BQcQQkddlNk6j fhoY/1oHEMCwdx30OL4apo/DDQfeH/Qx2Z6EVgVEMMCEajvX1pxZp4qeEFg06pYcHsdg9T7f g38RPwnkWmv9IOlU3iYkxR0g8VEyVjRe8FQ2gxEAscYAGXkXC1Wwj2asCEQh1Ey2Jl4PC6GW kSz2YS0VSTU2xJmxhrYVGqCcZARMuRlZ2vEkmbJYSR9LTIiSn7DIMRrKNILVLZlYclaIZyV2 mxyl1iWc1Tb0onF8sIBWNh6BoppISg+SuhJQ1gWZpuH0EvDKyaOp8R21w+QOSwkYwymPRAv5 aqZiJPJRFSjX1viAFvmAfwRH/tMdMeAbqXA2huCF689UFHTLGR/QELW5cB5U1UW0U88pFFX3 UlUBRkdq8op0U4uqWtfHbgSM+fM4Fc5YDy/mmxUMBnsGRQFU6zQfBICRU1PGn7fCPbhTIBaf X/nYhIfTX0MQCD6dKg42EGeqPBjOq0MXywxHEwPmTgSFzPZZWrRCK7rynsQDzV7Skf67H2DG QWUhzVS5PcXD6OlB82AE8uBpw93uHpiODEJHzQCdsAL8cHx53xVc+wlBbdMU5BDlgeiM4oH/ H60VRyKmdlaZnT5rww0YQcFNUzXbdV4FFHLkTaEfkvwOeFmkBT0TqjL+ICbK/Sg5uyolzrUs wrwiZbSvNh+QkOQTE8i4wWzXFf/7MAlFukTQck3HXit+mJge0yh7/Quupfa6G9FyTSPBRczO 6rCbKVQo//2xiLioW03UYibBLQQAQvY0X/Rdaw9Mcb8clPYv6SJWrTpTW5npF8KCs4USXAom P1kkopJ5M0sINxfGNKTBfQwC1IQ4mOb9KNyxivBS8P1pEswBJaUwSHCg5daCJ6gs9H+q4yBm vkpXPmQWBwEAVMYFQ/BYPb0kCeTKYycJJ4DG0kmATMHp0hxkex9UhO6pvAeGrMAUe5GgDRfi I1FVC8YuvpPW0YcnAFkFNRxzKz5BJfyA2RRENBPcRk5SFQxHUOnWHgwcqpXSCHBOQMQlSAsI SvggXxb6yKcoxxUGoW84VULNuzBDBm3ercEiChLpz0slZE6cZxCXDImRbwpFAv9DQvcYS3pH wQZVg23bAvin6NAzG9EeiLUbV+AcLxuhIBQsm5AI4yQLQL5FEeXnMDIkEmcKna27iixDYNDA GBQUVYNZMEuU6MPCxQkMP008rGadJ73YDIUp31Ucu52Cj0cEA1snAZJNq9ddkwnUW4QQXbJv +hd45CscsE+mI6HevczB9AgTJeEDUHYxgGgiQ39rGFIjChr6HCq/xvasSQJulc+sfDYKaHsT R3p/DbBFKxa7qhJfNPQEUAYxngALfb7MBUqHLIYtxoNFGwIP+xgAEogYDHRiDiCZvaoFxOb7 gIQ+hUit21MTWbrRUTCiGKETzExCIUSUuPeqyL43eJaB/vzJCHCIFxa2kuneV4Fagci9ERQ/ hLeKyCr6DYrCaBav2vnnLdAKnIKHJEscGk72HBZYiztkSzocT61nfFayIvx/5skMWQiOqr2O Daiz+gNGwp18EfH+vx0Hh7DbOvbdrlRqp8tqFAMEUDYQJUXY4y0gADCdN0ISFDLlfVgCBiQM EcI8LUoMTyxNCjzwlnoDqw4JTFsqG5s5mUcmEz6GC5Rg64zoLXMwEIiTnR8ehOSFDIbcHAim XFHahgSmzFRmuebGE9ThjagS8IxX1Tp0DkupjaN89F2thAEwJWRZhz8LqB9Uz+OHnmMFMCAQ QOMUnlpImGkIOBpkEo8PFSVKojUiLgjNFiLrAAyawF8K7BbLjUwzNUMb2fD8BbKlGMqISw91 9lrqKD1CexFWmTsWuWhGV9QJCE5YaBEOUH91dhnT+gaiCiHhgGoNGtEaKsB+Ga9+CHK9/cLw BNEqhgdSUTBDGUDphKI/EbLOYGf5cASIEE3F1m4SqD2izEJV8tYqtB0yT0RQRVcmiCQS89IX sY2CTgU0tE9p7C9iU6H9/l08IAZf9ZrexIBWR3gDakoBV47aojIWv1B8GrlTSMJ9AmEvrRKy U4P3tj8Aak+gzC19/UnLFRMcXDbiHqBg1XDSdFOSFlQiDo8W+vYKCoTNu14iQwW/e2T4ORmF nJxFZCjDRgAA5cdexiaqNK+sSY5ANxbWOiHCQYMR/FmIABrNACrz9wFBElgiTDTLFBJIp46J FoIcfRYExbx4DgQaHPvFZAs/Mrx4RXjMDe4mBWXGIU0G9wVpASUgnnWlOxd2cG0HDl2ygxbT CQFyxNkHD0RbHCBOxDkionAxAxPjcjv0GFF0VRoRLwKVsBpwpB8QvgsOKWaYhm/BEAQ/pQX9 rlZtUEBChFzj2BZgjkHgMSdTNY8S1e9DZkRo7M6yvVPCgWccyYJ4nOhmcd424wtVyUhWkxKP 5DmRzFpWtTQOm4KFSxwOkrlW7hfNHhMNKfSQTBpX8isPAKXa/OxoZ/kPFiu1AtRFxhRkZUYN DeX5F8RGC3ZyrW03WRK9UYyBXnb+UKIEm/FVBAAllNqCbDE+jE2EvSjUOaochnxmI1YD0gKE Gd0IAY0MSEPFhA5SFISZupaL14A8HAJHlwDBztDCIMClDtZWM9CerTs8E2x2hsues/QnqB1X kABUtfqaii8rbgx1A/JU1OQmRdYPz89oFRuf9m7oINP+FXHQA5PQpYpDsHLqIJ2kgQvfgcPd x0SFQnKtjsoiiL4D/lcY3MBdDyaZEC5kIKuuqUxxZDJmERrOAjvShnilhU3v1TLMwLjnlpIp URkbNyJA5KX1yUDfCSUgq/zvYO1zuacgkGLIEwN3E+BS6KhcTIQ/FeoDdyI5GQRhM8kCEGYs pG7L16ZCfV5auAA+AnwiUrlaA/lkGlRHAlRJ5iIRTnNZfh0pwk8ys8IMT1TrQWy+2iA4Rjwn gTkYxFc6yzTQZO0Z13qs8IDYKn6zQEUZwwYtw+MA2paxIFSnhU6AnkNGjnui/VbXhCM1Noty JcmQZFbHHg/HHCAqD0KL2E77yoHrGQzCjTSbrwlfMo9AUxOYgBDTH6+ZhWxYQhCNjx6Y1k8r ws3OBBJuupgJVqS+LEc3z2J5IF4Uko2jPNd8N0tCi24SQotUEs5oVkA5hJzgI7JsqTz4YmMI zf8HQGY07caRMwUDsdms3OhZrpHZfRsDYQZW3Mq2gmB8U08z6pUKRAffzZ2rZEkCQIDG0ROu ZQYk4VdaxRjm5rjwcaY4/03mAAIHpcMuOO29LE9IDKbAbYpU3lcnAVYEjig/zgLl1EwhaxxB 6rcQwpD/ogZIvqDRCRQvdNABIGZBEae34bxA8foFukRA+ulMPBBDnauw6lbBNoHcqiQKYjES QlfXAEaFCMeCesgxGVYD2V7ODINeVlP7ExJLPHXJjDmFYRAPWJWJZxJVdF0S4M0PRShZkTnd RqSgBgbRRvEVCZBERlJC4oB8htknghZWJRT7hKqcPUXNSFAGdDpCZYgjBgATF1bUMxwZSOQ4 WhYtDzjFsHCbejjv2lLQB0M8MDbOJtCWQqUcNZN9CzzVUzw3YZLBBOuhayQ27pgRB+JWVsLU 4+1gam45WKZAVHOFOY2mbv9UJGNEUOQGd5KKLtgEEDGMFmKOQ1oRDqKKqUoQNEZ2IYHNVtGS xgXXGKFPKBJjw3QnV9cjRWPqvNptAtuRWPRprwtJgJYfRoc7Mz9NBEIBkzzOOQVkJM925AB1 URtMsoBXiL0sNAGeA4RlkZBbJkUIFwNFgAgDCi9ZFrqu201mar2IjwXVgyqGHW5HPJ5RI3oa b032FQB8TQxxh5lQvvQHxRqTdx0C3yzdh1J0pYKwSiJecga9v4MPa5t9x2EBfRms5kfsYblD hc39uQCVRlYnGAJVI0U97LNjyoTR0SykkrTFns/n5SKbRGtA4PBEwcl0LD9ZU+/motSDb1hi D0OvHaLDDOAOZgJFBSEQuQ5QDJYOfGi+Zh2btwhKP1G+m44LdE0/E7xMERSHXIrLAC6xINnO O2OAAUFJNxv0dMpXMTcJ8nOmvzt+jQPtEUHu5djIEQPklpWJBREM/uODCh62VvOf2N8spuR5 A/6vRgxXDROIQeqkNrpBmhD9X1Y+gqXFhG3zk40+jflREhWNK5UZUq//m3f3SoMbhXwY/yJW nASgdDrFbTIPhkIB23geXAK8UxWc8D+NyUIWXhj87mJMUlcwxtOyYrjcE9nJdZJTJyily8GA 3G5ohY8NGDiR5UGGoezm94rXPKsJRwAMCHBOPnI7fuIXD/4e40XSXcM+ihJS+UdrEnMMAeus nvP71NUQGlogMMp+VMUxl5cfC/9kqsRSDHJq1zDplNe9ElSWLIPyZgVZzN3RNW5DxR6xpu57 lNSXxtpXLDLyZXqTMS34W140JBQhlZyY9M4IEfjmKXuVSiDyDJR4WYXOfIWST5RYuEQwFARi nBmm5kuIpGmbicBQuEUnwrgMs2VwrK8z2IxHWjB+7ZWjnLXXQPukR3N9VAOy14EsQFp2Q3At +/If0ALCgAHD1pA9jKpIqiPSmASeHlYHgq1JdD9WKN/WnVSCuAvB4qbGuCXqfnY04pApX04y TcgPrt0lM8YMUir/L/gczSCY2vYEddZeklEesNgLCqdA+wZsDbVHRSKWV/CT73yyZuKJsesf uIAFIgMx5DHWtcaUAzfU9rJkYpCLQRhVwqMPU2cyVI+KZGdVAo5mDZnZrvwik3h2TRCo36yG U+sQs60xoofIO9HFwqB0OVMEV1R0AEgyFV4INRT+akKIEw94CVQO0IgYB6DxVEcVRxKV2BAk +2SHlxKbihxQm5V3cX/sJHidmxiOrE7myiAjwg6OsBbKEdWPGIiN3BxzHtOBpgN5XRLU5Sd0 JBEOs1m/VJz0pDlFfjwHbQX3CaywNupRb6pARjQGKANBTMBRFLUANFSeCG1YEdc1OVOco+xh k68htMb2Cgx71AHQURDE7lnOmQaP77h86WxWQTNqCH8qQxQn4UuRyZliiP1RTEjBWI5lu4qk kwWODwUYqYVghz6wZP/VfpLYskXM5o12oUPRb8yf2q02J9lPYwUfYKYwJudAnyK39SLgai91 fmxFGLkeyHRLJZcEKDwvnoZdyd3A9J/Wf6usWfCP2MSyQ9AzmuB+g2SWcZX9LHVzow8DBP8l gyoqNF658pmhtCN4S3oGTr+Noye2r61MEEJoViLujzgUmXeVXuNhcirBgHhMZgwug+6IawBB KvV4sAv1oGZuUZnU/G9EXVEWTFVbke5wkAEG8Nb2BsBA4CAN1rI9jUpgV/jb+iANbiOuw9rS DDCNn8wa2yZd3AKSSmHV1EciyakuzvKasBMCBzR+3o62te2yQUPCSdgI2J7iV0ZToRFqIsm+ iKHIsITQ5FHusARx2X7ZCD9kFg4OviIbA19oE3WRmOwGPS80LUoQeYoBRDyOcFf+iqyQAXdi SmGWMq8W5FkW9vI93RAbVcUAVC6XWiTntR7EdRAHipgUcL8CaWdyUghWizU7bj3aSwRJnWQb 5oEFrsR8eMEBQgnQ7FqsDWuAE9yOirQdk43IcdKRTMDaYgQPRNzY6N6D1NczRYITbR4CEuYi f8+XpsSFvmKXz56mhlzz7fcj2Ubf20MF2JaSohqshTAIEobIGAT01FUQZrozhztEGlAlZjYs YmIjHd82S0JGAv8H7YuC9IIbNxvl1OeGlmKoDBLV54bCWtgDT9pU+vaLCiVmBL5jIeqjGSK2 +DJmtRwyOL7eHP7HPNtDYpDoItbvL+bWAJCBRiAs5j8OjQbMBFh7+MMyCsUEVQomz2eSTwwx /Ep49B50IQQIAoMnqCVjOzFkyKVbKg3ncmeAmkvFadt4I5V7UQYaR0BVVdSJ9ZQBBRk2LQoI UUZZBwgN7m0XRwtmiBHeU7AGkWMvfEtTCBxUUF/MrtPFABUvj0K09AN7cc0TMI+qyCtRKR/w gvrkyrfWFMq+wZ0zjdYUyAp59TEFdCA8/l+Qhz9uAdc1mS04oQjJFd1yLBWNvCK8b4YCxsyF 9ikh2JUEqRRQGTZD2CcVdkyfEgBQEpn0IctaWlINQlXltCocUUTT76ratRFRTUQzRU+KROQW uzYVxNkcE3KJVpl+18UCYMzEQVigCGt9mODpFw5WFAweVlTJpGYkR4ksIH67zl/BFr12Hyvx 6vSiQrQ20kVf/9BOC6iwyN+F7RLjGs7PBh/mcgBFJUHnDBxtghJMrQZEUXwVYALP8JVv/AjV DsU/N6BMM90FTopElldbF0BdjdIxQU11FFscNFUWPOpPFVdcRwNML2sdgdveHAcGXRRPTQkB Vh/FMA9cXVdTQU4J6NBtsd5LFmkXR0FjX1gbhQxEj1ErCJJHOfUjduE8kivJgDJxWY2QRRkg YnIDDZJFkSySRZmGmn7JjZBFGSjSejFSBjdSflrKyJQ+3RdX4EtA9mcMDvYWBjvEfsZc4gLN P1ni0hzcThJMFSLbeZxx6QeEgUoy3JPUk4AOdMg0l9CXJspmg4yb3Mg0gUqbiJ9mgxgw2J+U gUoy3IPEg5AOdMg0h8CHJspmg5yLzMg0gUqLmI9mgxgwyI9kgUoy3HM0c2AOdMg0dzB3Jspm g2x7PMg0gUp7aH9mgxgwOH90gUoy3GMkY3AOdMg0ZyBnJspmg3xrLMg0gUpreG9mgxgwKG9E gUoy3FMUU0AOdMg0VxBXJspmg0xbHMg0gUpbSF9mgxgwGF9UAYAB/UO5+/EfiVCNK38g8SYW VFEL+BcgBE1Ur1JWOGRr+NyCuZBZxB1RTBoIIxR3atIpvhB7YS4DxEkpYaPBEqRG/+JtLS42 orHyER/EEisZQhp8CyBmXnUDAbnDcGZResw2EgL1Bx4Dkx4cI04HBUdoRicZzwj+jBpjbTb6 64Whxrp2YTVJb3ReEZ0AFrgYLfgYEEOTHR4vGYHMDgrsHgkSKPzZ/WV9bk0n8gJBCRFCcSzn qMIGNsLLiRzcLIACBvlzX+RiW+9uHwkbYZHmNAzktA1DFyQ5I2ZqSbJXCpsB5vi5a9lzRGMl azM3A1MF0yIIFy22/606VidUdHxrH9x8QCsRzUZaQ25q4aEInfgeOkQRnSzZrKDG+dEkzOIp iTsFRbGaXiULVH4GixbBktmsuBtFohAic9Aq1fZO+/gj8BIZgoKJHy8xW/Mg2jpnQI4X8z7L 4uuBm7Rdrjq5TfHi6zePM+cbtDEbEFNfIGAGQncdYFW0BlZz7BaxHRSgXysUiSmhtD8kU0B7 iR1eS+F7yLHZV0oXrq4fka5Mt5H0DT0XsnZO14UFdB0v7Be8aPfDeElg0i80N/vrT0p/C4G/ /WgYTclrHmCqlBkGoDvgnTtVWez3zQ21qv8e0Hf47f1CU3Zfqvb6QRWe4mRmvw9uUWjZQSPs K03ke7RS0YFObWEQdPft+DHMJTyJLkkEQPIrq3892xkKMgRmAGqwUYgb5atXokq+2eur/Aid daoIAX0SpLFuT3+92v8ETOSkiIKqhjGaGOM3+dvqGVpglMB2iAdBDwvA7/fpX4hFqi/BKWLi 3jP4THDZg+4QNAWug/ZQx7+n1RHpENvb/HHqk/+HSKcBsPOe3gWNXXYh3fn1S0th9otavhqt 6tAYuOPJfLC7HToMdBhDM/k+SDP310TMHdNEztAJWuVRHxIfuUXBucsbBnzZYgDM2Rbfy5yP eKitttoYsrQ+a7Zi41C1KCZuPD6CzQyj+pqCw+qe6DQ/BeLBUeOKyJnAVKpGNld1iQj8/8Fi KlRZ9dvJAmwkECZmCj4ibhQ9ZTC/y0JrGTAvQio5EWwkPHkZ96EPQiQHL2stIwqvmm+ta0AQ MEEYPGp0RqMrbhk9zQaqZShQN80ZLvwf8uA2EwkBBKJNQsH9Ha0Sz2wlb7lFTgsGBUxPHBFJ u05Gq73+GDJMEkdPb4CAdejgTMnon9LNYvdKR1BG8ob0QwdzhuBkXVd+th09MHZRBeyAIYLS bCt1NAhufg46Uu2Xn8N3GzCgfv8jX1SIx9DDApU32tIsEGihITAE/wK8/09STnsp4VusKCUy JCgg4Pt5xTIggRJ6Kvvgq4oSCUK/pY7/CzUORMOrrnzEYNI32s5PXPf/5bhTr4m9jyYHOXX+ as5V7ACv/utvsk83dmA8JHZjPDp2ajw4dnVfIQecAqszekVgOHpRIkhkEtHQMUTD6QZC/0mV U24Jbv7OQM3K/8WK/2HDy6A/iIS8uLkr5PgDrbZkrVJWOZBtdXl1caC1SkesS/mtlj/urIjW jnID5MO0e0VWouUfwTtNemt85E/BsgcHJVWTbysaDe7qOQMbQ+OgeW+GKy0mmj9duGvduvIk jUkshAjvCjPTIM8x99klZfP7QZU0WRxcJDRRZnfiwQBPttYau//P8MYA+h37XziyijKCuitq Bmt1yDCiuYm0kC68QwAwRfuKmqFhF15HiDCM0njNLU8UuVv/iuXD63zOCtIZOgxN3rlNzHwt pe53sOsZ/Uux1+Y4Ev9DlGMPlG5DCgkNEfR8d32mHOaKoAktuRKoM+sKn0wXNVmcFUThSbLc 8MpNfhITLqoKdUa9Vg7SDspgw0JRXfk4bqtPu6hA4/hKawii/VAOD6dj9BY/QHU2ZLGg3leB RhKcVx1g4yCWEXxLA1RrgEOqLja3+OsDQM8s9D99wlZNkolE3hHDvhBp67OX/C+Z+M3jjDFc 27rbOYksC8ukNtjNmZuCj1G06MtgO0FgC5y7+vqZdfKPPQPr71mCMJnMRAHnmsD8BsbkG2RD 8Pm1nDAk4yfrJsLsi/ABOwhto6DgSfDEO2kOfQTsfL0XbhA1JyI5RTVmJ4BEEgIJeBn8p27r 5UESLXWr6wtkgaUlAicLe7LxXquQYhk0orfbL6Iu8A/6IMH+aM8HBOK+A5xRRMNVy0TguQB/ yB/IO4FPk1L7bQUw98yBnAqUr3YKcgkLfOz0fXoQflm/GkNrIbM0iNjrg5yzouJLc+ZLQw3G dbYRgYIY9MtvQzj/XL7ZP8A+2iCHslzlmT6yqRXOdQ+7sPUZd1is1P1R2jANMx9dd6rrLYiH BHgdZHDbL1YgErkb+hJggY1YEUUV0gWSgCvSUUB4bLG43x29OXXUcMic+JL+EveF///ylpvN f7ybz+Cfkm7bqEDFyJlC+snMPpT9bQTTr7C930TNzgfUBBkuByPtH7PjKlITQDvadgwV+N3r 0jDdWtNSUFLyTAGWQibT7GOUI2hqg/xkXL4rhgTsTUTZ9MKw/xM/Qt8r6UTbK5mZ4HKrl3WB iksVlAab15n3yvadb8mE167RINP9EaLdm4WsODhCCmcNnA08ZR2tlY2cAkboXYp37zqNGsv0 +YcrSHVQ9rBGf9BMj5X4sg3+NSKq4hlEtGseagod3edHFa5ND5Arf1kAQamERMNm5PuUSoId o8blgO5CcjYpfe/4dMMKKgQDQXac/fBUnwy+3FG2QAQTMl+mj8i7UUofcLpZ2ggADmOcUwbX ofDtsgwx2WcGgIEd+DRSlgoqRQaBPxVNXZW+jp7v8xZX5VLOokQa/wtEsP+H7m7pV7yQ5eTd qrcEBi30B1ZptAhL8E4TGEVmCRsPQBlevNZXdGL66r0uTB9QazCGhm2dbE64KVesuukomEL5 MeYgfQir8VZX5xJO6GQGSgdTg8Y6jWSnc1QaDLZPbipjqEZDjYNjMmhbhNTvQ8aC8zSyblgx EWYvht8R9Aj2WmYsFgBjor0fgRgnm2VDdjLpgtJea3RVirEWY27ME3T7U1DvHofhJlqBqEqz JBusW4A1Xa9gT6ZMhoaCxvOUOB4KT0EnDDHfxR9P3posNhzHDVGBaTJKUJH2LMmwODWKASAE R+u9Xtb8c2dUzsmZg3KUmF3emD+XDDhKUjR4eeFXyETwEfDkDBZQl61JIq1CdIBX9QogfAe0 91iE1G+ksNZXsKYXFD8SgSQFEn4ziwTAEcxZWVvTGXA4HsZkwVJjKGSEg0old10mYFJSEhh7 aEoly276W6i+2xpMg+1mLPBki5NZvxgL+17pNn1DV31sdTJDcoIIeCo2sxQKjr/TUSdmcWEn bAT+KjDzJg2UBRASG7WIB963Q8UbqSM3YW3qbXvuyhHyhgK8AO4Qfm+j5kIgJHvWKJGfPaqe VvNSbaAqRZMimnVnig21QWVXpHqXNBZtggNL7ohTADuLxrhZ/qyQSBTxIO6TAtAWiRMBEqLB Y1+2mDGUwlcvwldFq77ETSEO6SA3P8VmZLH9lDe+NScVngB6NBI+PHcWLmaKvBS3iBJAAEnl RlbFEX2A//m9FzTeM4aD9gGX6RXx4XUTi5fzsj9s2kIKBiFHu4GI9CIZ/B3QQLvpBFbT1TuX dhYnf8kzryutanZsikr90l8cBib/27G7A5TpZoprDbn/+yJ++2DaSbbXdpu/ewCRKcRZFTnE dl9QA09SCrYQRgnZoESayQ6WsvlCVo+fwZVtTBL3XMioiYKcyfR+HVEjRFlXcZkMeQ5ARbJ0 APzLUWEtDYVqFSIusLyqW6mkEaNTTzXiokbDvgKnfT4hfw0VVx5Y0ggigewbSGe9vz0KzAYQ vWoaZghqBGALuKL+LJ5zLR53fD9CDVED/IOKQDwFwsQYNMvPVPAVE/tpDRgGMgjqEm7gI3FA R1x3nStCNwzR6H2xHcCO7PkWwBbvOlLe/PBUQNxNWDYRqCLVWfhSUok+zTlF+eFVR6iiwRmd XkwcBWUEC31TcjSO4hJqg/hkGDGqhj5/j4O6PhiSNiAA7CQQtwVagwWdEjR0USW8tLlV5MOu BKBN/lCX4UUKiRdJSXyuJSnMJs4qTDEmQqZ1QACLJA2ElJhyUXcNrBlE1yzKkcBICR8cUiuU NMYcNGIXIp5W8zFr9s6/CTtlqp+2y4USoEX2HFLLHjISQfXMs3IKNPRYEGEndxHAdXAr3Bpc jmntHqTqUlEQAHkD/A5AA3U/Xhc9t8q4CPcMJhknLbMetmHD4pl+WGIGGp6AvEDHhSsbjShu wYEHqU51qnQkbqLSNeS0airMXFOCcNsdH3nFFSL/tjt5y9dYBAlPM313+DyUB0v00fDaY6sX /yya9o/XVEo5HYLuw0ZXf2BHXnyvtMrzaJDmljTPJbDwRgGy+OgSOiqaXVh0LfUrVICCdJ+B rCpbL9lMG58OzVrPCWzRIB6DSA3yVnQmJ1bDkYPOgqkKZqL6fWUw1PDouOoKb7rKETATA48B /wflkGC3OUQsLfUxyD9IAEA3MHfWSVqekZkWuWYb/Un9BA9x1uqBqAOX7UUdMP5YOsl/9AMW U7HRnfUKyp36fQL6gwBeSyVtid8nBnMBViIpNyXJvVdDb8s4+M/ZzagNCj7Gz9CwsQbsTlot 5dJbYoy8Ubg7NroxCRDNbx+hgwlG+p2RidIzkTHGm6jFAnzMRuuIERLEat0kqKxqb48zhgkm mp8n5j6NDdUmzEbs+q5W6j6NV+74rCA90unDyRBIV0RZL1+c0jwRetJPMUP6DgPC2AsDzkYG idddYyziy7gvPksyLp3Mz98bK7d2CQz7YbXDyzwKrmwRncoRw2SB65GZXRp1+baifETPHKln OYWlDCN093QaVjTVdyv0l1VGBFfQ4ir0KytNFUUeOOuuFUY5A9JrjvcahAZlRgovQFML/hIl O+lhQzDMR8X7C3RDuwtcvqTZzndKN/56AdBJzcTC4LGiVkaABDoMk2y0gyogPSZAIHlDaLBS v21P2E9uy5SKIH//NvYKnmyFh5xRB7Zjs4VQiI4zmtoBgwF22aZ96PfP50/aKGjkRkg52q3q lzELSyp4VlvydurDkXoVWgZEFbToVehM26P8BeycR60NOQFR2sn08KHHAQwOLndMGewTjlei waus/91P5K94UC4x9cCIXba2dchTFAxFh8v2h1jNJANxP+5M+vDK/05MKd5xBtE3psHLcFiw wx+yZvO+D2txEKobMB5QywJI75uuec/NTrUAykTsKDIiEFkq/PEyNDwtdXFrzwgdMBLCsl2u EKeTF+YeKIqiB38UzU53Blj/F/6n74BowS0c13bD1grSmSbIroUky4qHTgkqxrcsyRtcJY9y 3rnDXajLXEL/MFb6pq028b4XBvQCERuRec1p3Emtm1EDEVj8wY6kO9M8EScHAiAaTwB+dEVm h5QfAz5v0Svyy116mhQFkaJVKG4S+rzpgr9EYBNCVWAoHnXE+Q70TPRl91fJU/cPgWUK6QQ8 AONZ9wRHsmtBWmzFR7QAG41hrSB/kqLsUU0ecAFNtPvUvpAuYC5wRQcTJBUFC9pQHSEOH+hL iAz/HdIzyplP6SlGgbwQYuNoFx46MXYesnZXkpmhuxr4hY4BIEmFKd3W719l1BeQe0j3zISc t5Ff/p+g9bd6P3es5mKSKmaLURrg6leXnI0DSNFyolyEOzgwD53AukjMMCHfKOkEMd0i9nC4 N24aSqOO6yGeJrPA31/bEmNSHIc1tv/C99exe0nP8P8JdXwd9DK6iLerW7A5C+BjiM0FW2LH rnGIb1MH4RiZsdlYT537818LUgZukLAGwxwBr/tfwjDry7VHR6MCcLNdRTj5udIyPyYEA3Qs sURGYBD1A7zPkF1adj9NKQD1BCkImHB/B3/CYidKBAlHnRthGYQkSEqGrUWTGLoXgTOolq9u uE7pE9tJgMmJ5iCJUKgiE/BWY8nDRJvmyAHhHsNbEm0hpI7Vzr5o1iK0UuHDufc2qm9LLmZz DXCLfg3pM+WJvF4kiGPnIoI1ZDHSdQhBjiiK2JPB0RBJTopa7RUEvk5GFrUyRjAIuUQugPPX ivzR8wPV+ESodb0W8N45h30wGd5AwKGo05qXHRg16LDvbulKQMRcjz/nGfPDt23WQ/8yRfcT BAwLeFrXStxvQozRRH59N5BktamNausaj9Ni95O3AtSy7iN5M0WgHPPm2BoS6QtENLOkF+52 6xVuOA75DxyN1hyGIWbwQgAk6a4NYO+3y14FzaCedLkA6/PbtTJfFo0FUwZcZGXytlP7jkk8 oCVn68F56x1IVMAmiKmsUWx8c836LAIbQhMAPjcNjaWQRDg/PUQUdBXnRQRfnsAFF/lSE/Kg wLVzbJCENRIEn2p8BCorLiCz7UIJo6oWH1HATNnU38ineLz0fKsG6lV+/5bBA8n/pMC0BURc bERRyVFOZE1ChUlSPCUi5FJCOJ4oM+TkiYFDlzermfgtZQ1hrCbc7CzqiP4AIwcUdidGgu++ SxLucsl1XRIHJXKq7ISTaCT8UmxytahlOfwK+TcE0mvuqlFCDnLZxlg1UrClYLf7Hf8EeAdg HQw8bZODFnwCps8QC+7ed0YUYJS8YwgGDmd+32aEJltaTGlfLmSY1R5+/7dFKhPBKWiUNIsm PB1WKjhMj0IKZA/HgIAg6SYTmTF2HxF5DMffTtOtEW66H6RYeAF5G2quXistJPTxWC//lQNn PiwEQi0WtW/6tyXceUS6jLrJPNP0RIY2rXrR4GhFKPCCA14eBu8LDihaAZjZZkZegv2HHJEh k7y7Su468EVzk8cFxRkG/AnJ7PUE1Q3EPQVk564MA4e2tWTjdBkVtSafCghXSjeuF+wnKIpQ HLks2RhqIGAUJ0EBhxo+mF3hqH5cFkNydBlQUbCUwhjNzQ2/gjMNVNEfBcSfQxUXHs50nHFi IORrALPHqaUcWHlTc6/dRDXUuPkImThu3wcGe37MlYEYAEIAvnN1rX4xGkL5Cu4iETxSRetC T3YeD+ZOPCToH3QQ0MucSXdIGlzpvvBAP2MD5A3IFjCK8IG+wrOvHBxOgc9lIVKsbFSzcw4/ AHvdPe4fPSMAGxdVAjTcdCILHkcUcBKpCQPmjiZLFUISEJ7vahEvkAyHXHaBZqq9JEyiGig2 u5b8EPaan9BMx730Dmg21Q1q/RGzw+7poMPUEtS28TDShE03GV+QHgLSw/7fRnQZeigJP590 szRoICcyII+Cn+/N0FYNtRPRA+TCb+N6u1YNTr8QYWGCMqYpIUa7JtUUmp592YoY2wjKTi7A M997ZlRWh+iIHviEXZcBnPpCQB8W8gZ08UQGwzfdJ7z57vy4B0KQDWoAvgay8gYjGz0zpg3+ vBGL28AIxr3cDfnPvdwOik9oaAP3MF4pjZG3zAaABdBVRL71pNjA6ghzhoY9eMZl0kBGdYRF CFREhn/oOfY3M0AZDqEEqhq6wzn1lez/NCxA6eoauvM8BmgEIhciEEr+7Rio91J5Qi4gQoY9 C4VdR7c1zZgPyAjCUC0jJRAqiKmgpZBh5P0GSePCFQ5UC48BBDY0jgocstF5FgtqQK8SODhK V2u2OQgxAkGXumJw2QSggizDoTgUbWxpAv2bFcNNVxCy/ZIH22y9BU4tDD/G/1RxyMzqVDSO EUeJBjZUUovPVLpkOpTTUb3vQtcs10fCDh1WIUlBtsw2+lZiiB7FNgTkBbdNPIndf2Pz0Y4S fU87IN8DbGHzSxWfDoeRdz42FeSurR2DDzQW7wIiHgRDloie3ntRbak+EqMGVAR+GoZimIIV KMSo3Au8QJc8fBeb5AJwvapfvRBFhAQi6wYG86aWuIN8mPtGYkTGvpto2VecR5hW1BYEyccV fh/0f/5yBAcCq/DRY84MTtEjXrZDXowZ8S6N6BgGMZ5/tkXgKsx4QUZvFphS9ejNDBoq9G42 kjQ62eDjtjyCAVebaxPldiAOMMfoIxOdUeSLiqR5Av1xvbrdPzwQJo1Pw0LiJIkh+AcOhpkc QtepD7gaQHoMzHAX+lJHq70GFwg/1N1rLjJZKYxOFWDwmfXyUWsFYFdrh2h2ekhgSq1VEXO1 3+vGefwndnHrUz/QKQV2cy2HdUZVzypkEx8ta/3PLfp9GidhPWAfzrAXwfYEFgdqy6YuQAcc C02vOcn0DBkMUICiGgoYnWa5i6RxInvJe9b+04dPBaACTGdwrvYplnqPD9AGU1joho4gUPPi dKcWWjyNejUY1W16gxcXkMFp8lYhFhz4CXR6lmCy2SPGWSjmYKtu6Rl9onTj6vzLinC7V1QA 2bgF+cJNNgGwiDbcFZdgqcKFxHc9ZdvoDY7MnbeWVsC3HkQzuvtDd77V7+S5Oo0bRbMzInTW 7P9Y05QqmteThbMdnLSmB5aFke6UFpIOpXCSxpD9mlehGBfPpkxEUnWcSuwFUMrwdEPHhAJT BlSWKEq2BAKZubygAxLO6chOchwH1m5+PpQKZyCE0Ej1ne4vV3X4TQh2QA4BdBYEwEaKAAZ9 IeVeiRFhyl6D5RxLoqs+QwyVOoj6+wyjRxZf70MCovJTAkNlqZygp/Fxkq77bw8FKz8iNnFc EGYaeosPfLMvfixTS18kMg1RlVeK8NfcC7ZQt9Nm+DBFQHmY+rLYDmqzxHD64lElIt3Q5/tM oALG9hvU8b8+SxXuE/wI6hXcDgCe27ZVIKw+DqpcIkEXiLtkIvRxKrzY526IHH41r0LCZ18N ZiJZKhHzbLxsTqAt5tZDpKrqgr5zSLRQUytUmLpulEUP9FVSVnHzYDkVJkNNMggQeu77IE1O fBiC/gSQR2JHeR9SudqfkQwku52UFC8nSjsXc3RygnpFdClSihTyTRNCjgpt/0rN91rbKSp8 4mQSng52gfUdVkTvzUty/YmJK9oQHQHoCjhJl8u4QTsGk2XW/PQC/xHMBCxLRIvWw3cYBs0g gCkMUDUsBIdqwkjBfbaBoWAUMY8dE4JFgnYRJzU+YlN7YRNWpI42+cKtU1vuTqhfTCgHSozu +W39U0kCBjQE1QF8igwXd4O4fLaDUYJ4esZ9/XBUNRMxiTleutxGti9p1a1CKz+eJJclFymQ ij9HQ6FZRBEIlIEkV/2N/EvgDDInD68FQ1TBwYr0T9NrnPhNEVYpljvudPZcQgLfSkfYrAv2 SiUaAApUm79i2R3kQlVA4MQhlxQW8dODImLbSkc4r8ObTQ1eEgLCawMK6DDfAUc3xTPcbQ+d hzMFrr+HjyqkqmZSwqPXqMcSC/tm0zhPBRLME92PjSIKFotAZhIXnCo2E3B4Qln9oxzDh+ge C2BqBBNBgl49qz7NJfEJfihIw5xcTsRUVxmIXAcdAP8nzEQFw/nUIQTFNRMonnICQbntJyB3 IL8FuArqyTPul8REg1ADo/fqDjsKPQgCARyYMpcM6WF5RiPIHc8YEjaT01aytDdDCmwYyCjQ xD9PRBFKCR5/tliaakcmrIGgAmL1ziJY8vwbNU6XCcUWBaIW5gYGzSGuHPxPzoITW/cswtnD /OOLehJOs2i6GlkP5JQejiAN5mXLkf8asTu4WzZJ3rrsGB+OugveItEfKr833LGmYMAuWAyu IthBggGS2Mxm9F3MRfc6rhwqaCvSjnc0PmK6PDGWYXjNxzwizmcwriuKcHixxiYdBbIc3GLF yOMnjhSQCcRwiA/l7YFRemoaSkUZcIl4xDdw1u2Gxnlh1AdWyScjRcDgVsyg3DW+DnAHmdZp 0bpoG3ZB9Nx2X+SmgeRiHB7GePSGcizsDtdYt2oxwFEfpJiuEhwsFOpGAJuAQ1+SBCsvcC2J AwK+vVd5AmZkOCK9AkuSjS51b01wX2qPii5iZWh8AeT4gv9mQVlSCwAbDGbuhrcNEy5kxQsu cTVR16huy2qibg4u70IfBqZGalw36WYwBZJ9KKZChxEXhPCFkddquYPWzA6S6UXUEdKgkRdS ituFRCMUtCoZD4FWEPtRPyLXtvxsSdX2ZAlTEuRIE0sVJRlpAKWtrCDn6f0YBJvsBdY+xw5e BGLa/3lei2jdLqTbyj60vPUFCj5NKoMpB2bWERaoiCgQRBa0LDJr42fGQtQwdXQ8B5et1mkA xK7SRaq9CQcAAQJHgteDj1tVKrlq61WkUQNgWhhSKpiofL28v+0hN1RW4HEClZ0YILwT8gE3 Oc1UEgd3i1hx9kCQqBChIQVZALYo0X8jR1PYDm3m9pTROBIJlmRwBPRP8TZgKf+fTG47Ui4y 6QEN2MAuWL5ZkPER/JR5cicmAlMRNhYHobQ59Ip41SvHCkPvhDRWTiBBhUexDyb1LGyucwHT /U1L60pmbZGBzndoUgaGWEN0AARWdUQPURMgXhrJoReATm34wB3fM1LyJZFQ2vQS+aIZvSPY 2Wn8VoC+lFJMKerGcb4aNiGTAV2MmrW4becbHhEhgOMho4ACLVyOoXQJH0GucVKVmBNKlTRZ 0dpAkDouTcc2CzC0KuIgvDYL0yAa6hCkCi8uWdHyAKxSvryya9ym5MKugPSY4GmOxp7IxM6O aY6kL9DU1v5AsmvcpqTa7ty0mOBpjuLe5ITqzmmOpC/slPI+9CLfxaZk+lULfP5GNJdeCGSf AiYEIIFyg0gKHgwggXKDQBIWFCCBcoNYGg4cIIFyg1AiBiQggXKDKCp+LCCBcoMgMnY0IIFy gzg6bjwggXKDMEJmRCCBcoMISl5MIIFygwBSVlQggXKDGFpOXCCBcoMQYkZkfQQvnlv+Lvh4 a0BpEvY28GBrQGkS7j7oaGtAaRLmxuCQa0BpEt7O2JhrQGkS1tbQgEJMaBLO3oMc92F5ECfw kUgNwwsVwTARvIqxBAtK1VsFb1GcAFLi5HO1RooUFiEoeLtBF5WFWhGUTe7TU05zOc0iWCaY xL8ALcJS3Li7Ss0akm18bHBik1jQT3RkbsFMJssiYEBNaoBNkMI7jDtPS4oGY70rJG6Arvx6 gzkDNUCsSPaAc/Vk1B0g2mggFudsHY4wGxckyaDOj1oEAtKHHITfFdscc1loMi17BjCUtTA1 k21qpR4Ci48RAt0feCIChA0SoZLHEHRmZi+rEUQSsRT8UWwQBNTklOqI+xt+Qwq+aYm6Eh9T /geSTCMbbRZRAwnasEZHFbcwAK5VWFZqFxqr5HqgBVdUoGZE+DiKBAQsYi0RNsT9BkIKbVUA tlzgfV9FBMXVIwcVDbZAD6rEEXt3KCZQ9mRUQy7dImzy1QSBUMtQALQpBkb9NggWFhQWG6je bFOIB9FEPcX4eXa1wUVS94NLrTgaMEpKpW3aXotGMGZgEAq226dbdevjF4FAELKRu1SefvvU SjMBDMFIigNoNRUWEhctpdUo2FIo0CAWLDQo8boMfEv3vDOtp4FgaZo639ElSuszFQaK/w2U bFPwbsAvBGJocQOkzTQ6xn5c0ujxPGRSdxGjzlE4qQ5ty1nsNk8frYkSq/WKzyEWldz9CAQz /XZSQL1wsIZChC00KkYdwnEGx45hYbIPHbKtT4mSPv8cNVd0j9BMhlBmyk5K+H8v0ha+IjmE c1iC+gYIGO9oxKhI4hUViE6iKYRJYGVP3D1frbsJuPUi0TrSsguPsOs6xtyOdvfV5i+tQg1z IXwXspw7ELIAfrs0d0H5L4Q2hHJ6XHsFhf5pqE1O9iLrS6XPj86RTxIILNoWvrASCjPbcnqP 4xYSShhaglLQ37RPHBYiYo1UQ0b/WexdtZaITEKcCgaI68tKHx0FuM1h6g6IPMGeiGwVAIHu u8xQbK4rgIsMhQ+69f5n3IZbKaFPSiQ0lYU5VtHZtrVu8M9SCPoNZD1FiBRdMe+wfUd+FVIH LVMFRvArxGeAzwEUwQyBqkMPu72tyQ9CKdjecwXA3kstBf3jqg0fml/V6kGD9AAOoh8dRHgg bUpYetuY/ZsSYcEUfEXe7cEyrFganXww3Vdt41Jl23gLYAPUcSU1EK+2dmcM7wQVKPytb7kf WNdTWoCsX/bM+SRS3cwzRiL2P0DbBQo7m5wgGhLMkIaDmD/qbhPp/RHQxiKbuTfvMXoJMp9Z dmHf+HfSRkwXxJEQ3XVUqA3FdtOdS4LjxPiZfEab2M3CFsjRwLiuIzZUYT5EFELoKWVanAiF UpgqTM8dxEJp1mPKXdWMx3t9d7H/CyA+9mokZhA/yEVTAEs6H568A3X3AAQ82RN61b5MOe4R bZ2NxkhtF50gHyvaA31G2l5PEGyicPsg/oXr2VSCdBi6LuT86Yl4VlJZ7MtqMpf/5k3xzGos dEImrJQVx71CxPhFdw1PzegCs9eJBFRe8auRq95Uaf5mWfP8Rv+8DkDb3fyyErX8s6QKcYc5 1rSJR1BTD5OoznWmTbZTME6BQx287bU8Gk9LORiBQwiMEypLLuWAb6czigFExvv7wPiD9nKH 6haJ1BznNpCtNlIyI5hFp54PqWevU07D7XDAPO63D9yLV3lADqt2b4kXNSx6ZzUwQq6BuQPo 6Z/n/6bkd4Kmg/XSdcJNdDKcAvcCV78RqAoNooKnYq+CaREWdESx5Cmyr8wIT8Qds//xyqTm hQTB3IFsxybTLwLreAABPrkcKR5oy4I/0WsURwbAUq3Sh9xuyuemrjNNOJwBLcZdDkRzrpOE d1LBXt5IYkvkHl5cX6oswnbxjKzUQDfZarlNeUT8mUyBv0BqI8XpVFUSBx2qSy04FjLPXcJW DTjX/633RIuPdNuFDNfYu6X2b8XpM2nMGj/JOAun/WsVXdN/l05azctPHio3L34bmL1RVSmR 2Kqotj9Yi6DCTwO5U4cLH4pX/41Dj86CZZQnTuCMEt3HiMh1yo/p0gZTe70pA41F/T+olenA iX9Y5WhGF00m4i68Fmw5Bq0ML01aP9P+gAzZiFE7WxEF3xdtNr71jfrrLdoHMAvm2JFVcnZX Ao5Oc2+Hq1eJU5YqFG0XZ8ivByzFxdHhBEaUEOQXgfgKz+IU1sf1wdg2lUoEubtPZBovRfNx RvsNID0BUl4IUXMwgZpbn+Gpj+exJXpnCqrVtYP6Ctx9E7zn2KKTKQofEA6+L1mWMfzWXTCM Z/rYNrwtcyiKWUekIgzOFUm2X6MKOALnqG5P65xEBXgTHS5MvrJFY/1x3RZCCEawxEEuU0u1 BlGzba20lAwkGi+7xVKzg08ViiC5cpCH3AuxzlcRDEwEmf+B7RdtzkenMgCB6tqQvhU3UfgS 3lPGOrLYs6UWvaJmDPhONx1+LM0kG0C5AczW+8JGVdvLT0EXyIyT+u992Wvsn1BDyU4rzVxa azFil8hMW5x4qKybsjlF/jEcwbdCdRjNXk2ztTghasdelZui96Nz5f8kjOVPE5AzBRL0J3/D lTPLnA0BKhp0EooaRAdoUDa466gBCGF6UmUNDgoR8xBmjmcn9Em2HmN2qDq6n/zJwlniz/k0 CcgnTRwl3XIkeEXdwh8rpooQFr15/4A46UTyVHwScer5lD1zfJGs9t2f/EEHLS0R68JTdFH0 xkxfyhhsYBPHzhEbiWRmkS06K4Nk/BBZc6wPq8DeSpuCTRw/2tOjPMBXJgcOvSt+Jr7XD9Ot 6iAYFlp8fvBFD2bFH700f39+4FmNAJAYfDvzK1W+M7be3QpDdDAXSXbbwUwCAzFgBAQGxo6h px9FqMEoR2lA/5LzygX59PupNqXmjqXPL3fm19uorCUKF1yU3k9yhAXfP7QABsgRHKJBCvhO QIgOFsMbnbrkVSayEpSU3hY0vvhHavDVGTxpqBztANMgVLUrU2TmBbo3EuM3ZpRV52v9vyrz htcqlPZm5qEvT6AlqxnjJFSH/+gG+ckPjHLFOr7ksSNCdfmPfQ0J/ItCI9OIeGK4x614uUMZ /t99xnoDtWDXzEbWrHowPoaTSvJXHj25/+vwUGi9Seft2MxdwsdMBqCQFgZhRVvCUlTK4xmE /cP+67vjb7FXBjobIrInm8mIWLsL0vhsO3mBSP359etCowutNJEHm6MZQMtYQs3d8I9iVJRk gVFCOn/v/blv6GcGnqFybai5x9tpVNfgz+tLWXhOQuUUj8dQ/+v9uaun7XtB9I6vgN1F/JO8 Q+wX8n1toQK0VEJ/V2E5mfU2/zv+ueBoQHbJKOG5lkaIoUKan9v7/3zsUVeOaWpI/bn/6xu6 Jsa5BXb3zrQpO4bHJlDQTJDPAmGki5ICF7766BD3/bn/68eC+lBb2rD9BdqK5mYD1Of1reFe eNPPUWDklRPenj6s/bn/6zsAx4UM4K60G6WjUhVKdZWEM3bdSgvks5F/OyG69O1HCbr/6+cb PdFffYuKkBym5KNmwECnyjd1iRwXMb2D/+tfz/nPZb7zM73kyEnfxm6PlWbCRmKCJWF+7sDr 8h/VemBXNbrIPeLD9WJ1tQ0rtdxCsWQ4AY6N9LNARBzTH1nbRwIDdCATC0UXvM6fXuoEDFlD GxC3ThFIf/RE5AmddEwfTIPbA6h67axfDc31nYPN9UeLyXcRAJzque8tMbDR9NOU0cLTkTvp cE13UMa5t4BwQyvnGbtA9uUd99dlBsF2swML42/nJZbxzPMgdsVuBQ/yIxe7uY/kCW1amyf9 /mGFiDdEzTtI11y5GhduJCPUrl+ydKvhLz+J0LBQdKUAnni0MjHPQl1NBc9Q5gmpdlMXwnRH 2rWS4PDqOVYMc1UnLdZhva4HVJt97xFJagggaC1pu3HKB7ivqJXiEsJhu6AN4yn0wV0G1fhZ 3aJ1Ai7Wm5X4D69l+tfD99uFNYQGx+pd6tcKVFA7yXCsF+pEbt2AwxW8B8erlK00BHzuE1Br QXDUFgdZBcDtAugH6ke2FwnEPl81AwThg18iHSlxFBWayn0Vd0UT6wDRSBT9WUIdAodK6+5w LLTxdXwTDpuydLQmvQaeH4u0/EkIXVcoa3pAqWQfKeQtPx6UFcXO5PjsX5Eik/pGTdEBiSRJ E3PZbALbEFc8QjfyCgryTQYrhfsdnZfWiC53+wYHShyoKJ8R/j28rwglHvT07ywVQ4PGuW9J t5UySyACNwNEMzP6ekPD08giOC5EEiesFVAVSZo8FOxuGPfnINAcSyW8WLIH+XDx+h/Gy0S3 HM8YnQQEzHB3FtBAU+8QsaCTSISLh3fOkANUg8DSEIlGf8wqFBMF2RGjBAdoE6gs0yR7Uwez gEJV8b2S6M8KlxfWHrcETM48gNXxwHFbI+tfRu59dgfdGDIBiy+RlkC9WQd4LxSppRzoePMt HlSJJCNu3oIOrScCARANkvzRrBkeUYvLOa111pdQCz68g5/4JHI3HluGWk/SvYt79m2gJpk0 bFoBDARvMUcEK2mLd0oT/61QVx67FXyeGVSyQymsRiIQZeFw64IIzf8XzAfEYil0Fy/NuykC Av+2iSRSQa53lyi2h4iL/4IQFAaqkjRCKH7ZkOlKbkdC9kboGX37YYeSkb1U6Vk3X88YiTyb nhIrx8Ygg6A8LQJcASQdXlXVEBdWWOMRUSn6zzsD0f5HKmB9rNhhVSSUO0XoFOznulz1vV8V nMhfQeqlYH50hr6lBgloH1cUdQt6Q80yRUIkTQCqFGN0nTDNgmSj+IpOUlAGfbj1jhvo+gGD ieGJW1QDGDhO/1O0c5vsMQzIL2qAF3R9GWM5fWO8eN7bkotDFBh0fWKXv2p0QnDDCtPXJ5yu BwOojA2ZqfbG6apMd+FRLUcpa9Wn+RkaC0bwFUZW5AIDe9wcD+hbq5LmCE/SzeqVgChbxedG /hcOx8IhmT2bGYOkDtI7Aij4YhlUhccDiyHMz442YnrOar7w3X5hvY9iCJs7bwr/LxsVmosR /TAeQxJt+0OzW3aqUYZCselPNjELzM8au/qI5htwJj+3taGV5I8Q8DRynf8BCcjdY5tG4ilA QZA6kG17PVokZwHNBC/tNYzpgFqAYoTCyVRDRIC5KmMd1DXiruGh/b0O3sfH6YOh/m2ArtJf ua0zLww5LL76AoQRF33Mik5S4d+ZDkah69ZJKjdP3WHQie5Q1Wg6LCPNzK1fKKwaO3IQsRJN BphxfH1EFoE2T7IeVYVE1Bse+GACdXYKdeEX3tppBhGiG4x/HNl2FFE/oN1VnBD3+muewbKb YoWAEod0QzgKmXWlF83un25TNBMF7RvEQmBLRp0ANHaGfz4bhyD+XkHHjRG4LRvhqw58dweW NfnHZswTGMzA0ipZZAZcwkBaChcQk2NCOxNLgCMmwMgNNom/xJmaXePhbS0jIQE25h45mHNP mFvbALpt01A+Jsu0cld7y97+0cRu9IbRHfPDp66vJlRaQRAc907ocO1S8S+qrSgqKjH2mbnN uoXFZnIQPZxoM65SD2AAFBSp3SI9uIxUHehiognIMD7kNZROaOwNje6OSQbzggbQgDu6RX+X 3OVLGX8KguBCewEIfktc5cYA7KnqpQcZwDz40ujiUqIv5fOC48DiKQ5GofGia0X5x2bfMQn2 yaewR8zFQvjHKvLYBXMC55AJHeawEikQsecQgKslAwGHKLDySDgQQOYWtXPhvqLzMQEDfdj4 CRsWYeufsN0AjkDRoLbjKUFHdM9Zla7Ki1QQzIAT+OGlZjVcCsf5uH1+lhCK3GwDw5K9cX1m zJz2rSQC2/Ib0a9RFZ/2qwKdQgBwMSm9CFOeTiXKWk7fXu6HchM06t9fukoG3xDH+gN3roQc xc3D0o+Fo6OomYj9BsscFWI6D9O8E53WUz+GtHk9MwARQnwYIsfJFhfPXZZtHdAfELk/jNis BL7Vf9pA4LqkHgOLYu/PK75TfsI2GH5Ig96RVpeYH28jVYoPChfRQ3PkwMUg6gUBGPUxTnyR CkN0PQbG36rQnFN3KaLIJxOxwrXPJ45YHUP2FZdDG3htZkWycGTGATLqEbMf1ED9JfZA0AGY VHfzu348LkWpFGRNJU0BbFG0by7YBZQhioyJbCclYld/GSBTgzf8YbWTQ3b440NuRu/Pk3JY PJ17mQ5xK8XwzgbPrznI7Cl3xrwHSFy+fTsSfgM23dtoDmUqlq0PBdWoYvVaZXYEiWrV+WVX G9G6F9WmQ5mQL7seVOM638JnCMsUjGS3bUnSX6z69UUJNFigx/RXBm2D3Q1seBtmiSByC/6F ruyNI3x3OcKzrUtYkrK7BA7PXMXUt3adWUAb/zikQxwRptI51tda4i54PGgPpNHRw35CaIBR 97YYntvVH0MtoiKmsquXFkBDnvbNHP5KghOGiRH3XW076IGOAo2rOO6JNsoADKxGBjEC1QRU dbaaGY5XU+g2BZwcE4whU5ROCC4jbHjqUM0HL9o1CsAkS9ghmKLyEPFFXlPB+MIvxFDBUBQ/ zDRYEhGpqR4bZzUqg3sGX4GfHMRBVADM+7YW2lCT1pZvlegqMijiE8SAB48qtOosshSiBXDD 7hgB0Fh2PWRegyyRXSmwP15codT6RDmBfVCoHhrMJClbIhoQNBQISejuY6mFJWPkvce9s+K2 6H0LVXZlhmEfPz6AghN5TNYDVx2huX3LFzkRWWMYxF3TC+klFRlkAunaPM7UJUxKdI0FtnZv VeFF+zkzI7ArQoNpAqepfKGAg2FXRrJ/SmUcFTdh1swLlfs4P8Xu6DetTOA/jVR+j/2vngZ9 2zRg+9MX1NRM9/DN9fwqB94oBeoIXGOLABJPQ4MfI8HYAnQZsz+m9j80CN78p0UpBoWd7ooQ RSoleVmkAJfBY+MR+ZcQLXKGBa8RRGEdM5zim5GKg2i/4NoXdj+vBsHgsDkCXHO5GG/1UhPe DYgiOoHgjEoIYJ+NnilGyaitIh4KGAAnuzz1awWJUE7u/i7Fua/zrR343Z6B7c19D+h9DCkT IoMeRlFLAxor52zwhtcdx1YjeBBGR9wTJloFXpMBc1AjTCQRZcORQMXDfLwkW3IcjlkW+24+ rR2fgTgSmg8VSJYEnl0Q9p05ck8L4sE7D1YLA6CpnX1I8f1LyKyhG0DgN/IpCp57RemiF6+f 6pZmHPVngwlqmcsqCN6yooPAwi8gUQMkgV4NH6cQw2JapuFUOfXOOHKXWRuFE2CV0XoTdsY0 s5Bt4kz2FT7bEvSEAmAeR6j8slrd5wkDBd41eusjgU4/FnqyFWIJGrkd6e4fGCFVwYocFqyZ iYYktauiheQf40kNbvqsGqZ5g9LuoMJbQ/X+qvuug/lhBwfb1ju3vVyBgsoPEhobjsUbRfU2 VD6+Nv8sYqra1d0gChwDQ3ynm004G480FQqA8d2FK833nEiJUOIBRHDRWKEnxgMI0+4ZLiZK n12LyX9r/Z0B9dkEalj0IDkmsFMP7sf9gSHNWu+ALS8SOlPVZc0dxu5PehkaYRN3LWY9Fzde T6+eBuubCVoAMRlN8J3EOl2QrTJt/MvS36RPK68YNzHCauFEO3/Txk2Nf0iCZt37CTHeNwuJ hDRBks2F0Bo99V2oUInSLgGv4TzpM0QaiWhVNVSeqJYhC88QRuawWQ2xFWI4A+sNpGApXKac c+Z7FA+m+Q2oNUnjnhFCTDRdIhdBn1hD1khS+gwIDoxqXBNMrHUGEm0/X0QbFDhDfPvVyAP3 CtuMx4s7kpOAQ8hfrpVB1E8Wx0W6Ty5vBgWhl07uwwO+0hiwWzMCn9eeGzwXRHsMUs/INGJr 2frCHzkNi2V/DLQyw6o7rVElEpZqrEvfbyXlTRAIV/cWkjOwrK1QglNcaQ8dUpSpVJ4K+gjU L8RGxBlA+o9FML8RHDMdGEXGvGESDPQGQ5ciasF8TbxIDW1jPZ6gQX1akWDIRVrrw5ga0dMO mrbXPwsw/blJEAMYON/OjsnDzY7N2tmeys1UAu7r2Jrdyt2m4fcCouVEmPYRhIJ6EkxmigXN J3fAC0nJrO0AGA9G64WLJfQd6iXYzhydkkPIHxLVEVvKIRNNgp7BYC3ueD5rhwriWWj86BpX /Q1eXtzCSETHC9M5KgoxTqKF40HQEltFhNF0sxw6Bip/NndNgG8DQwWF6aCi4LV93jGCvA0P Qa0FnBYGWedD5u7uIDPwHBWXJ3pvVT8TP8p82a93g9TcCHR+EFIRbhFi01XCHkzmsVgYPUgU zVvA+AE1AiseBV5u4A07nLxZgha8HxzDCO8BDev9DwJ8XcbF7BwnHgYaEEJvhY7ihDXeWEEc upSjI8E5qfTFvNaeAH7IYxAGF1MaRWL0AXfBLIpJeKUakkZTBEiv+RSWdnwwd1meFVoAwAq4 KcR1RAHWUDCFvt0sBysdf9lhRsuhz0ZSZUsGSjdxgfT9cQpOSmHgrQYeBicrtFAC8RdCl99q DHwPYS1vE55MRzpbbNNlfypMCBa6XwHj7/EXdhccOC8Sfv1hDssQ1elWDfsFZ0oWuReJ2sOo cOgui+YciVxFWkocOJfCab+YvoQIWsKEBEqBoDaeCnKXsft8CmEyCEheJwhIFOmcsl4YiFhK c52XI9w2WtOKi8H0EiAFnYG2+ZvTGgnnqc/Rvl1VUEugS03hcVDbq+lKigpEH97K/Mb7NHa+ tRQEa3R9Bm10ciYYa237PnR1WjJcJPBhXQHTrxFb0Gb8z7lQ2RE2xuskE093ODu+dzw1MaEV TEkBzCtfdfLycYDC/IsL9xAfMeKLdN3p/bAOUuex2GryPu5PK5jr+PyDJ/+++VAIMRd1JXaZ e3KidiMKUTALE9qQ/XETQ3fEgoUKSsuTBEiHuf9r162p11L3/54oBIT5dkFAnCq4yWHwHOB4 ExPdnAClUPYCqlvj1f8GnhgEWxIhXklh8WRS0/oTIyfZ9SRQHsstAcZBNhUJY2W+DwXUlQ9t UQQXJAVCf3sJnryND6Nt2hrFQVfP6D1HBGigGVGEEAeDlMmMF0MKJjJFAQFIQZ5sBdUQvtyn MeqLVDDyzRQAYNsBckfwy8k3ZrVyICXU/SDo6Q9V05o9IAvWZOUUFKi5p7NRCUZAVQdSUV5G uBHXc/ZwXhfQawYSXEZWCgBSUhOPUMYLAEJjKlPP4d3XTTmY2Tk70bAQwM210h3EKA5ykjHd 5c6Gd9AHOaMe6VUQJxxjAvK5Dp4KOBBeiHoIJj5MgPPdM48WXC7DeEHO2Jf0s6q23sD8RA73 OwLGnn/WWhtShCqXgpz9pKYrVp03/VSGi2IolDZy/s8RIQYCl/1iAhH07zmNETLmICgaWqPm GooAQb7xoFVG7bor7UrQPp/JZMOpzUuYj+iNzNYXEV3zH/BwYv1BnIukFaz9A65PQvZbyH12 ROgtxOv5O5J0CVnNCyRvvT8c4ECLbxbPNCwNWte+xNV2CHelu5PIAQBFjSvTZxNB/mYFXkHA Ybwh6+PXg5bfa2CfE6x3uP0YBV0MvjmA5uGCMwYVqhac5A31Uf7RK6LxOJ/WRXAj6VEwRrbt xkcaXOhHlt1EvFhCYP8GBxKLQ0HWUfdOw9QIIgrUF+NNYFpTfF3uIbFLY32s8HXSi2S6fKjG X+Mpeol0O8IYB+A2a3vL5rBT3hMKTnUcDkqXxNIcejQPmjXR+eegTHojAC3SzQsGp8X5RHVR bUBd5haSiU85xRwP0FXg9BndskwlQ5HRukxy2WPE0ktCG1OCtuwAHgJy8Ol4TV+HDaI0KMNM NG87SEWBIPahmEdFzHZZ8t6oW3wAueNNRAhcA0c/ag3cFAvQwf6KNUlNi7QdaBpP2sbbcgv/ F3JjhuVEUMPCkgQeec1Zhv6hE8cL02O2D/Qz8I6xtQEaSAaKDQE4eAo4Uu7y9AQQu5HbuQwa A4hPYfMycwworbX6sLJbQF5IBiYeSuP6S1vmj26ARhYxCVBayuuJh5NSBgzeQU10ubCT5t4c 6w8rX+v8TffF7zGrBk4DllFqUSxwnaKzJUT2goWijET/cNTPhDh+7/V9CoFBQQrfiVUOvgoM QtIoyzg906AXxhpODloOFBPvaZVSW1gk7EdwbI5RERwpV7eLUqJY1145Ab8PuKMx4K59hEwX pBV0Vu63dfuovt287RpWgjNgbXFmD4RQUCRWLAIJ5ovWIoSxCCgRR+CjwYwlEE1Pi2cGU6iC f+UYd824je6aVz/drgcBlDuvdBhJtjfMBq3YG7yGQVXpjwUab49KcXl1HIQ3wJz5NhJReeOk hoifqr4zExQf9sxIazpefB0bvKX8BX6PHC6Sy0AQBAvEB1dgEus6pg1VupghhEpSdHqgaRwt c+KXaAD4mhZJthvGrAplLoCg6KPuJxfUg3+wYDUw+HvTB9h0qs4pLnVmXGLSNnTLemY8FFpT iFBWDy+mBMPibkCwChQetFkuAzAeAd/27RSpu1Ao8jINJLKDb5dIRKtlBjOGDxtdUwiFbq0T t+1iH1X1d7XCsRihfleK67JKbLSvqC5qiCkI58UBBDPdvqlMp8EFR0ItNAqMcxovimARowUH CB2FxgfFhnMrEobVTHp2WSVs89/qaFBHc0+B4XhkBuwrHEbl8XsCzFkRjzcJnce2tERqLLpX i6mGK+e+QJcQA7wX2n1PO4AGH26yzVeREU9AkuwoN3tNanRRfZoz63eWs8TuUtBfd+ZgNp5W CvW1B/+lOyJC/HFakwoXwueEK9gUM4hEQvUAKoWWwI8TCpUQh005HYgXcsIRkVshWVyGtgeS LrljEIVwFJZyCItrUYFC7k4B+FvCJ2ocQxN0ng19tOshflpAV24BWy/AxxNzE7w0f2hS/eQV 2afbi8tXWGmCbgjPim9vVv5WDsVgEP+pDRq215S+wwVbyCBEHcwJagUE2lSJBWzWUOoux0gt WM1kMC5E/M9wh0NJqNr/9sFw2/Jgk0wsvV8CqcBKq1a+Skg2DE6aHkwpoxYbX2SEKxpXSCI5 yAs/DnRa6SY2YDKtUtnKicgpLGLrLi1gu0L9ues4so7rPrKP6zKyi+s2sonRGxj2EIP6udf/ FPbO/xD22P8M9tqSsp8Jti5W3N4vZRpUEsWYEtBnqmgPZQCT4+btKw0LehvhdTxgcm43ukPY NKkKHXFIUU5DVIV9a3wKaGsXRFuB763/sy6/noP7CWd8g6M6wEK6s3AikRYY1u3+2Y1TUjx4 SVMa9l32HLhbjmofQVX0FGFaCaLX6CimCn9w4RISQVCA8TGUiMHvghrsBTlY60gi5WlvFUfI 7Eg0IRJfi8ztU3VeRMoGSP/EEzmrlkvuuQDcBAYBBR3s+0LrRLd1VU4JChwTqBQ1S48yQSPE 7L0bWqHVWKK0R8iwH0rsf1NeAGrA16xR+mKKTA7wiAdJG9XjCtEdoKaC0kPoTjKgkL0r9NiE dYOISoqGCKoqAqFUpRNwxeXOJzV3CQd2izmKMRwWMc6gkbFxXnsXHWilOsFy0RuGQPp/CY/d kyK7I7xRQX2qTviFssZ7MNV5gMlZ4RfX6rnVBHepiTJovd6gGwFenFIHmzTx17xOxv7E3YJ2 JDzpWm9vVzBsRa50CfAGfcUYioIJdkv8ghZfLQJN90O7HIXEzHcWR3aKKjaYESncFtSfbAI4 CW4QwYpBiOcf7QhzHAIs0DSRgvR3RYcclUMUSgYzQnpqzQQQT0EDBR3Cjl75RV7/jhaotCFT E2ci+YkUmPhy7yJuYz0id6QMrrg5LDFqOS0izgAvLpMQdYtp/0nBySNcBmWQ/XG2wNINXDGD WWqHBUPFHFC13VE0VHEcBFMUG0JrZUe13pJDPl8XqpAGg8PQ1A8AqYt+CARCtit+Vv+9FWzr 6lxOSlJKaQ5QQgP5gMEfrGBDjF4bwwwxj7X/C24IxQIdXvoPfATyuQZacFe7VN8E+GoX3+T6 s/nWnxFvGtMBSE9FD10IPCucbPysPe8zJmdBaxgSQugrKOUWDBmMH0q6xU8jTNEZuHCHc27G fW8WDUMeQAmlpnxvd2oQHRB1q+wJEk8cIpwATQXouUMr/DOaBAQCYQRPz7jEnc3P+JubgbV2 NRXYg4u2lFcmZfhFMc87exMH11b0vlDNP22i3YmNCbzpIRhkAQpO239qyO9TAoaVXRVVGz4C 0cPTHHgZxu2gUgWVL3XtMwknGUclCxkpFgVIU2QTzTZudEc5W1dQzxhmMeTiHimBpU5uLjMF IxQOycgdqQQeIwQWdk2pkinOsDdIIe7pbwQAndMcKcXraM47LzXXoe8UZi8yZgQ4FUMEYAyD Zs9dQDMc6aIEFgB/iwDPmDoXW5b/LxkPKgjTpFcwT3B7v5USAuPT98FMXV5ffObxMBGjujc2 ChV7V0NdOp9YRBEt2zpXT4Zjas3m1G3FxFYZGhcQuxEOkn0kwWw/e8a5I0bG+P3EcD/8n1S6 AQgoHKPuTOjpuVPsKL/tzhFEiFtiUBpQnnTxO63a8QVhVX59ECxX693uOU7fuq5H4nvVNKZ1 UhHTncwYqprDPvwXRN7HFtp9dlIr4wXuYEVTGt9sQC9aSa8NTb7k44HMRYXIr1CdyBZoMVW9 YUYSsomUbCSUBEgH/INi6gRrWxbzUJ6rcMQENvJL+UfOItVQiEe7r42+VwwRv10IWkyPYpTr meyi+UvpOcTEybgB6gBkfIMt/+JVumRUrOK7TEkkWaoLZCssQ1FtPtzQLy4EVoH3ucfhBFnM 7hE6YcE3YmYpiCk3ahLNB+ngWolQ7EDdZga50HiTNUZndxd4qaSf4ak4oBXD6mVsNDihVQTU NsWFdTdACt9ZW/4rfQAr1HZri0wkDHwPO5x9CyuVqKFqUVBoG9ui549NPNkVDhEf6aNJF4Tm 2f/pVCQAk8xIRsGZ99GP3Y4Hj3ZOaCh6fTL8qzdVMW/xLc04AjQrvwHmj0I66GpLwWr4FO9b ZnKFcqWohkL5CsJs9TGHRqtkT2kAd/8t1QbXn2m6gx+NmyQV6HRYLdpRiwolHreGecsUO9Fw qhX6CRSYp2Qi/avDrhGZhaNTUQ4PGQhHdX4h6Xl5LhahCWhHCTviaAGtfIfkTMCQcOgUysID w3YA/ypZpyVUla4lEtdnLfML8aMXh6IV1tYN6CrGjxJToSaOQurAcAzTFBZdVjj72RwMz0MD IGJSWs29fi5Si2T6/8kcEMUCCPfzMqJOmLyFM4lWLVAY8FEisP9ZbisQDY9LUgZZsnGWrW7d C8crMx30HSCSVQI3HfRHdyex+wCOteCAEAShVs+qWosxQaN/xEynF+sKEK+CX0vDtwbow8AK 5ryCfbBIB40Cx5lx954ohTm52s3FvAzYB9x+VapKq+5BGnNQhCWCeFnTy+aWxkXH3WNRzKcU j3oMUeHjPWgIQB447uCuzERUDOS7CX/4Lp0nXsSNs0IDfYB4jyuB7LRuBB8yTwyivvr9GXZw BBp2CQ9gDVdTUY50xKR+0mVveXXUWPqtRR2LDQQWCuM2SrRKEgTtrTLM1xl24vSALh43RVw6 sQouEn0aHE4xkej8X+UdDbaHhHb7UzDkfaJQ4o866T3BjWgEi271zkp/TC/lXdl33xDVxzMq 5m2cAFh2eXSIvswqzsMKyEhMEqW2WXMJAUx9TPNl9BE2nGpMC/jpPhkTaQ2MiXAsFnCpJxPu 5qtBkdK58/9QSsncCSEoIP49xcPotEIQUgS3KGmrDxofVnF089oIREmEwwtLQcGRfeLo1IgH AZl+RyJ7/mx8z8JnREUBQinVfNMrjLOTJFTYYQvXDMRqA3zG+RrJjcvf+3uA7UvG+UGCv3Ad HQfNlPvGYwUVUj6Qh0xd/4lSBmLayaoMR6vraRKhgyh7Iux4jy20rBKdIBiHHb2otkQD/GNL m+lOhgk3a362UBUdmS8dUQL8014nG1lYaAggHHe4E0wiG2lZEmWeEgpm0pV+MdJwCOOHH+k6 Aaw/NDJmAoRZKiQAiEnyKM0i9ldQJ32Vh1oyhZ4adxOEnvWT6gt1+hTBkwhmLCNw7q16ubgh 2Xb8VRAEZKRPelM+G4wNRByHrzEE9U6dx+kBWQMjIqw4A96eEH9QvsRTA1QHFs6G1l5FRRzx kiMM+1+0d7gWVTAdjli81xeqrY5JbkhBD+xIEjufS9JjYIxKtyJXW0flrl+MEehuzwOjzVRH HhI9A37BDG1/AjXPHCAAyKjBxuDcdgAThp9oajOeJIqvzHNlcAxHPD3dKV4GwCcQ959CqhCG UlFF/160gVYsilZH6ooQ1Q76HGoajwYVuYGp0w3vgMLu9hATNvoAfgUy99bGMyiVqxfcPXBl QWdJhpu50UEBYRu5JeheqtDQgSDiVOsbDMVBKGzXiPT8QJL7xOIDwDgrKENmlTodOlMXygYV CmC7CSB86/tFrQhQxvFCs+rqLy4KNREXRBctpgp5wx83kWwqOFIGKkMWEVGzWWTmWsOAO2OT LB3CzwHVkc6Z/JB6uB0GzpioYcMc6y0UFQkJdtiEXqIIYXYDbKQXghcFxu8e1xdpoZo4KtQR bvGslhQUyJvofWuky/IHIFLuipGfm4MeIPzPKgEgLfUFQk+jb9VM/xeQZ9u+Wic+LLJvcjwh Tpi7dwtCb5OsRVrsMQoJJhh/zLYoYgLzzZRBTvumAHfRcksW6zNUa2ymCV5QR0/OgBUWfdte M8WbKP66a3dvTbJ+utUDpGdO15JDUs84JcZmJzxi3NAkXwXxouk3OwLybVnuqMFyOZ6GTA8C UfgzcSv8QKVuo2S3KE1kGiEiO94Yeaq5nJ4k2Tx5qihFcJEBwruczcuAbP22DWiOa2SYGV5x BB+2moAeZewIPmb5ZkusdmT/r1+wnkDaZOwscGValjGJBbhhbGxWmgriyrKBqhCu8kaCjxam uZ6Al3dBUI5ZmERXK6uHZZVvNhQ7HUMZCSphyscw50DrDPILRoQJDP9Ed0OCmUJBP0hCUAl5 U44ya8QWtWfPxHki9+MCVjFqaAspV2QuGLlwGADIFJUK4kyd4CbAZxPqoItNLh/Ujb+YXLG5 6lXgVhHJPuQZURbPkKnN3KyWaLldH+hKIF06tgWSIiQas3qbCRPNLBvCVETqpSG+cV2D/1Kf agoLyCpNKsHAiwcHiADH0gp10R0Ctc4PR7mqfDKKx+NvrgAW/BaO8Jux/7mgW+Z2VMURKCPk sBCAfZK4ikO4YOJ9/WkfsBmevRM4i2RJr0HqRcJCx5+NOSmJfqwdzVUdinMquEoW5WrirV7r CRPAw9iLceTIBexpkEJGBBY9Wz4oqkJZgiQLUqhnUAb32x1WYIhVvGL4FjjfCylZ0UvsFAVp SgW5bNnAU2RcP2NCofjUHKxnTYQGeAGFU3htEhEOAzgu2AqmFxEv0E3qIAGTFEZj9Rr2iRpR i8sVYsCO/1YTCW8bTTPmvBpBQNA0GFSXgEIf1I8fnW8x6Vpd+hOLp9omidyYErY01lPg3wRk B6uiX1GUQOiKnoItEwwiMY0OySAYKklIXQZX7xH1/QX4441uDkDzRQ/waFrwUEZVgH8I5Cvc PW0GAwclsrIebRQe6FgIurIcGQG0RKVN30IIoiCMAQDKpAW8P5eHNeWF6+Vah78lIViKBGYa dfuZQyNARfbW5xlXBUr0SNdnjs5vhrYGD9DVckhUU84sV1LYAPuzuxURzgJx61ey8AXd8Nvl tT6PZ6RLgCxvfgdsE9MNnANKAE4gaF/eADQYoznHbRyYzOqTQUcSHoxR0cOwsd+lxNECpikz /JnGGiZvvCZnd3zLOOxAI6Kcmeu2HlWk1lZ/5buGz9i1TEIwMhfEcgp0m/9AovwBs5k/bRNg Za4gC+AotLa8bYQu5AY9dcP4/1l9DsaQN3RcNFcrPaTbBu8iQkXdy0TEWdbED18NE48iPiVD wEtbSUx7bCFQxOlMoEiZBxMchGNBT6Q64AeKceN+2IBF+gLsh5SOLknqE17I43fSaBUI0AzN dlgdpBrEHE0XNHSwThTQBVck6AEKfMza7ChjdM9RiXtV8howklK8e1qWHS7cwoTodu2LUfqA VAAvnRMEaENF5wGs3e4gk9Sinsa9NFaDJJaj9NOlP7YKEexqnylJgln1hvoNF3MNTdhITXQ6 AUk05LGp93ULMm1XPjIculEyr54MngJ+RFmO9AGfa6hELvaaJ2ZBGbBNcuECZfBPDlQWR40y d3VwI0BFGhADyUOMTFPXNRvuF/ZZCyCtdfSKXhRb6TAA1/XasLy1F7S3Cy5vuIhVNR6hPpu0 pxhWhBnnDxHvyxUhI/w7j0d+ojTevcMZXh0tHrIdWRAtRVvWUlLZBABhI5S8CoNX2wlU0B5P iUxTB4NBZH9RoCY51hB02SHAO8oqQmpMAb+qPl6LSZAEtncKxz4iNGdLq/ZrRWRJAe2rIwRj NkhgU+NIGHZ1fRdkzwgV1bJ47gcWO1uMHeWwahpyFNQSGglLgZexrY+VAO3oycKepGAFl+u6 okByVkJgP/OCgm6jHUEoaqICiZQ7GUQAEaTHJLJE/tpglJlCU4idduOfALlQHAnkxQKKHVEH hXqEP55RfQr9QAZRiVNPH8VUJ7wONiq3EreM3ABRUgyObGJWMrEUvkfzbHDqCghEBUPMUBBO CxRbGhK0OjBPKFfJYBFMKep0QgsWAf4jBQkSyIP16BfwQl2UDuAAMRn2qeaNWwlubmHGDgUx x0f37wN3AgXysOv/dVONFHPHeGYYhi30D6ZQBHF9Bp4OzrfPRGwat0DPE57Dhf2JZkJEGbJc TT/d/tmnHaoYVHb568pSMxZMSald/OQ0tNIGV4lUEnQ65rJkukwK1pdtdEgQpU3ToGE1Fnei KnGpywusP4d+93qcpk94fPDUIja9P31RR6IAbmoeVYJfxpW0vlM+wcufrBK2/hSqAAetWsRA v9TfWOSNebj+HHpHiB4CtGMDxEGQlgDGCUgCQmt4gohYJ2IiE3B07M/IyBbEHPaL7HGTGzeu njLxPQhIQ+G/zBCGppED4n4ZcB2iVW6M8zwRwO7UbxQCm1K1YsF4b1R4fxUhEtWMW6VWtmof BELAOGdYmjFQMaofD7QrTHJuovVERNKtqFMXTgFj78DjpFBKeJl/urY0SgMbpFO076Win0qX P3MAYAq53WM0fustl54BFbQ9IxAD8sAchYE1d4T8B1xSrwhwVb/e4uNZ2vwuISSlw7ZCBILv qduqV0CEGvcoWRFEl2PXBiVfIkSX6zUH0RAgEgBndiI6LmAnZEtdx0YUK5wXaCLIIJQWCREB 8lvc8zKLWg2USwlksEe8uUJgCxW3PoVwF3U8gHGPIBZBj2oeOvYnNChGq2e0Q3IUqe1cXyJ8 WVxn1uykYyefj1beAx+G1TANooXUTa0pAdEkOsdVjwv8kABNhEaP7Y4w5mc2HY0XgfbvYHMG fs5hko3GXFYlgvzEJ03CgkpuDFv6+4AEFt9Lr8ZllyvaxW3svURoJSlXBcgNJzAmqyRzN31r 4O81U+/7ORxgYAlXJdHmHzWwIiBTsFJGLV8eTAYwtz3gAnsfK0cbEhuwnPcTUSAeBhjCohnw OUFWEXZHTS4Aaw0AnjvAp9TFOUcHSQST4vioS1bs3lW8AmRhi1uk7bybsECkO1j0VkJMB/cz 70QRrAwifJR/EwGuYEa80FgBms0NFFPVPEVextjK20eWTAzPK4Jk/SNLBsaYEhI6FArJI2mo GscMHODgYtjH7oQnUml8PIU6RVhWDVOnikGqjDFAbCZ0bMcC8SGOCDs0fzh9Bn9MfdI9Yu4i btdWFLRYU+ewpc6pbPCDEhVMi4BOGOHWs3EYClU333THBwoWZC6ZB6ADDsEKDNBzBRgcYlMA Mz0u1kLzQ9IUbibFOBLpg673kBpeoQ5AVmJ1jB7eD0SSZLRTVT4yqBYQkXKmvwlAfh68+q4Z hEhdT0wQB+ULcL0MsVxFJ8GsWxnwXKQqF0AOFnuyMwWdD1pCwNch3MXMZQZhF1oSvKdWBob3 eHcJfE17oHhDF8DZTkQSUTZQ02ZiyxNPDdoh7DR0qj5JZMW0pI7wXh7QFVS9hUzhHM37nXe6 eBvQqK4v6UlME4m1IVUj0KxetchjX1YLpSc2YwgJB7k48AIyFAcvzbyXOHjc6TcLDR6LR6ES 3oAAGns69HLJbLOrjRECwwfTGtMLgpmOI04PkJFh6z9Hoh1EKUKC7Zhbr0TrO48cUlcwhhsw CRyM0mNLIWYgq80ScIywiIdnlCJ/gn6KLZxe8DuQ51gA1UoTfL86QrjjQWsPcFYEADTBqVQl FFkQwBHotV4E4X4eDR0VWGNZdClrEVDUFCEcW6ftrYb+6kQNNj7rRlUVpll3Ml9DAlLwDDr4 oCSPNhjjphXAVEODsc5yS4kegK0uDZANK6iS7pIdOwzQvFtHZHCS7huIO3Y1B8Ull0QWhgOP WRNQvoJEErOE/ZBsHHbIcHVNmO2iz8pFbx5M1cjQ0B4F8VO5ALZaHLk52TSq04IQA5+bVd91 i96V2SM/grmwNTm4cjV2a/0NAD6tOSVoN/hvK7EKPrqx6A0Ar3c+0X9djRGK5LJl4K8SFor0 9YT8WV8gq+y1KZmZTlH8EkVEixPDrAMGZ53aeQVNBF7dQwgcDtBlTZRhEAAcXhxNlCNZASJi DDxJQ79RCDkwXneO6FUKIK2p/ihtHgWfW7ftSQucBbjKpmICF+sXKK9hsc2Fcg2R83Kp2QJM 9F/vijCGJOiSufzmrMt364k7DD/7wfc88gsReOMDqBd3a4vJVIsBGBiOARSDGOCjz6SAYOl/ I8V2o4T9KsL2BofltSP5DkJ4h6zu/x9s9lT+swXp74TLpg64B1wmA7lcAp5gIxaOSD/D6VOD vK2wX7TLX5QspQ2eAM7XnuzkEStABfAO8yaXNhOlLwAozEKmdh1BxwNPIBavBizZAFADLQ6G W8OIReUbBHDR0gFfeIzytlsLBboxUVW9zu9MD3gcrugMsvfyw2z9ZRvUgY4B5kFWI/a5bng2 s3KKFYhQ0BSU5Bg4DiBZrgSwCTYAREW3W9AYFwFIK5+f7UrxO3V909Srg5lCKRkvBwdGW8Se IENG0GLWEjyGHFEqC9A1/TpDDcMkL19WdgSrZOBBmMOOcQlKzUcOK7EssrwrxwGYUibEmMWT BlKL/wYEAh8nLDV5krDbJ80ssHOJNYbAircOFl5jfC/bMBGOgT6pJnXPMlU4ciSiypsQY+1d TEwv8KoMR5lqTBXbKhYHDNs5RQNDbajBdzBBNbXGl1YFBgaiBhrgNHlwZeeJF4tYHuuH3WoT eYUqPsYFeHwzzcTrN0dQZk+xZNj+UuwWRO6W5l5OKFA1Q15LWTYFvAkNpw70Aev4vOjrA2p9 JHw+tATP+oUoJuRM6kUdenmN5j9WAP8TQhgG0uwPpnhFEB1ZbNVfR91NEEUHJ3RHRFlDIT1h XkaIkygYCxUGmuit4gr4F6xTqHGuSpQoREe83o7O42RseQssCP47nO6wRnl2XWYvgJ/b6LDB nD0SLpwRQml1iO7Wm0/P1ZZiWFZeZI3ekJf6S0IEcJ5gWCor+FK2Rs4Tan4DVQgslmgOmqLc apEEocqui7Qp5BuJWhUHlHzxCn4BuN9Vo6Shr+srVcAQvqBo0zY4PgpedU0H8o98UK34pQwT 0QDCxbBnwAcWig4JA2q7I2F4ys33HaZSJdsiJSVE8II8DfuNHDSJCxziQxdXP8BeE+b/BFUI Mr0GzQBoVXQGcC4WFPQNPA6O2Myz9ouykVRHGGd6g1hZ4Wt1A5Kw3A54RM9mpcxCDlg7RI2U QIAKHApNikNt+SYbo+ppqqBRKkVzEIJ0BN/eKQXINM99/FXWjS6z89JhPVNzQ6r7VAGy88kW 7u48mIJ1DJ1EHGWKAFWBV8JG7wJBVmH/VK1zZBvqdU+YfShhakX2DGXW7XU+AnX+0vqZZ8LW soBlQJb5g/trcXZZU+QPZEePWbLBcQsyqkWvx4WdDdDwoHHSm55qzGYldyA2DKgZRTBaVhdU 6SgvijHPEFIDsjC+OEKsBANfxi5TSBQLyzVy1YHIFRH8vxHlYnIe/GvNF/KCwaF5ic8PewbC p9YDFJZH1xLhNzf4/D6LUesjbJ8tz0Q3LIdBhRs2jypqVWwUL91bza1EY9bvJU9JtMQuxkvS 6cudJ/KSko+iGXAj6Tt1EHM9Bpkg1YQWp132EHvhZRKxJZO2Cso8A0HY71G3dpObe0DpDjtc Brac6kYUDz2BvnTHnplcIFdyObxl+CkYAx85SM9mEU0tz1rv9vMSJ35v+agZcJnZVgq766KY Lp0gSiGYfgu11TyX0oK+EwBVQ4aiJexTOZZXHZiqbiEaAEBnzi7dF5mZqZpvwgQXQbo3UKYS I9v0hxBgasfn+ZhMiGODI/wSsADXthusUyrSYngH7kfVzCdewgwJ992wfbHQN8WwxBfCEIHb Q8xiS5ALmWp0N/ekq7t2HCQyTzfVsFRJgG6ssUlKDQgEEYPIup0c3VrHC0czClaWJcdlLGJh 99MT8hG8zLCMftcGo5xDyRGoXnOBc4ZrjpLmxtQmIV1YsCZHELjNzkZVj8pkExT4gF5U4AQy U3TB2VFCgGENvmhjgMdWJw2JNHii0Jjpkl5ZRFRB2UwAHiDualCQBjVVJlp/TNz2EzPklEpH BBBPAMCUYcQQvWfVTpPhR/B8RFrguKkshdu/TGf4f7kEhwnS7T90upPowtgCFGrUnmNS0n5R XWTo/vldx9X6QvA4qDxhkB7TiLkBPHxKOaV1tSpMhu0MYKM+ol3vF2vvclG8T00lDlqaxLKT WE9/CPheREj78TkhShAT0vARo8xYHAQE7b4w/LpVEjQA+xOs6xd1zxyRTW2CDgBP22QQQiz/ Si5ESwOLBWMII6EUrz36qDtM7s+ArTmCmUm2I6luwBRv0En8AElWU6g1EL8D2at8EkU8HS+H /XzyBlBNaK1ZG4+WjBhxQ7d0fyphecPLXEJ1WKfwkiBBBgNkunCDBHXjC24dakBdwuNaPARU irv08BMecRzpyHg3iFsw310vyRAAGzYUFqViK5s/kbBEGWh1cS4XdMJ2iprp4wsIT17pEXbi gIQDo2v7QhdiTApLCDqFym1a9lSsuJACLBgtRXdM0pn90oKZb64ufRUidl9663TX6dEPTd0H 6AvDXAQaxgThbt/xCkJQtBq7uHY5q9w1YCrvEzfUlAwBPgIbW8J+3Pt7BJax3MC3mIYHeIFx COWa5VmgDnewNWTPq25PqjkuAHk1sx72O6djQtv380GXqKP7S3xnm8nEx/vGMi5f7tOjGThp QdxDuAccrEwUBqxARWFiEAcCopC7ZOiOs1cDGQsFsRHeYJOYW9Ro7A+v40xRIoHUKRYbOEt6 2hOTjpcvJ7NLuht2o3nFRUlncMRmJGs9bBjmdV0mJ0KiW0HzqCsCe4Ev5CYFnDpOiYCkraDa fxPEEwRQDkAvhBPEl8yaOHtFFSQm4VlNykZ0mpgosk3OVZoMmzQPlEgudBvLnlhQah1qNMYe PoMOgknbEneLQtIwshyJzNT5XBWRjx3Qj2YFTi8Ajdt2G1SvA34AIJS2EnYUZ7VExLU4BFkn aGqoEulWRqntydWHxhbMKB5d5d1LGJVFmI6a3Mwm3QxljjisCYJ7pHmNFXc22MzJSDjZP/nS zE0R9lmfZiGLGgF9dBLLQaOGFu6Cecd9wZ0CXqFuqSuO7Tu5rB3ptZLqQBW1/+nj0NeJpYv9 /aaNvlIiBTnpCBDzl9lQvhtV22lLUsV3XNJyxe/IErEKzRSJD92UCjF2PJGcE9A1EAzYBglc Z6rZbNld4UDQifYf63BaBgE6nTKJCV6kCVxVrRLGGvneT45OGgVrbAHM/5EgLXvcQE2DYoBK msWctaDRuxvX7HrNkFn0TkhW+1A/2GA7c4xY1QvmR+x7Ijsd9wOMEQ8s+pQnnjGtldnhVhc+ MyIuNckb7RuLGZoxr+KIdJkEDocSPBIN9qLRg+rkiFqVaRparD2KoVcJmkYnRfax2F+RzffB iwz/Y1Hme5mfy+sDiEBGKAj/ggUD4JX0B4f7MSLOA1eP0x50QcXACYlXfR1cMKG/ZH0uZsxc jZHtJyfuCxcReI/LE1RZKPw/233DYBa8/2HJI9wcWBvqPxM9FhUFB89YkA8PlosOHHKzX647 jc3KB1h1A9IpSdszMlqfhDF+NSu5xk14T/3k0fRadBq3skaWMBWK3kUtWr5vMBh9pbmZ9DHC Szbi5iNFglNM17pNDSpXhlAJTL9AaqXm8LzWnj+tclfadEoe1jE+2BX7Jz0QRCjvlmBaa+MN A+FzrDKSIMgO2XXNCRIxFddvEsWHQKDnXBUwXxb4C54PrwuXW3iF63R8YEeZSc56opb6DVUr QKAGLcZfD76ypEqtU9wXzzOdKcq+pok9QwQDXwh6UotqTX0RMOLknFuNdt1ZTxUyO3gVrn7s IdmwO1s6IogKfY1HA01Q9BZ9E9J8DXj/YC3dHwHRU0sRdfZ5FTyp4HFKA7REbwNCep5LycHP A0T4FRZG8n3w4EiT1oVBVciQ5MGhrFKI/yL95nhowEV6hZX+7Z8/vUAFlXGLaS8mkYWDqvBL CUPi8OfBRczNxcfdd4bFLkBDKffmGWRirwXAGzQ8FU3iwfzOZ5WcSOGRRIgYxGC8YjSYhheq 1fbyVIOyCHUPDwpJVE1ZfQaXEsFGmT68snJ+gNZK51INIpyH5hal3J0Q7+Us04nfoMtdKkxw W4lt/jVQO9HMFE4BJcCCvMPPtwPtYUOr0lnW9AZlMJ8PY1ikgPOLecUZemydnWgW3vA+sQYf KiIOaltcCn9qe3TWUdgzouJub2LjQrVvuvVqTVogtCgpVI31JwFbb3z7BTNCL9zAajjbUoU9 /s8MRwbFSD4IGr34smH7DkhCRWkHZt5KRQnv4w590WKpPAdPfDFQAI9qPQJx94IVWt8Zcx7i hVgShHMd7SM1J7dk1+yjXGDYVk1wQitalAVuWVX1yA6L6G/WaCZ9GhKhYGfwRhL+gLVcHokS U8ceVRyKX+nULZ5Gq7p+OrNHUwZZNXv/9IAImIKPIBOCM4AbIkaQlT0GiBpEBktQsjUROX2U NESbXAKpauG5ah2Iomxd1bSDrS6zyhJYVsyvL8X0Yl0SzNRAibtABl1qDB/cj+bdH5SJZMJ7 4lZ1BQbhOhVPBWzpPqyaArJX4R4g/IOZQQc3vJ/VO9zrOZw2qpjMJ9n5da//JdMIJjs8nhQA luLAhwUZp6HZCMRPQDSCdNG66e4NvOlWgEINBd0hqGmbH8rPD4I5OsSfwDaKtAYl2zTz5uiM QXRdZKNO3OR+8VFCVNd5nANG+C5NsPspZyz2rOTlGn73TZh+9nI9zybao6pR1pWUTcahtQEp 2IE7qt1xg0ifGgymgDbc6usSg2A1pD8QUcoAOMZ6ToWo+SCuQMEa3rMzqjlGpH5Zge8oRxV1 6UEOBPiuiQxtxZLq3wKQJxex29xj+n3LuQ4R0BkUJtBCRhf0KstLHlF7CbaDpfO2GzoNQwQW RBoBzRmaHFL3V5xLsfv1I3hwEFMFHoMxuexRF8BUgw8D34pP6ELevcIMGDrrC2Wb288eGOsA HIAC6yIGIV7gcBisA2S88LoFFk8+vlnuh2Z1ElTfaBy+hABhV3Ojz7GuAV4y3mQ5SWirLcpj mySPbLgW3xtQCClEjupSLHsMsSZBpVBzP9cmgCAWx4kbfRLFZQTUliJ82yRBNChYDOZi6Dk3 UVpS3UJFgEmEDSSwDo8JmLkdk3Bmvl1eCyntleo5uQwFygu24TmEmJ7WaIuSLuRWDHRocZYu A9xLYGhxs9l8pJLXoHxFLgKHzdNocXbl+Cr1Wmg2ESTREMTYXc0S5eUBacRQHJz6BKZnMqBA cAQn9dUT9hwTyxKXMkGYUituVFSz1zXzu/moLCJdagjlVn8fb/GqGMisDq1I9utMiNC3JQsW dAgjnUjjIC6XcUNCYeUEonOxahYYnwVQDBcUQ/BUEtloBB7CXnXK5VyrqniaD/U7UBuQTeR4 UMgrFKeiC81oZhQHBkXYBLB5lBYpkjaUDidrBApVkBfaRgFHgkZgESBiA4ItS4Q7y+YSKQci hRHwbQAXFo6Whi1VBCuWwg10QUQrwGlF2BQwVggHA9NAGmIVgBQdVzseAB+B7sBCAFUzWB95 kkWodLD33GVpFocsBhPKyiGHVgW+PUuSVhYCNwxBHNWifTVVnwCiACHnPBzThzXBRjzhDRl9 Rq4U6/dTag5N19nwtzSDE/6ZExStRQAW7fVCw3fqGkt6FGQJI0VxGgHzZMlgm9NaAIitt5vp t6Ta7ejwqJYgIeAFBgtCRBOuVkUk55IAvjwfaAfx6py4u/Co7vd9H4fj5/S0xX+xqFREB2tU ZxEgtAV/9Fgh1F8qLTZzVn1j9Wyisaqe+fVfTxMPw+4BrVyUa6LiqgZkX7IJUBkgHz9viQpc ZE38uFDW23n2kMwD/ZjJz3+ym8X6RLsrHiKylA7aFLJCSJAXsvwD8AJ/xNo7Bg6E2qTsetpz JB4JStgpHIrrF8hgQfQITwAUehTU24J5QHXqwhPr56QHwaIe32TDGnn/or42+wtDBDl3SHX4 YMcNN+leTgC606C2K7oNF9DRaD4iO9FE0gAJvJmdi+4tdnwtfKQ2E5pE6NP2dZ8oksyDsc7L ZeqI9ffs3zv+z+Alpwf+Cs9+iWj8km6WCtAU8zfL9ZebNnGXKEqAEPhr2yv8qguDSTtuVh0f OQcGcEI+o6iNROjP4S6vIViG2a1CWqZMdbCCyo8JEBOClN88XSnFYll+TQdKQgXuD7g+VEnG eB9MsBdnfS2lBv4LF/3ZbN8smYWwwiATIzswZYAvqrjbPNujM2jfnptXM1YgB72Q6EuCq7lq QiC7fj1ECZKCruXqQYs7mXedFr63FkZmzsbtaQoQKs+QF38Q+LOBvfjI/xjfG+SP3wPk76oP Zi/I31CwoC5FKIigcxW8UyFhY8yGiQSmzv+Qe1OgBlJ+BEyxvkm6n134bAPsQfLd6xNcTtt2 pHcnn7ZtbOQsr26jtK1VgqZNyhZKRAMQUykvrwQzDJvpc3bOdGAWnpI9F5zvviKBgrCqe8Ez q4LvmEbN4q0PEulMNraNpgQwXn3w4vS0dRyJGwJoT0Ika0rufRiCEltrBREG0gFrQ+PcAdwy mjsX/PWxiAVDTtjMgLjWYen9SZ4DegppbHaIHwnDfkYAXgTi4lc0eIoT3AXgiQ0zhu5DfmNg CsiIJhGFR+5QFHpzo5P35A10LhlGdwkaRxHeY/fluEAGcoUnN83AGEPfKlZFf+ZcYV/sM65/ 3Wb6IgyBDSGKkrCWwLVSN4Kerk9SAgofwEJdkRLvcTIIXJ8/q36o01SA/nccL1hQNwhaFUFK iSqKQQBrQgLB/BL8qKdlQCMHWg4HZKLwtTG//zEOuX5w7/3u+hb1pZHj5EXBggVF1nWMbLcI A9ThRaDfKiiLNkhfchQ7cAKz4OdoSCQRtvKA5lufR2W5uzcVZTMR/wsJO+Nwkcb/DTn/OgMp VcyIVjpyAwkwJxvV7f/Ke5XKAriKFIoD9kUqOAda/RnEtQd32p5PUoD13c5N4+KrVgRsMxJg +rHfubQlg6UjDMedJSqxdqE0EZgFE9oZLBab40eJR+sbbkADOLRQz8oU9ZYyeqS5u7rACsPB OzkSx/4Kd35kQPL7o2JvHusRBBuIMih2xkzxlZDrE4aLxYWxwf0AzcdRO1+Sea7kP+pgIe4l tEY3ELD3sZSgqEZgKUNHI2Rsg+2BuP0bjk0Rw8QYiCIBhqUbjdYgPLy7IswKwf9rFQcwV4gT +lgHcccHQfYNUncpFXy4sa89yq0OAkw2Q+GuBB9TQjB1+AGMVdC0aTtNf2KsdOPjNe0BsYEk 7yvbuTxF31pWrRwQG9YYUC1sumkRFZNkIoqunSLv4FfPg0y7Yi4x3msfhZHI/0B1B5EvpGFJ 63psTUMdCFV14k9n02DLYU0AU628DPa93X2IA4t9gqQglMgDuG0K5sL6o4sg/29tQ2RQBqGV 8zrnSuvmbjUGIgsXS0M2tNS4xhA5Ro0XU7IhNJx8NWxwmEul2cSV+g8VTwSLgBwG0EA+y+Uu AJmHNiAfwglUS8fum39VKlhlG/1BvipPBLiyMVtdxE77acS5KsFyXfwHB7vkFsQ+q+IAffPr F10gTthO/hTsGztHmDJQlPy88teCLUtaAdokXBYcAN0cQxoi5OaVHudBI2FR1kMapkwiDZvW GowJH/YfniMM3Qv60DXJyO73yyp2RBrApBz2H5rfzOnYPLjGulXGULKeUGZ4sWjn6KkCcYhm SoHb9i5A48bLMXLcEveoN0XxNZRKdmrqEU+emyNxFWAPqfOIyXBmEeBb8h8oKjSMigGtaIe8 4WteZoMK/bog/xwapNcvXaq7FgxIIst3/rjeTpFnLKAoAfM4ZX8vA7DMd01qKSOtXqeICwsA DFcfR5L1QlBpYRxeswCyf+RaSEY559lXR0UDABZlsiAp8wMwSGEMXeV9hH7p3Cs7NpsiUoc9 ACV58JWDjmNmlz24EJJO1At3N52MSCTUM3yvamwkHYK5u+aPvEf2BpmJP5poKm/DK8oAVbxR 9dzNRe9F9hXSRfTncAbdFsSqvlXZ8PS/C/ZVF95E4JpXnAOXp6IA2DGF/zy2FpQKoLknaUJw vvWu0zCQlPVE4sHGDEeqpZ+Ys5L/WRpJiBtsxR2pKZK63GxH6xmBhh5rbCr7pgPOVeEAsSD6 kBNFAFIuu6Ek5ZthGkP1khSHjiz5D3JWj3yzeAoI760CqBVvoSyIrR7HfcPYrDhQ5vp+F9Ts 7RNTtrj/pnYwaLwDAKAKfw+bjK0wTNqYdqp9amnYh53bDOv4sAY/b8KkuaNMi5cK8ZBkZLsD /E9/FIBDqAQghgRV7kBS14tBFGhHEmsDU9EXMR77bZ3GK8SfTd5e/yHRgkRV7wgfjxD/XbYr jYwtISQbd442xrNEOhu5I3TqaEZa1d45gGOu64a5VmhZuWeg+14ScLyRWB+8iiE+XAuEhNIg 7foV9EgRrSi2zyNM9lMevw/8Xcf2OiHkfTbXGAJp1SzYG7fvg72iacmwuqcota1eUQ1PEG/A FUnueQX10pZbyPQb88oTePwpAnoMwQdbRQ8EbMgRXktmZtn+taz1XUESB4oGVgbm9SNwRAIK xQcIo0Qge8BqOkZRWsU2aI5lsr/pHDhqBzzHt6oEpMWdlcYLf23CRQG+2sRbnaePHhENDlhz A9PFwbEPb9zdRBjiTMR/SKvIMR57ewCW3u0oJA3d5tiAlDhPEfYknGvDDCVx+ANM4BrSYYv8 i0WO1DcrW+7i/AT05oTw7vY7PaBkqejsfkgPkPOGlgPDrZ/jEISOk5GBkWHA3jGiQ78WpC/t jjbc3ttV8CueUQrkS0nytsYdpBRbAAQrxhphwJRkCt52HZ5jc/sSOxR0lCZud3FqL196IkHg QE6WhW8ifwouCCPdI0Vmk7DwyTUVdLq8rsIKXDD2Z7mFAqQYqkLRnDiwANHeQ9hyq11AEmIZ /ydA8y6oH+E4OhqbHqQ97sEZWRO4fQnPZzRMw0vU4+uWHEyLJ88vQ4wUcEObTSrBDExCRtmt jnMLVfVOsABcRnINDvJ0oU8ek9FIYcLtnBmbB7c4uC325RzNCqIrVrUDwhR7xzyhsvOwH3tX cqGy87BUHALIobLx+goSjiGjov9b8JLlQtLIZyMTm4i4Hb4GDibLhsSsC9/kpCuch8rg3+SE CZbUzMDcEDC5tZedkm+8ZLdKiBYsJQlguy5UIMcGRwAIQRTZQEsYGIptbtVdVAkM6WrezQDJ OQ7Z9+s1EpsBHhQLmT7CQkNo0zaOJLKj9I9vnx5BL1bwTB1k3tKKle2dGbDHlOlYVVAblyVE oENaEf1iZjECAVmBDuxAxYpyJXOCEC1I4Z1DkirKkC6WLEtH7eDyEwM8x13EQhoUNPrHca9G dS0HAGIbiush2QO48NeprEZlVLoFFTBGclR2L9B3OEBtecDMUYjQmovecqllT/KXAkWTSb8H Fim9yyriyNX7VqkfoKp0F9wrawsyO6BYDEDsPwv425sHY0om/VWrqxEA9wbHxYApDnGrgdmY BWkGjz7fCLGQKgQVk/SZWdiPBBys9OW3A+fpSA+mT4Yz3SnMuEMyFVT53l8fyttm27N0GyWe RTB/QdE4T6dXR0zih7hvzNkD2FtN3E50bY9P61N5dgqhCb/zQIA6AMsB2GX8hSHIKCL0RaRG eAhJlybIAZEjzu9u6n4JD0tLG1w8qIuMtiSDoEWXflhso9byPSI4rRosqqZZvJ2kpXPSTfLW SQl0lc0zDdTaUMBrfU0mqLfdShYySAVXA3f/r44Q2AdfGAkWiVvtwjDHVOaBbdo1tQ3y03xQ FFneFyAQGmEK1AoU7H/RJYS15nDQQw6JkHc2ht9O1/m6PObDvKu4+bqGIWS5XG0AYe2akdTG AcDXmED6IArynVtcnGcuNQaOwwUvrGaXw3NE9u+CkPLdXT5B4R3Q3gJ2B2lBRDEU5ZYwyAhu 6YQzYABN8l4NAjdf0IbuAyAcSxVSgWzsDTZ3T+3aibaL1Ek1shn/Fgzod0EILsFe7CTUi+wa BlqjPFTDDUJv5A1F6qq4TQXjX9WMKsDLs9pssw5b1A/NBD0V+rILyqDbClnjbA+Sl/C78+1P jVnwrR4x/dYteelDLxDUKUREfh8BL8E4AKMNBvXVAMwmlHsHdcKdi78M8hBulAhO/xSDuF0R A8CkavrmCNiFM4bwS8YKFZXa/bOuK+UvwzjvC+REprTMYudvtpERxZ82w7cKQIj03GIjtQ1O DSAE9IOrvYLZLuPFALbpY4vn+RAFaD3dl7WCS/aSc0cMXMdjSUple07okEbfT6PqdsOZ+sAP oF53KGqMUB5K8IQyArr1ejNe9pdk7PkWcL2tOFISAQFCzhpWS0C3RbdBhd10sNDFCiQRK0FP mQV1sVgEdkqJ//DAUK2tcu1bVLkGJbz1CyX0xl0wHcVw6I5G4ByIRD8Mw6UINlT9I9IJni7/ C9KWTuNsAcAPdG7RjGZRntLZ9pZQGijaRmedVk3YDcZ2wd1V9KDwUUPWzTNDEHF/Gm4xlFFA dwdxA7VeS186liF8UKWFG7ATCkHIOU+aCsUqfBwxB223BcZQ4D8oYRv77/m5vpA2AR/cfcth AFJA/whTbVAbIAwzUPswnoAE19e3p8AE4//xBFuTUwBxFWTihM6lsimlfg1VEBIRN0UxlJ5m ALbrAXNk/orW/lVSsPMDKEfqHrM5cAp5aRwuLvamRoEid58yLNYXmW7MIkpklcJNUH3K9DNT H+7EHGjlokqSAc/OpMU4QMX2DkQHRpG/iEtkVLxbNwZTVxQORzFfeBjCBIpJQyZqZ+vgeY3+ DLX1HBkQu6RmKBZaAwwfnnUjgObQAG3OpRw4XSlMVPNQdGFTMykGERRZovjJQwdbzCVoSqJ3 ArayAfIc1MxUpiQgBsRDHwllqhwTMrgBhW4GRTv3Nf4W6vzY0rIOdhUEB6zMHMOf1uoqdBFF xHDIOiI0tF9XEQdQFEkGd1qrrUsfGH7pPRJ6Rv2UzSpUTL1XdBqRAtz2sEYfdwa9JAMgQHzr aBqNgQ3Rpv7jFLac554ffqv4D6Q4UAiZn1Lr1GibVtVsVtJEd84NWCCEL9HPbkx8kf4uXnMQ wlR653xcX6rJTYujJ2vpfb4BKN4dYBNOCvXfCEWPCx+h/bPuXc+uXvMNDU90HkpEuSVjnqjn VGV7WOAnD3XLJt8vxO4XYoZTA9Tyn/HXaFCYxEKD/HPPDgVXIQTSCOzbDRDRKKQcFdeb1NqX wB6qPxMjNJB9OCtqDAyuQ7BVcmZO0T4ZsZ7/WgSxb5JZDNKxeFet7auFJk8ZeBsFFxVJiC5v EmzDGwOFAgwAVVivBVoQtscED99+Mq0JR2eejBNkAwsosRA5znMCB4JUBVXpejIppQXQN+p9 dcsvyl4CZ2aocmiINPQvLRuJUUfANDHDE4oITiKL+r5I9HDdF50BYkZV/13Ao1G5A58JvCBg 9HoJYPA+ssLaxTo2jVIYNnZCkyGBX2wMFFQxHMb15SceqFL+QhZLVfUO7Z0E5eSEFsMjZiN2 RXq+82I0jfvIuTG5dxeIRqKCpG7MFAxXrc3cJetQPislHrmfWdguusg7jKynQOtwdg+ObBYo Pe3wcSM92yWl6osCLS4LYry5BqsRIsPXDQVbMW1CCRgVTNU5yrJUlDusyhTPt6Tkxzq7nMXi XuRt2JAxFiskBi2Dy8KCeUYcXjMQfIGwzZOuTIsexEBiFix1cbimKLh8HRoHA3gIXD0uzA6E 3Qp8XNtIgGqUCxqcCbkxzzcuv2ULzAkfL/JKjA2h3xeKzja+Nb4BIQjoYKBtQxPKhv+GQpAA KA8i9o5CwmThhe9Z2Y2yIR4NQk0l0I3Gw/P/mwPUQ9gJ12lHlM+Ud3OG4ozPhQFGN11FDAin UF53inNwgjgJjQQs7l/kpqugJTSk9IR1PGx0EhR6NH4en8aMHqGSPWERwhIAWQibsUi3LSJJ w5cgbfkMkG+QN5amgoWu0t82SwDbzqy7v20AhhEeh2ODCfCAADIGrUwiIWgKNyF5XGElGiiD t3u24h5QJQQUngn4yph4D0bFAhYNHZPdC+8YsOnYpGhD3G+nnkEPjGHIgJRvg5wZI0benQ9c 6zxhHe2/DPNzHL7i4umCDYC3DrBL5Aakb3gxq9gJuIcbaBqt4VMDAAcX2q6m9BJY+JiPOwGq BYKkYSfX26sAiaJIz1I1ar4UMC8GxFO2IggMyM9wUwRSAEQVTABHNYAdBykuy16JosnqTErm Q9R2wSVnc7sQQbxu0RXDJkuIOq4fzF3+cZ1fIMUQRAEDy6Ov6yVmQ751cWH42HpP+nuPNHOd Ba0EWoGB/LmC1zBNhphJDCMAI24vC5jJRdYgv6CWLhiKC24EeiktLgau8G9L8hVJavUR7SVl GtcxKaSfT047HuJWvQXVTHznvwa0FanxCNsLe6im7laGVAgWvLbbT4iTB6Z2N80YUlPW0dMH g7yQ80DJnvHbiqwZB1jS/hoSjhTogOaiZZ1KEvVxzsoVWyUEU4n+xL5P6mV2dRXWbeKpvk55 nM9PlXTPF0gDKHkUjgwGmjT2uv0CatqxAN6B50PxF7Qc3XHCCJESqgssRcc/ehAquvM7wUlP Dzm7FtF6T+dPSgMrFnKTIM1HMQIhUQKGNtUVDNZO8NuvP4sgmsX+qG+4wnAS8mJigb0BnRbe dANfzGPvAQQCYTrcW9BPHkR8PRyLGVMWQVUgI/DXJKxzBA7b3UX9kAm2vYW75fWRIWwirRPr Pgcyg5FarOzyxAYGoRLQMeIS4JARFkhUFt1nnoWrKAkfxtB7HTMds4rFUbXPMgbp9rvU225y 1tIHZwEQzxZZdhCXUHES4z7DQ1+2x2GN0AGYl6DP6f0raOcbbu4FMy/gQM1fPMV0ajwwHxI8 fQMIOQVHDAn8JGsiSIJCnYqF+p03Rl/FUCWz+bFllymU8cxlvV+HpB5ez2r9MFy+7/ZloxAP VKOHHuquGHmEMaa2TgwX2N1mMUJ0OgCBjZ4cAK1Pp60WvrjL6PC1spZ/zkMhV15wU+sc1BCT lBf7bNz2IEptNa4eqlgIGBfp3GNAZbjri1YUvyIus2YW96WcIPBU3kLKDP5EK5zSCwy6+OlO iAQWVFq0eV1qAnr6iywMSlA391OFckS6Bg92zRIR2U5zO9nYono2fEOKAKQGBe1GMqBwqC+5 +H37Y6A7GaQTW+vvdKn/eP1BDjSg0wovT75/hAF+ABSzM4ugUL143VqLMMhlB2D/85gFHLVr l/CE2pmx6pYO0Brw/ewFrgtgKl9XAV/tgANGy18QTPwU9DRsGt5XXhTdG/4/JjlxfP5t6djz g8YMzBKmgnTT1NjvaEDEGLagb/Vv0beX/atoVX9DBaxYQA3uW+Ma7OtUD58xGE5QgN/oTfO+ loWC8h6k5vYPPoIxGAeBOpPbVCWBVn2vdFICW6c8gscRt9dNDG8vnYsMUxHhKkdZn0LFlfQr M+13o5MRAzD9S37Bx15fJykSlKg/eMGCDcUlqGDY8DKGBwsVSN8DBgKPNgD6F26zqtcKXm27 3lOxRM4Hv0sSBBp8n6ovZfdhyanzsUgp+Fy40xy3DbdrCaBXbYj2F8N7AEPmCFIVYVvyxm5k /2/+tvtWAd5QB8Hqzu8idBO+u5BjRiyckUX4YTO0o0lSF+m/YoWCB2Z+i964Xk8cGkfmTVoS MpSriPhAsJayBrqUEgM2USgDKbbT8FuGY0IGJQ8SMdFE17ZNsLyEHnhHFxb+zwPHe4OPWpRR BUcBaRTbfDAurgBgiXRdfh4A7AX2bPHPQYFr+3RFXAeL3kdRB93wMQF4HDA9SCpRkEc7Qg12 DJy4HyUHNH19GYmGgRMpFfh+4tq4jCpUzVS7cQS2cVPsTAY/OmsWuoWxM3za7CzJEyz6p6JJ RINqSONLDaXcawO7KhLHV0YujhroBcpHSktUYA9CBc9BagxMvTNDz+7JHxVbxlFQGgq/nKfe xUe38xRUf1AogVsVTCeod4asNrrXB5RieLLB6xWBsvU9natbNII+3WbTzTdI6AvnvTw5ax2p iE5Q2eeyiBYs4Otr4t+QOSIaDQg2T5mECwYwhAvfkChObtUaVHwGUwjPHhgWtnJo5TFcpwVC 5hz52QBoHJYD1c3BfD8gTncKBSIVlFXuZZT1XCzxasEvqmhXFymugjsCjcfBDgkIZeS3EbMP JMRvEFlQvHbBW6m1dkAPpPh/cXAcYRVpf/aL0xTihvzKabYssiKE/LIWZgcqi2eq3fosHeq6 jtMH8chVYVJTAEa5Ax/W5B49V7g7ZgnLUFIBAuD09IQDX3YSLaEhzXIwAAfuEXSW0g53MPU3 AXKNAafE3bQiInYdLr9So1UXcRAIMIaGU/V7zMRWdhtxzrMRcqkT7BIwEQwZWkP87iqp111B CzBIMoF+2eY/7AhH3WKhZn4X0csEUz5txxDAq97eAEqHqwUPA8SOSxUpoi0d44kEBcspnFAL 0UhDW9ZAMR6KbyxnLwp1Fg3VZp8RWM7Z5UASPRxMARuUh8C2KPUbACBQTeZgALSvFlLs64hy fhzH4+JM1pxYS7t6RDr0Tj4VR14KBspj2wfIWhsMFmrKJDBeGH2F5pH6H0XwHRhSFH+zh5ax Dl/4HRJear8OnfyXFzb3VneyK4R3V21hh564QMZa0vofvuvu1JgqIBJt8hwVSnwTgblW+Yfm wOBFVDXlf4uD+0TLhIcWh0cWGstXsSlzbnwEI30VSstkYm/dbVOUbc8QAKQEBo1XHPqiYeYX BtuKOTrx0NPEMgcTIz5AaIwUsBzQycYRBvBbHxguklvDRfkX4EYEL1Q1PLin52IdOWCvZxlM GvYzEUMjFhvXrLUt+Dcfx23oEkiBAClGuh4t0C6hk3fw5Whv65zClqroG5ftdhLii+s8mjBJ 0SdUk1bTaHRO5pEfA4HG9G0G23xOUlprYbjWFKdR6n6/Ew2Hvgr2WgMXDlJERFAjtBmC/ogA A+IQeitgDHDQcqY/RlQcRUD9ZkvMYXkHDnhWC96dhbkWcoH6JI4C0Arw9myC2+SQE7wN00As EciwFRcg6xlOqIJAiZYgFuzx8BhSazGfHwK+EH/jDbxNIMfeFw6KdtW6D0SJvOnsJyxaVmIQ PAyecb13L86QtXrnDeHYZNoCjxAWF3uEnx4BEv2fystetmElBtPjrK0Wy9Q8MW4TsbevhsAZ obQh6FbLLCNXDgNmTwtCt3QfHSoMEVh+NPBdO3wTh1yG89dnpaoNlWQb6heAZWgcRch1B5bL iJquUzC0R+FDUMUZdJRQLhitaBfeDqq52kYGC/pF86m3ZxZI9l4NtEkE8kOU7NNqO2S9u9jY HkR+AM7uhNIdO9DnZjVI2xKJENsSxlMwgGjt4kVGn6eDvDIkdiUJlLS/z5oVMl2V6EN0dQWE RsEhczBGLetHFI/vNoLnIbvBcH9p/1drlgZ2efZCqNiTO/ZEGf85SRstIcY5/gHn0yBPMbAQ AUMGEwoL0yBPTwsYD0gVZvtuKKqqMoC+ReYIyN78WboghHALohpsRO6sD2oSGVWkJ1ARIf5O XvU8zTTRfx5ZUfJbHewJSYfRWC+aX/VC3bgBmt4MVtZres/jzMsKAgf0aMYPzwDcpqj6d/7U Hu2CtGP8VfROyBARJYqLsfBSPKMqTmEXFoptdBJWJZHLdPJ4OcAU//rGHOYeKsDs5A4+JiKx jVH2gs8UcI4EePZqfnBxDpYQ8rV4ERo6ZBQ7tjgbjwPs3COJkcTGqofwIUVED48D6OAq9A1X NEBw0uOpO2MmWRlEJ8tF8IIxbBQ7IgcI5ho75h7UZSTis+zcPHSACOIuQZlHmjlwcQ72WAoy 3IZnIgBgTp5LGtta9xQLZtia5mXf/1sygEKPA9SwdQYO7TqK1DS7dHMdoANltpNfAQEmxu9q kEJ6/sZUXQFWICY0kiFLRoRnqo0NOVTBdepqQn0DYkdPFzdNMkWJeUAC9RznQBaWDZcQEAc9 GHkY7Jb+ApusURZcAg47cCyYLpd+UdN3v/WRVd9pXUa3LBdmR18mgENRnmTAwAKAiv3DjdZe eIU8BEjLU5YH/BbZQAjIREvcJJZDhbTFgyJR4Avt7nQET2Qhg71uHs5ltWMMYfaUGjTsFLa/ 7QaBznIQEWYREJ0lyY5wHUkDOd51GysxGQSYuCLoAmIsElmp4kwndL8HbMtkAjpPTbq0pMVp VbgSe4U2BkoGsNMWdgX21yIHGnoPUgroIjaX1bBuntGzX98WuSsEYlUxCEdAACAgsiclY6RS x06reRZkwVa71VSweU6jb0A2dn87Z4UzmBUTaJohJl2idikkQEPFzWzPrPhF6QdUChYH16yc W21XrAR2GJ4WsjBTbKkWeXdapPUHRH8Vpp+GKM5dgBNZ3ewPI0IID8XXpPfcV8viBQ10GQBf IpwqrS9DmW5e8MMyrffWBlX4b0tXGgmowWJNHcYZ6Tkl/3T+U+YOsFe8by4ycjVocILBWOtA YVIYC/dMVWJQYDcAOb1r2Ud2i8NVYRnMcWWiWd05PkpX1mLcMQtEEIIxhfRXsCce6UdA1lQC I+3xviXkGlZxmdkGQEQKxCxUOqCh9kKFQZYB66jBgAQYUWJ+IpwJKBAWhJdcnHqVHNsSZYex mhcZ3fqSCdZSt+PNWxaf0pKoHXACscYmqout6ZIhbUCBoAda/kSJe6fQFggQJCH/KhUqvIF7 m+oWegv/MVz2CQjBCT0QiSCY/hd/YPZFg24552kwT1bo6IBjJG0E5IprsZXY2xhY6zFgSmAd HNBNYgrNRQWB74YoZQEjF1X+rzZGRsxpUOIyAjlDdTgFzf69QgIGFohhywkL/FYSAc6QMBtR 7XAVfk2RimYNQSZvKjh+Kx0IEGWcOFdAaxRoQxzHccb2RcFLeatUg/3Mmef4owdKgGEuMkSd d55BQ0eVGBsy0djNtJlUsk+eg3kqQtnMAHyqTJQjOSM6c8PM0rkbPFYsCHwnSGjKJc+iVHEF r7vxfbVCHs0e5GLDEILsxWIk0JJZQUjONhZ9y0NGUvRZA7ZCBqLwlmxt0s/mTladDPQYqwLy dQwMGlpWuW4aVBlPNObQftZcIMzeUQFyFlcICLGDOjy6bkcMLvSMUWKBQMQpZjR5rIoyMDr7 LDRCZbOYGF4ky2xliLrnScauUZtgGIMxI5fDFFHD23c6PohBFfDdjA+COCBwmFJ7NE39Nu5C gNEYIP00chFzVhLjjspsBQ5OBCRiqZm/asZ6TVytBofSQKnUSgapN1Fm9Bbc7p+LUCwLsw4G W+8lcvbmdCJzV5xlG9tHQoAS/ydRBH7bDHIAUaye4DhYBT0eTEaZpMv9pc6GnmlW3BxaVwS2 YpZegZB9QWW7kCrWJu9YFo/Gac0SyE3EUv0glivkI4TqgNsd26Dcn86JBEVXlrZWR71SR1IS 7goGulmCZ58CCBpSEBjDbQp0CtO26CaZpPFZxcRYz8XBHFNGPZlQAjydZ7qXEIrLnABmUgWh kUn/vD9kgG9GTVERudcsqh5CDRhXrQ41ogKO0nkmbBlDVZdXSUoC6PwQ2YoSR/lnDkQkjCHE ZTQK9pFBiiIwJC7VTeBAkR0YelAopCRG9aBeLIaLAMtdpB8VPqx5blzbR+kEF7BGtgc7xUwW 7u5YwdGYYHzNZt0YZ/65OCEVxZAj+hlXNIraR6jhuvAMzpGkkF6FxsAesKX9By0O4H50AdNx 8yHcExsBufb2VJJECnoVTBQFgacC7Q5qLngAY0g4eTYo1+lk1mXreyGdL7cAUpLo9XFHBItn PlG26jSQkHM5dUcOB00XeslKFF9Eak5iKiNzWeKWsFRPe2+2gyRCdLw7AWGU5Zv5umfP3ez4 Xj0EE0J/n0OMEQhV5xhsayjR5tH8nzR1SPOI7D4jXUDZasoaO2cqMhssfAbJPHogQ99fnAxA sRatVQpPXBPvsXIAEhcQR7j0WeKBRW+hKOQNRx4fGE5D1UEi30m4xk+cCl0E50hBz0IVuant 2mnBEJafiVfsmlrN4kTB75F4h3Ms+dTH8HpdBVIHb0Yz2dGGJ7aKMQSNHwWe1bivstm3w0gZ CAD+X8R2Z8QxUgOAFvbbvLl/egQKNU3lMs/ARWEXknKQHSj05Br5RxhZxnz67mxAsAj7ACad LzQVEAgwUJ+SsrRxBEEGA7PARZNAWGR/GPwIw4tIsk9LdHkOXbJ5alpXNl84h1Zdq8MiSlid 2pCKCmIlHCSY5LvlyV5SYB2wR9J3XyMVNuQwIc2Mj6VCAw2/SfpAEIp2FWib8ugkJxkRL7Vj eVo0qyIT2vpBrhQN4y/xWCP9HAWe792sHDGUBvQpg18EFgFXDj7X0yRnG84mBCVywdLs+54b hw0MCfKwQhVGewZE9ctLRhhQLBaB/LehaP1gCOeWqPY8stSh01n+QgbuSDTQRzn25u4/ATFB xdtqFAZS7Qj21rHzSVXVfwfQIpttt7dyNAwS64JIsmfPViIGWD/neJaGSKIImEoqkHOSK3Ul lxxJbgSv3loe0Hx1yqLqVCRWIMAH4AE9XWExscCGK+IXHSGKU1aYhIkD9NhHStb3hBHbz+qa 7NBLknDBoOprOPLSRy9kjbZoQXDkDaTFdA1qfmxxbKtGUkHwR0AawRxa0nSIikOGrfgFSKrQ kviNHHSktVKUWkMZLT2fCVsRF7rpDm8NMqoREZ1TGfjj0aD/KX17k/oq3rxAcOTTSwE+ELzm HjxUalJh/m+W1CcCxlS7SaKGJGj0oBMzhxwyHws/fFOJ/IbQXeTSl9i/iBUQKAf2OQOdSgkA d0ORr8M/EBmrWp7OCOwEW/koU2ldnwgWqX6uEMzNap6dfYtQAEJVAHO9oJ1vVN5Hy//ZrwYo H6jZWfivGaeft18dWHO9zv5UEADOd0DPIMIHKfdK01CQ/VRuab5cRVtDowGhy09EMbeH8DlO 5UX5NTlQn3qQociuCsQB8RRqCzhOpokFVMcdQnutTVHP+0e0/pdhEBTOZp0DX/gX4xYtcTJd Ouk3YvWs3Wad109lW/1JQigxbINkT90TCS/WDSgUSfPLG2hUOFoQLO9tZyGAc6VcjAeJRQYC F1oeOkeLqhTSNbQc2rPyEePb3Fkn5G/TD1bQv8ImgB1CjwQbxm2wFNy+jRmH+P8ElrZt0gSt F34LXlnibaNAF6q1dd7pTQ+qCWSKGeq+Oq/x7+hzeavwGwRHRkIJgIJIB96fa8E2FctZEI2R A4VyeFZw3pyf7D8Yn18dy+xHQhuIwwVUzZI4nn9XDwx2nzRiGgYCwQWBQJdqbUfLFgyEUYkG wSpmS0Y2gGDDPLmYXpUoPvw7wa0m0XRKZs3vxFANdEJa9b5SBGGvOxseKQ3CxYJnTyxjDqDq TXMYfQTCVxOUSkqBIVWUxgtyoDXqTStCxtAA6QZSGtSDefCEBTzGNtaxDuBQF1ObuksGYHvM 2gQgB787ucSju14X6RLZDushsRKJMYvk0MItdSNfppbQp3diSgMlU93CYVipfDW9ewRoYpMc vJrCShIjg7m0KFeJmr+8Fx61OdhRE9iOjHa23NeUD9DlcQwQM89FqFf6aH1p3NuHAbV3F/S/ KWgNU3QPpsn5wAHGHR3a/E9RLnopkUfm2aB5UxsRGhEHyVHdoT4Yli5tNeeCjzKKD5Xr+nDb 76sOE/K5AQOHWQtS+/xdHUHr9uGezZuggOhndQYT3gW18kAQzetU5RH+VIdlC6rEELQXxMOd BUF3H5OOAAdodRrUtQWeEBDVVZNSDLLGCEK4H+nVLyaNRO/SQRdOxmJ5DxhAuX4UOYoWxjpj Eop2B/zvDEBqULANw++skSNmAckp2SA2hHuJnJ/r389paCilzs9BOCY0ML71XIqCrv4DpFqp 1hGOIOjsUQ43ciGnwqbC6lpef5h1IzGdMx8FXlY3xnEurHH1pyLpxrADFJkY1go0J/ig7lGK Wc7RNJ/JDkKrcpjNC8NaJhL9X77pACpM1kxQ1gMUjZmMNE9bNBe5kBFZYzi++Z0FxMIFEt1I 2RDlTDZMeJ5Ht41g890CxkXEgYZrA4RHrVYJxlGkaHMZCOZDahca/gOtoMBKc+X29c3GaiZQ 6vezuIzcWWa2ktewZvioArMW4RNa8FX+mrcgvGYh5C0wPtgMWYIYS8HYnf8UFHRhR0UE12bE iCb+nRQTrnXCkcpH60qMaHBJawczExqJDnejKorc0JzjpMOhRvitsvoIgCUAGJkI8ogk9ohJ yv2FULfWGkWlmyssA9D9w+b/ULgFdlKvynXI4nAzWAjd8ds1AiaGCB9PAYolxQPy/vIsxHpD obsaWg0iVGkVNHFd2TwzDKCUHLAEHjOxxhVPAsegh7l5NOfxeMPqYjk9QFpXSUlqUetxaGTU ghVCHB50IBJGG1odqV68Ud6yiwA57mz/GhfrOcZF6gHPF7g811JQBwyRgkPTUHcw/MbLsmgg Utn6ETPilZJLIMI+FGfJ8ugFHBZjWRa4NNWSIbCn5z9RF9nhQyN0zVr2BMLcFpmkWDAWfd4i mbkI/ilcIG+DM5GxWMIDqKKOJyQJFjlOc9yEc7KWXJeCrDObIPUdmTLRQJI+xWw81tyKsiUy xcdtEE/jF4TKV7pbTO+BXm0EgSrb3Bnkd2zv8g9EkXqhytsWKhRVhxIXFucyIGSK53UeOJxJ FKZY/QNeDSnWzDEO8P1CO8b3O7wXnncyg1pqNAh8cqcqtiPfLSBAmom+DDQpQBuhFGBaup3a agWvdkECf+gwQB/bq1ww8Qwmmu/AYD2yIDMRtNtDTLBW4s5GQmDMEi3JY6M/FZ0sCeDygXY5 htoNHvukn20sXaO36kV9GLpx/nGN/WXhPsID7+ZP+rAIlpV7lEMEYAuJ6EDXcUjjp3RzJgZM +M7v0cj89Sggq3RBcWx5iZp+Fh/CTwUN8OK8G5aFQg5NVAqF6BV0Uth4uou//DUU3O+IrRVw LhZJZ8oU5Cfa6/HPgamWoXHv8hRcT4aUglx0PB/KLgYUrVjufcBRYWIy+MVl1q6hZe/m2FVd pF2IfwAcUIsfhSY+Bo1cTtaTIIZz8XlmPIacB7oy1O+gbU9DtMZJL9PoR16oHlkqS2HndoMh CX2NYiJND5wfXWrLb70l29r2+OPtbzMvRlScVbQ1I/T2N6q27V44G61VA+aMzhWFHPL9yWKO hQRXFValKXUcemLBGkMawDVhKnyCztwJC/6GBymfHe/JZ2bFIgcMwxXvgP7UedymUFxSMrW2 VyLbqhyLXz70Tz7gChUIF9TN2hfaHvtJ721z7Ckd/Dfsf08Ef583VQZaT+CLQejwAyDAr+a+ 1RvG7bcgB0eyLFBHQxCcMAw9XF1QE3fYIK4EHRq8oFd4SnWIVDB7DuY+S9hBrhJnfLZ8KgSj lwNbXk2+fTBJy+QN7u9YNAMoLmyBhJRgOLrOcknoAWvcTWhXiaqFKE3ASudAYs/QxKpHFn1v SJsiS5G2IGOxUF+QwsUIEv/QiLjgEUZdEWTR8CPyDlDFBHZ4A2PL+EGucpF4EFM2UkChzhO7 I/ogo8Ot5CcEZAKRQQfrGesoa6flzQDgIzgVVcfHd5GzPx4YVSYEHHYs5IrD+FkE1rFjs30W +GFBYQToFkX4dAt8MJplDW7kaZaYb49WD7MB1ycW2gajVDMPBEI58cBw7/CH6Kxs1tn3GoFz QXl+GI5KedpcZA9n1ejVSmor+mqIeXMfK0ImHIxS9+pQJHRyix31ZwacBIVH/33ysAVF/Juu GBQSJiOAr2/q+DYUXK5vT8/o3ONGRDKqRxugHBGNTQ93ZKcBFiM0GjCvjqmHCwZFZ/hjB/d4 XSjs6+qu+2yv8LtSCEiD9krL5Kd6SW/XQjMF/AbAcT5a6xBzeTchrQppSqzBcQcGWkdoOv1Z SkRDEVWt5og5tkrPcn3nRXcw3jJNL7UyLGqeKqwWZzxDgpDluIDmXykyZQYgzFcSrn1mlnLN I3wB8wt5FtQK8sf4j8RRALEPwJmDqompGF4sQrAZaehSXVOGrONlDyOREDQYXvWxqBdAmElX RQdXwQI8FnA0xvpD/8MOTzbIeJ/l7njF5in8Dg555qeSxE88OGoTcOEOaIkhDxOoGkacwwrx ElWV8N9c+rghBzgYePZZRkf/fOfeaHgAVwwYRYkDcABGM5AXC+ZZbCMojFHJffQv+8HA6epW LTCjMCveF0e4gd+yUFS9xzrrJzMRegCnz6XfggqXw4vBThK+ahxkU2xN8nZQBDiHFsQSKVtO uR4A+F47JBs6Oq9UB0z35hSOc42SWlBHIkaSSYEISBATAg7w+eDsjzJQyFA6ULBQZQyePULS SLLm35JgWh5gXpxveVRqZuvXKCZwp9IViAJeBBRVOrqI9EcXdZ0ONKn/dHIBvYqGLRnsV8Xc FUMUNCbviNQslZavAQJBGgg+gxEU1Ioc1nArvYomukcXB1eKDH1kPAkP+L+eViG7IjEEXBxG MngJYryWkk/UbD4HyFSG4podQhh5GNJCiISrBHTcKU4ZyHgCFZAOAqxUBGTkbxY6q4bkRwQb 5kUBCxRCgxEWDiwchBfilxBs4M0VVegiCD5gSRrWMweORxcijvAzPD70hFTkcRLYC10CEahx snBShhJ4dHWEGAjeCOZ+JgUAMUMRvCX2FxF8KRFYABgWpEfMFwTuR5sxoyRwD2YPqJSOkE8R jkx4BC7gkj7iw4cbzlypFgyfUxtuyAu04mMax0oSmTsHSVRDMu2KdEM0yBHwFaAyoiolN1Fg oCcEMCWYUWBzN2MjE0dtFUGahiNvRyRUQqKQ5k9HWwxYAoUVUzuGb2FHJOEZsKpODhxNRhB9 NMM8TwRFC5WBzOCwWWvbOBbDdS44J5UVwqUe4yVQkpeyGfjJJmEAT11TTBBiRyFNXU5BXMvm 1QswFrY/YFbYS/Z/2SZAF18FOjQI7SoCAEAUDmdfGo5YCFnSFIZVIrsCntKc0ZAHKEv2+NmQ fgoASAdFX+QKDwNNYocvD5I63wBKJRdQmWMrcMEHKEsDXYUkfRmzdYfCmGu7HSSzSn4fA+5H WFYic78MEGd5DEJDCN0DBnsMlp9BTZA7uxABwERcvP3o4YYDQRAtpYRVUzbYa4BQ7/B5gvSh V3C5sCh3BX1yRhrEPsXUpJYHUVpRjqtUJK58GDBGMlQy1gwEMFJUbAJnA5CeYkdmyoYEEBeO UNzmokISCj99HC4igIQDFnRcDF8gjAFKhSjmRRksvkwmM4VEJkSy9IjuIpmEEZYLZRrIxCgc eQ6O1JX7A08beniDAgKUBs8jVQE63TM9KqaS/dRuSAKSSTI0xUzBk06PEDJDhonsEY6F2d5U pCNyHMnfDM0SLV1aABejRke+gGF8eRtSXtxEF8EQOVlFJiIOX59gkFXXEBf3NuJDNYuzTAqK 3YorgCJOyZPGwtFBjgebmdGOdQVZRRMGaY4uHVcW8M0pJ5Q0AtIX3JYCLDQCQsuSF3/PzT/k 6GuPwYggW0JQGuKkgJxPxE6CFVZMlItLznJCA4iqeLKoPBpPTkS3cRte0R5aRNP1kweUzBPY 0swhSLTClAaIShcbBUVx2EpcEkRXtlYxhYeKlNqWMvBQOE8EEsYnBzFawEwRIk1GD1tqlmoE drcAKAiSiFZPG8rAZNUBettBi0oEFdNLus7OMITohk6hFAfN9AAwCJFfPJSNUfq+nQy71skh +mbXSkDMgOI3SQQREV9u4BPyWzS5FFGgCWQu4lscQnb6Zlo0E/aIWFPTO1iEbt4xPR5a74GO yNzapuQR6qrwhZOJyOD6pODwk9eRheqq8OAhZZ+F+rrjFAZOIzchZQwEFl4jNyFlHDQmbiM3 IWUsJDZ+IzchZTxURg4jNyFlTERWHiM3IWVcdGYuIzchZWxkdj4jNyFlfJSGziM3IWWMhJbe IzchZZy0pu4jNyFlrKS2/iM3IWW81MaOIzchZczE1p4jNyFl3PTmriM3IWXs5Pa+RlI8Zfzw AkIIUkQARhgSUhhSRABGCCJiKFJEAEY4MnI4UkQARihCAkhSRABGWFISWFJEAEZIYiJoUkQA RnhyMnhSRABGaILCiFJEAEaYktKYUkQARoii4qhTRABGuLLyuNiR15GlzlXQwNrXkYWzo8/x 56ORhZPX5fHno5GFk9fl8eejkYWT1+Xx56PfhZPX5fHno4yf5/lBKp3W5YDn3vwR5EYjNyFl BBwOVkZqIWUUDC2gHDREAEZSJm4sJEQARlI2fjxURABGUkYOTEQbXxlt5aHn8xtfGQ3loefz G18ZL1ZDWEhiXxkNGyJoeHJfGQ0bMnhogl8ZDRvCiJiSXxkNG9KYiKJfGQ0b4qi4sl8ZDRvy uKjCXxkNG4LI2NJfGQ0bktjI4l8ZDRui6PjytBkNG7L46OpGZPAxdAQc6D58cGYiZJSGzoxw ZiJkhJbenHBmImS0pu6scGYiZKS2/rxwZiJk1MaOzHBmImTE1p7ccGYiZPTmruxzZiJk5Pa+ /NzKjsj/AkIIGMqOyNwSUhgIyo7I3CJiKDjKjsjcMnI4KMqOyNxCAkhYyo7I3FISWEjKjsjc YiJoeMqOyNxyMnhoyo7I3ILCiJjKjsjcktKYiMqOyNyi4qi4yo7I3LLyuKjKjsjcwoLI2MqO yNzSktjIyo7I3OKi6PjNjsjc8rL46O7XkYWTRgQcDteRhZNWFAwe15GFk2YkPC7XkYWTdjQs PteRhZMGRFxO15GFkxZUTF7XkYWTJmR8bteRhZM2dGx+15GFk8aEnI7XkYWT1pSMnteRhZPm pLyu15GFk/a0rL5EkYWThsTc6fgzJjCq7PgFriM3YQntBAdSGAhvZSM3ImIoPwJuC1GCRgvI XmACNAHuBGjeme/n3UJ8/AJaABEeIoGsB8TkCZAdu7+8KgWBJkKebAFDnCqdieWUAkys3Lay r+i7rvmiLrkXvV5GAdQBV800AkDly+010kTWOgXCIgvXsAJSvu1f8Np/F5o0l97KBRYTRh/t 3htupAJYeZQHRgO0OQbP+/H/A0fGoyj1LmUl1LY7n6WzPhGIByLTvBUN5+P7uwsVj1YR9hrE 2ANu8nxqZZkc7AnXTcAHnaBEypn3A/kSCE2LRm5cE5hrF5P9scvdRhGvghVYAwAnSO1/OJ8s aLYFhs7pOGVbotwk9F/sCbp9PHUCQgaYMrD5aSrGWOGmP/RqITr4lyJtiON7XgWLPgBozBwJ y7UABTQLGjpGUkQ2UIDmvjIm8L/g6CbGKHjNIeQnNpTwYI564YuT15H8qsKIhPp4Izch4nBg UYp8UkQAgAySmNAN+8qMUCom9BwbXxkNwtoI4AeyGQ2+Nrrgwh9VaIwr5jRbVzVB8Wuhork7 eyU7RiBdbDYNZ2dQcmQAG0ekgjujJAF3yV3q1XommEf7GXI61zxIKgMcAkLHZKqmcq3KjslM yKqwWdogHp8DbE5KcfD/QAIiIFBDEkE0eiFBeKDmwzRwm203VLJmV6oobxt3Kxu+4iggeUA2 bI5rqxeWtHR0AiJmb3IiJzgEVwXwWE5mdZsi4OlqbTozJnEQAfMB1Dcag2rdof1GkBRnPlDI tJBl7k1oCHECxijDQhhkhgM99ty4QUD/jtYLpANfkICa2jV1zQjuyIi2FyfmVREbAeaDWWtG RaNC/XMZXiYBVCHdc++yJRDBVL5cUZ+0Z+t0RlD5REYqOlYLUNlGI2JhZfwvpFVDDvEHfg8s +peNicfJAMAJRRogW3Gsv6XICLMCUrMxGco6IKal/C8gBXKVDb70EmYOzg/yqujUBCJI8OLp DswLJ7xfNrYL9BaOgAhrRzUUEhjClA5qSAMLx2EAtFQr901rITM7ljWgDcoBDbKSC/D22U5i hvoKLN4RNijmI5NZMVw/H1TUL3ACOgsqFuIFZuFhIxlSvcIXDtG4NzSOTzCuBF4acA0D4kBY NxA1YgsgY03kcXVW5MfuZ3kMDXEQsxZNuvhC/IsbLjWc14TrQhtxBbyYy0jqW/LROASUU9A1 rQ2fTPHogIhWI21kQ0paBAgkRQS2USG8BUkLNDxBQGULRvHO2kVtHVFpBxYoDgFjiQJREz2t Srsv9hVqabx1Dg6NYhRS/1k83ur1VUYQQWGGHBcEZ+Z57kIGfTmTLmcfdGTqvkpWWnZGEBcL ApoO1p9syN8Zc+i+qinbdpIHUaivJFsUnkghnMJRkRTZYeQHdVDwERVOBzQNvs8xzWMk4D62 zzHNY1j4dq4MHM1jkPDFhmAX4cI5bCFNOaSRNiDHO84XLLuiQDqaFqga5tQDfLrGLi2SDciM 2sWMExJZWBtC0V8zm/Y6hxZ8qB/ehSsvI1xTBxkrg1vK8LBnYZ47GF0+PC4ItEgUTy2QUFKE wIOmXUquTWJcNz5O6aSjxv8RpbDOUpp9ixUJ/j9zXWLdROpldCgO/m8E97m7rbj4v/zpr+r6 7R6nSl0O8TsSuktdSAhPEA50OiYCeDoq8Ccon3kBVMsFZmUwkEEW5KHTPE29eXgU6X6+FEnA SqphztwDJwXILXiqPfAHtJJUOHA9REBAZLymsRS37V600mYkb3tpAbvb4zbB1spKXB5hJyZi baVjfGftKgQHNWMz8ysJfwxJBT4RGtA05iV/KgpDBMqAwpZzYU171rrWz6xteFQcCQYG8KZE ZGDYjAZwhurDB7IQEjOJoX8GzQDyKxoNPzxhnSCYFClj2GRFdjVmTYBDF/QFhmU9vEYRn4uj zaYrGJAcEDMEomw0xfHYwEBAZFTS6jI0ATBACAlqPDsqZgNMidtImgIrRrhFhCK/Q14fd0xe ITg5ZbSOATBCVVZNRAADJXRUTCJ0AGUHDNxniwQAOmWQuEnRPJcmGsgrSq9edZ7Om1ZaZfRX yyMoaEtKoLxcEgVnHY4DFakMRBFBXs4Ty41IFQEjGBQ8Ysu2KJ4HxNDMQT6C1oRQ+EKZlMlP OjRHEAfN6WhNOHVCxh/mCoFXQnED4socK1eOTXx8QgiaAAParISVt0oTTeDvRV+QKm8tF7zn lUUlpG5GT6tNZ5t03QIUUDZOSxLuIwtQEmU4pxWPjZBBVBRQ5pUMbAZUU1EK/Qktl9pTIUd+ HdZSnlMIbT4zGJV7hIBdjUW8XRJhqMowL0EKtUXMbZe32HYTw5sNcnQ7O9dfUf4AGHuWDJo5 k2VIrIXGkA9uRXf6uAtwj1UBGBdlQaZ0Iv8BliVHuXwBvyDtAlU0FFV+j+kEogBF4kRpplI0 A0FmIFQAzTZUFCLEKqzb6BdGOlbkY1SPJhMaUFAFdRABocxXF+9xhuy4CHvnK1EmEASQR0Uk lhZU9Px5U9wTKemu7sLmH1YUAstejRg0s9DczwHIcBUQrQLfRfr3Pvs6BBRFnkgAIQwuV0v+ OE3KQKQeGhqiEPlKAll3Vq9cASICtqQeaH/nIXAPG6IDuy6P8C31QgQHkkQDxg9CthgCRggI AYyWIAEGIAe/w01WeVY3yH8p2ZAiJugIuUI7/8/UJhsudwQD/WnrKgNbYBduhgEZTxUgR2Mo czRilgDtUSNyfWQBTGo8vQE65sYH4ALGLxyCAT7tdzaAEyrGOBSCCoBjhaEnSMKGwHjCQYAU /bBKhyHW/z8SQZwI+6K068ZG/8z9rsk3tVXuE/pHMBgAennm5mIDKAYeBXwE1SdbnDoHgAru CSjwosnUCJ4L5A53DBmRYU+KJkg4G1JWeebmj2QFelSMB6JSI1ucesAB2lDwAzB9dMnLQhgM zVkHOARBnih79KAVukTQWerG5N0hCfyVMV6CJITYPG3wDoh0ozqigLOPkzNN6rLQuJrMjD4/ 5ODccgz6JrmpqoayficLRHQW0MKyFAe5fv+4wYKPCV8NNQxlLSy46Aw/DXcJf3FM8c6GArMX PUVepLFOsxCCTgHi3KXxGCVlYRBosrHNYUsMbwA/RBV49hdM0R/pAwdlWBAG2UiYA4asAa5p SIPIUlcbEn10xplWexaRTjOCNt2fKoTUBu+AMksSOUELFTaLdlSEOQPticzTIE+ViO75uv1Z 0XJN6/xEBJCAck3HNsODlANF6ReylQD/AHrgr/xJ1vSV5Q9vxkUHGQlID4SSCW6TTTtU6lpB aOl6uuTdkWGI7pq/rOycennmwrHU4uqz/ODmj5NTfFbzNPBy8Yo+P/Jc8hrvZOzC7d2RYU+A 7u7rrOgnvCPKiuC6xdnZkcLq0Q4DufsZe17QVCJHAjOJdwJL+Ucb61bnqu71HKsHVk8DHwvc A/0vO1BSMkkKBfRDGyQxQxgDCUXvMZlKCpAJ2aAxT/wGuwVTLYXSxvOjHSPMGoW+N4+hMQ0L l4cPmAG/jA2C9mzNIobny6SfTlFRRZSEmOBpjo7OhJR+PmmOpC90ZG4uZLJr3KZ0Xh5URJjg aY5ODkRUPn5pjqQvNCQubiSya9ymNB5eFASm22mODk4Ej4i6fw0vZTa/BbfJDUJ3ZHtnYYOJ yiwHrPFK8nCSVsTgHjLIhyXFzOGCsDiKPj8yjPUK9uT14pBzLQT4FA23qBmLQGGooTZDfDVI lRQPTNsmEUVeFsmA94QB2kXsEsaBFD9uglY3clIW/j0EyN1mZYkCJ3Q0Mq4e9IByshMyQkM2 IrqBtkpC+yXvCGSQPRf8N/5DIRdKXlcD3406llBzFIOBGg90yNwBb1lVfHht1A2UvhRshFkb YBKI6COgCCgBkxEkP3pm8Yp0KTZohXAZaKuGvGI6YXwgiyJnPTQeU/Gkr6cgPCIgGvhmCQYU OgZCHUKWd0CjEWhxb2JxZVFSLLhzXoyyFDAwDXIwGvtudBNRWltpT8hSFBdHTtmjN2crciYw GXg0xQBuGI8FJ55DjjT3ObKRtKoKe8m+bc1sRwOCPQDHWCPZgrbSRgN3Ii5XpVktZDpKKCBV 0pF2kWIiIHVRMm8PhaHKoQKtO7wQUCN4Ui4tNWxaNLVr/BOUBkUcIFbte5UONIJkZhJgB7sy Zz0VogPqV1UQJtvqLk9J1nJ7BY6ser4oYXnJUtqkKuXPEGBnbFfTJGEA/UR6xshcSWZ1E8Yn t0NsT61Eahf0E0AXFXqME1a7m+I8RmlwL3h0ZGUqax/tPngGjTbdBTNIF0zKaDIJNnQ56h0m Fl1RGVNAUBNDPGB8wK4ApiAoK2fDBlrRzWIjXsHiBhMzOgUl/hkVQ1Q3JGZDUl0OQbkFMNsq QEVFRzJuKJjEJQVFVGZfS3Lu4jmAxilidiZL67nFUGBwb1s5MxsgKXN2McNsYmEFVjZUHCXQ rKEl0jB3ZtkahNlGS7A6IXQ0DWKnc3Y1cnfAmJLbPzp8DjpPUeW0nGlnUVRmh7+qSVAuaiBk K672VpSOplLnAFFWsBNsYhdibHfmIkF1eS2wqCVzFX53NQZ37Hb9FN5KsTQqBl05CrBDArNs ZmLDVgVRFmciLCVAdlUgPZMdu/XJEJNNpBcND/GAfkKObAbUKGNDx5lHWvYAGcbR5YgCGUNE UiISXCh/MBdWpe7sIl7yTZYuIJ+4hyB9I1CX289D9hYLRBceAzCAFVTWaRQAW0EVMGUuPm4w ARcCBghGs8kDS8cSg/wqxjt8xlqJFuxmD6SlRmO7VoxKJRjsBa9u59lnAlR/dychGU0iJ212 TWqnBzm5v2kGQwYcAlIVBxFIAhEURB49Lm4G4x2eHxEHbxcDDEYPOCFELBsoXXak/TATDx56 BRsAUSg+EWwdNwx3P2+avRc3J1USFC5sCwIHZgLN7UD7Bx5CBhoVRAMyGl4GBwdsI0mwaCgl DmMFPgGiC28KRiMMEY9PzLBESBQibBM0EZVdnFNZYdQBjqZ9LAvg7mBPHTuY4GmOPRJml5Xg XI6kL7rT0aRjHNFyTccaYDdcWAvTIE8qgIe1iN2OpP804WZEGDMxL5qyawdScnrWc32Y4KCu z6FlHGOVNFkcajxfTnfyUBrMlYXb7FGRJEZdM9LtKtKzKDEsxbAbpyI1dXdqUWkyKywoGgD4 eRSTZqi0C997hEbnxsKqb21ZnZfW0h6ZLmcgBm1MNOa3tXEIVn1ARQ5vB10bSk9xRhcXU691 yv+uEdM0xjBMEslywusPQWUuV4kyPJwVZCSvMarzLc0edHaIaOq1cSQVzjqWSG3ggP5hfkwp e7GY6o4HZmGXW1KWhjHwZaBF/hd8VXYyclPfQDjexjSAYo1NCAUIjw2nn11m/nHMNVCoIx/v sE8Ia3AhdYtDNGc05+45PvJ64qRU5ihsNQ6tBBdlRJMCx7CPP5ktWikoa3Y3B2s6ZewJc20X NGPunWx1cksCH8CbylqTaU/7n7PNltxx5Xp3bbVZin6OSiI4tW/OO29SCdRsvcY1cHV88GeT 9CNmgseaSXgSIe29uv89JWctdjkZPRXV2yp5XXESq/m0qy2tkQR+f7E2aYCGAaGV8X4Jgrfm FmfpMoIaoIuDSFI/X5fBFkEwSkxpuGZew9JwU6xbyMSQkISBcHylIrxlaj6YGg4yTmG9UToX lZ1jXRs2ATttZ2GWaUUGZvtHwCQcqBMsIHEYeCKdKsQI3StP7QhhwgpWDW8hOEKBOl+F3YSX NnZfZZ2kAYBhJ0s1DhRGB3vQhEzTYBZfdKQbfaAuIgroHivHyDESKyxPBFXIMxQwA08bYTEf bxnUl9tKKwIpIpI3OUMBPCIiIm0CDgAEhtCchANWgRXux43UAnmCFQNbFha7RDs0Cw5VTbJd L+V19wIXEUEIHQhNDBnyVhEG/WN+nxFbFgMaXxrlH1gfNCNkIzBmlt/2J2AnNShtLDksaSMM QkL/Ljl6PSo9BiZ4Ce5TT17iYAv9uf8/eTp9an3GgZaBwoWShc6JnonKjZqN1pGG/bn/65HS lYKV3pmOmdqdip3mobah4qWype6pvqnqrbqt9rGm/bn/67HytaK1/rmuufq9qr2GwdbBgsXS xY7J3smKzdrNltHGReyA69GS1cLVntnO2Z7i9/q5/+vmo+bz6q/q/+6r7vvyt/Ln9rP24/q/ +u/+u/7rANzuFQ7xBX4iRSE3a9ymfSZjJjMr8GmOpGgvJTB1AiPRck1jN0U3LUAN0xliC1lI YRkDck+VNFlsPoGck940WdFynLSm7qzHNgvTpLb6xd9PlTRZ05Pay+S2mrK7cvh/A0wOBmvc pn0UXB42JEVojqRsLiY0aSdOfG+rfOIvw8BekXUTLmE6Fz5NZ0rjkAhtL3YkYhpLf++vpgsN HWNILicLAkcCY207J0O36JUieRQnByw0JwRkEhEKEaDCB03hT2B8EWxjnw5WM0gTVR6BcwkV bh1WLlccaeuv1ETMBkfWVgip9ZgbYTN+NSUpTIBq7WAjCgIMAg65LRBmOCNiZgoL5o5qQHRl MyoLG6BTcM9IYmUQ4FXhtCmWhK03I0AvI0VjpE3mF2IS2JsBOgKyHFcX98qysUxeSgFGV7tU 76k/fzTLA06hHpBGT3RAU4QfF0KwvHdqKlwULU0WWhKQExdiiR7/myZfEJm1a2PgjDpjfoMX mgVxciKKoAUP7kJzwybhXixX2mcXcLyc21SWZ2F3gwlZxindpOIDpGDJCC9ldBPM2CNPFmu2 f/39RAkc8KEDFO05/60tqpS4wmUTI/K5ZIRlIQbsDbb45LLGMQ3yQQiou+joORFtBB1MB04h GA2vEDoPPXc/kU3CH20JOQUHAwfuIsuSC/UJ6wNVEcxmo8Ad/WEmIKG+psuj47bJqJZCsEIA Ybl+j1FXU1x/cTlmTQBjUAvaUS9YkSMfEJxfiqh1Um9JGGwAXdkucgeWdqC68QVCMCYOQjRx maorpgt8BDoRdezKZhbdHgARYnqqzQ8pySr0c3CVdOgn7/oabIkDEMRiYw3P1ADKCEZcR5+U cExkQQg49OQ4myFXcF9XvUgXwexloVYXRZMIFM2UM3/V1VbFbL0VrA2/IlnRSRDcVdS9p6sF FF3YDhtGmgwmZBsc9U1pjqQvDwQTUhWSM6KnAhfKC9+A03LdgOqLaVB7AtQCB272A11vSCra OEwrWGP1o3PgCFVAN1DrrEWtagO3lzpGKuNQVof1DQMDZm/WOh4nNWdWDjYvYGpPlXjSKDQM OytwfDibkxwQ52dmWkVcIE+VNHRmLmxk0XJNx3Y9gp6WC9MgT9ukubPzuSBPlTSpw4PJ2dFy TcfTk9nJ56DSIE+o9O78NQOOpC+aHA1fIT4xmYutbXAfCB1YARCsQjsgT5V0F1g+l6HWL5px 0bURFTIIbQVKpISzwVSrpDqkG7YJhGIAKsVsfBSfR0REQ6QRxJvPEAFOVE5kzcVERHb/EoEb yA0sQQkTCEYw3CJNDA6S2pzvD0iISiJlfxQw5BfcgUaHJCbRBRvakuyVXgADpHGWC6hmBgb0 8jIAlA6OgAQiX5BVzHZARKZckBViNndfOtOc89kzDNVyQEBqMa+WVAhiyBHkvSWmXDB1YGGx 2dvlEhagHbeLYcYiAYhlyaQcLc9aMT1DDfAHQjsgvY9nFXRCCwAWQRx0ydgkANEhyNyCSoV4 flIygA7KrCYiRTLA5rLkUcoWkGM+wJKDvjFMY14yZFSEBKSgCl9KEsYa8oaV+ngYelp4OMoW yERCMkPdgkqEgCJ1IFcjmuw1QY/JEv5CXuaQUXlQexJ5cA7DvFwOqqyADo6AqM5peQUwinoA eGKQteZjeiC2RxmEozqMkkDAkoiaopSoZgb0bwZpeQUwxntYeRqBkJ56BXid/Add0xF7oCGO obAbDNi40PpIjv7WfDR2SiXZUgJcfCeLUMZCyiDHUpQMpAaSOzZrwLI3+oo0V0u1fQi2BphX S3WUcILOGN5OFqM3rl9QNSkNOUQDR2rwScYaHJJ7lhlaA+hRIhRRpogE7cWQzEaOwG5KRke1 VhmGpEJyOFrEFHlnIgIVAonsIlVtZ9sNxE9lEk1LkRRFUhUzhCmKuBo8E7lnGX4LHCR6djEk Mm8gNU41yDLaXTAmP0jJosJ9Hyx1LhLNmp3uK7FBIgFjeSDNSSIoeWQoNAp5V1NgO6ZycVYk F/Uq4lc8ZL5v7IbjWFBEZURRThZIXUceQ9Vwnl+/Vg9PWitv9Hdwk/4kBdAPbGY2LSoGX4I0 WJqgvQSwhgHPY+UMwRpEpAw2ZLGYwsZY7Qi0V3OfbExwDAeDP5FokIcN2gojg3uZUD1w0AWd hDoKNr484PNS4mYNaAjs+GRnYROu+DcQQn4gDgLtbmXUVSAuZGBjfiBI9SYXMAnwbAqW1cpW dGefeR8YYgCrqk01BWOhSPQQNVZojUbW7f4VXEb/LwTeEYpHqQdzE3w23/izXwkLKEygFQ2d FkQgJG/rom8KG2qM9jSInb8eUhl1enVNZDwnZZQN5WeSP1xN0DVxwXY0GScRWdt+X4LbSiKc 0Bm2gq/0JnCtND6EV1osjkYST0ZhjjjcLALWPDvAgpo0ZUx3z3bCHm1mYzQ8bjsC67dRbSvz bY22aztQYCoJJ2BgjAdHpVdwFT0b5Wg/PJxxXwyPEubfeHODCPhX7h8G3AZqrsVIUjpOXgvM Q3tBTXTxFNQmGnJFYwNscj8nLQD9smVgZtg5h+NJD/5JSnxokEsJXz80LnC1m8hergVMelFu ylMKliE0ViAhL0LJdCdQLu+Ouw+aE8/7REBBEFjn29lGQkMKfBhQA1Q9Nz0lBAAKJT6+XNwe DXtwNWOPBjVQsX1wKT0NPSpaXDiwR1vGdJUOH5AgIDnmV8K0MuJ8XAL2pLHCZBm9IplVATJG 9pM+ZWAeI2aVE5nV5pQfwZQfhlIBkUc2ybAi8hsFhqIse/b7rFpjbYfotc4k5pARgduKIohA gqxLSooyiJBkTA1+Pj17Zs5NkYggQWsSZoYmyAmq/C9x/9wXjsaO9I1C/prmL5ry9EYDRTZF UhAOUhyya9ymMC5yXHBPlTSDbhUcMC5yPCBPlTRQThJccM1zTcduMnyQaUU0iev8iH8mRXQj UxfuJzm1jGNSqhtIAfydfZgSBBhpFvQX/i+asulNFBceOoyIrC+asobSpHBuLc2xa/zAF8ae 3IQCQnSvzHIIR+BZT2ABPnSD35R8hVWkYPciRSjDdgvXDA02iBei7htZ1XJNTGL2+BOCLjRZ 1TIL/LpFwIySlTRZ0T5wfFIOXcM2C0AUClY35AGmNFnRctjEyv6wxzYL07yi3pCcpC8uWYI+ 5OTqppqya9zYxMqGuKRr3KZ9quaYhIrgaY6kxnhkaiaasmvcWERKBjgka9ymfSpmGAQK3Kbv nP335AGu4Mzn3aZ90o44JAJDUbRPlTTZkzZ0bH7GiCBPlTSYlt6csHrQS8OyabyHktO9f5jg a9feReT49rpX/zz8ZlxKkVIPzkE8F38yhrJGCsPLUYX8xzYL0xf2quTI1gvTIE+KxKi26qRg T5U0iJbKhE9+4DNZ1ZIDuLZ1URAHXtFHDgGjPgBtZ00GFiEmCOYCeBYGBRf9RAIeBEZEFFRG t7y6v0MUTkZBHwISRUECxeiuuQgRWQIJG0EXA2fwZx9+EwJHADwiBgEUA0QQHWZEAvPmTGwX /EfmhUXQ/xeCRgfUAkuWVyzdHQ38R7YUsvZlH2vGgxSSjQAiAUf+FJMBHq3+Of/sPbnwi2TW 5gv9psDQ/kc/b0uRbDsLSQMr/Dle3QHCN5cxxgBzDQyeFgjuBxnUGi6jWi4OrAU2A3TCdSyD lUqAFqJDUBuMwgvPDb4/FDGpzWa7mgPzGpyb4tmo2m30VDbzOX3AFQGmA60/TS/kBUr4CwG4 Pzl5qS0bFVkvQQuNllcCdXJvmqgf5Bp2GBcFu82LyUY9Et/GABG/+qZNbEs2aAEFAHJ0Ucwg mTh/1IJJIoVz3G4UetlwdGVHcmbuhgcX/EbwcNWWPCv9NjASEkUA60z8pg0NWT8HfUdojqSv AxcFSR8rf21C+mVIABg6Q8ViX5VNHBIbIHE/phMDSR63n/xYAhMpWWVo7fsnOzVVAnOZIAJ4 Abv45H09Os9uq+DUHUX4swNF7zF5bxc3LXGExoc7E+lUVjAn0UWSvQJF4H/Jo/amAVysByjs Sr2MPe+p5/6AFUJBDwMdadkeeU8/lwKjgYlULQPwEaktq8mCEZASh3/qPUEPHEmfewMddQAp CsJTjzFB/MfmdIAXPkDcg0HQArCZRfAxm02QFXLdBHWeQBdz54SBmHxKOCsaSrcnlY04Ei5E Rhd0B4GXuzMNScNFYTcz1Ro/MkgRHut7Dgw53Qszg9N69sGHO5feaDSD8sf47CZefBceesHx cP8eCB1KD5CNhuJPcP8+k+KH4VcEKwW07MVyFGv5qG1uoO56QkZTE3ZGdQcTRu4uuOUJJWdP dBFvRmJN1YNmLQWLYwVtSdc56fxVWgkwIQVGQbvZDx5jBQEBdXoFCwC4afyRe1ZJZUMHIg/i v995fAIzrzurQDci230LuQR7DRNBnmCXDzUPHUkoE6ZmxQ0cVTQRFIAq77mhb7NeDfem7QUq QXOZVQOXD3AIEwG5A+EFm1jDdnFhYQc0g1IVJOvSDDULBQcncj9qTSCHf+hBX/EqeRDsajbM Z09s738zya6M4LJgwVppZgMp61JqqAU0AiVlW2sTZwV/KGy4dDlps3ZJDWbshByZeVHDD2s3 maTD/CAfbW9uOyOr8FbaDTu5eekb/7g+C3u5MgdyByQPYI3oewlfU61sYX9u1+t403gxJbVk 95hmfLhVJQQFd3M/dX503xsXYVX9h2X7vx5JnSNRRavBzXXJcTNwFW15Lz/r+Lemaf8tdUEj N4/52JWDb0uRfGZGELgZPTAPKkEsHW5xcFl2GW8xHW8ZVev9hAN593Kdg98/CfVbXrhhP9GB fyopuPmYMpMJQ2QVcG83ItvQXWShK4th/4RYY7jNJxEsY3N7feAheENcMVcxRjL6bmlhgzkR QzvUy3SnOItRHhnzIC3jJtgGDRZzkdOOUxzjJZdbY5Rr0qZJ7Q8DWIe3bkYZw7sPGLXrCWk0 xy/rpknOff1yTz8CMeqbZJolXxcnPzG2hsFDyaF2j8V3RkJlDH10yWLKjR1pYXaxbk13d13C VmhxiXJjL9e6enFJJXx5MslEZyBEbHrVT3NRRbgShnVfYXtXmxKOKSQfkyT3MQnKl1TDH4uI zyAZ6+1MA9ZEXuEFwTZld3GpM0hEEzHjBSsfHwspGb1v5SUvcZvZAWFNbUNTJIkErlcGYxMu a1EYPjoHlyiLD2Ihj4EVz1VygQ4gcU5ZJzWGsRjSKQfZrURsG/hxoRkrmfZSFlVkOU+L6sku IjVzqZt43BIjFAd/B9XYDGepTQMCL08ThdEQmXurnTBbNt0YyWkfr2eNgsV++2RSf9ebBiTH ZtMSRWY5m74OENEnE5mZoiGmbSkXbWxrSBfUa+MGZSeRho7LTXApL/kDeYeizRUkeQ+1QWD2 sHHbQwvZspNiO8t/qx0VpxpJwYxsc0l3h4TpmTI2KwQ9OfWteZlLY8E8L8MTRlJ1rocYcyUu W39LsyWXC1adMXD6lSSCQyBTGyfMXkr5+U1uZNsMzwAxcMXXhaajUT+lYnVCzRppHyWkwqN4 AlwDcJjSkNJfJ4nfbV+4X8ddh3srhpaJpClVZ0NxsYBI4GcxT5kjcI8tddmr/3JdmncYi3vn G8YL9UPXazFhWRBV1nct5SpxHCUjGGZ1c99tF8WdZ4qZQaHBFzuUzXmZ2cImTxDboQhDn/cK bD8btT07dUsyx5MG/VJd/iR3Zc1xA6tyG/uxXZkF1TNFOQpNNS05EXUtazEunRlHD3slFWuO Jj1VLm8dgYcZOXdnaNsmwJCm0dsrVLDjx9MvAiH1N9aYY4HtG6a8sd4vb3c/NNcOX1ZoY2uh b2eMSdvC7VtkT21h7Xd7TXU3NxUUxzdd1U0tDUY8PWV6x2wcGWurehmfMC2B90yJGNT6ctHF ZfVuRYkHy8/9wUxf+mwrJSQ/jxuWJhTJIe1FZoSEN2fBffXpQ9NX8AARHTa1c6w9gAdSBVUb CwKH+jIAU1ETV0hPd+m5byelZRRkRCtVUPvnrs/HLXwTQjPLNVhwFn4hc69uKbpX9Xs5Iyl1 QycVbegnna0zVQVTIMdyHglbRgvBcEUIOISQ7dWRcVRgMJhbQrNxZ1dNMEhyzwJnxoZAADn5 Cy0SbkU2sQF1GSHNpkcdT71BGhIDmJnnT2VJh9Ld9OlZs9E9jU0pcDnfVg0ym1tWvTUFW9qf m2VvL0cHSjFOO0BwIkcx5QNP2nZZR8tj0AhE/2EDocJsFoYtEzt6j2ASa19np6Rp+JEV32Jr b2kfIklf//EfBgBTGfaPHJlVSZNhpcn+v09i39PneJOxT0fncv/5kBoeErt55SVYYiknA2lz o04EDSCBcZ+EHb6D5fsbBbwNbRE7L1FCXCQOAZ9HbiOZOihr+f82Lwk4T01GphOmfyNxVa+Z MiIXBsMit3NaT7D4MeHzwolndCMne3s3XAsHEIktXZepvTLUIw1zvwcVON5khlsUGnZ4hDBF uRWEgrDHi0WpqMPuCVFsn3QjJFZYTV21GeOAFbAvD0UJX0pfj619R3QVlOoXby1nfdkg182z 3S+bOQFYMftdL624GH4cYWzpINRIpk0pl74icHdRm79xWCcyzptbxX3FL00Re7ercZcGfRpG co91VMuCknQrC+PXSYywVyVdRwoB/Sg9tTciy2xSAOUpZzt7skxEZYlXBvDNyhtzDTxRy7J1 wjEVQSBtLvgtFyRTBviF1Hefdgs5h1vG/6uZXTNPMRynbQZLjdaLPX81BziaygxwY3vKEhtq IxRAhDKuKC1F5ATCEzNj6S3/QITKLAXnUVyxwL3X2U/ldCtFBoNB0m0fa2krRnOWEpqyER3j ueoWNJkXIC8y5wMVy8kSJgawE21DWyOSwoghYDlt0SRUlAD1AQTCLtL7d1XUiw53bSqJSVFR YJymEBk3T4wR3ff1iRJ+jer1KcElC08hhxWFP3NhJeuSXgRFV6KmMZB7HddNnSwEIgFJU8Bd s4wt32rwEkbUaVAPc80gqZcbFTsbxbL8KA0AHCE7xKLBcwkAE4tpiCJfg6t4VYWYWlsGUxYl I3R/3u5YESkLNC0+1E2lx4sYK3IICPSPSVBpSM0cNdffC0t97BkG1DkpOVf4GsZoTW3blxKx bsKRb2kDdz9n9Yca36MYqWHKRmKCYVedwm/czVtVOyOAVZh45RQRVdUb2dQTm2IjZEdmkAZ4 nQ7T3zOSk0eb85WM6E8AIw8Bvw7OchKzKwframVRYWER7weNmCR3DzAc28f5BiFBFRZfcCU/ TeFH1oDL0RdiymwNF2sJ6/3lbBQke08swMQ3rPFiQhcV3TqXAIYAFGVWLA+y1woeQzZhUA9O QBSFVvQThk6ChSmqpRAA3gckqrxRQFtFzVJTs6NWADoKW4DmeBfdAQPxEmKongCYoD4OQpuW qL6SlgGedR2opEl/AZF1QBASxRUARzyAQkYXE2rSgMyzMQISdMs2NVIXpBIOfoGeYDoInknm olUFgSaQKL4EadszGExTUnC2WnBWFS0yEW/DiIp8BQ4La1RGDC0sSds7oievVItyAQcDdIAY IkQDNAGOABAHRzGUDkAHX0IGgbQC1hRdImejFCjsChADDESkI7zg9kHkAZ0oHQEWRl4KItE4 M5agHQ9ke0waPyilAfhSV0WopUuAFhDQGkZDCna/DxbHUkPSLBv2BkC5f0dEcTBLSCJZXpMC TRR2lgpLIk9p5ijVQUl/cPR7KJ5jsShsIZiwTbIuDHFKl248IrxUe0abAx9ERwcCeYVeVSlI GEHanSxWCkwDZnEyjJyD8y8bTJ4OlHqHKgkMDxAVrcrZDQP3vRt9I0cSUkJLDHnxbcxuSkQZ Rb9BV4qfa6VSQQbNCPW30QrtM3pVVva2iMBwdnCgETU+ZmLZA7cmGO4PZAALVc5WREI1L0Yg rzba3nYpDCqGzcj1Fkd1InU3umK9BgUyI3aAxGDbjp8TSnQO5msOEwxtcv8g9kMzbHh/ZlQF lYdM116wDqcP0joZZ8492iSvD3MN/pVFFw1XFfoqxqYRkBFbRwtbHFc3ZIAN5sjCD01I9XIr 2TgIGXkE9Ptgp2YPDW/WEQ9QHk5iTobGHRIBBxTYbiJU0f5XbNbudgsZXbcttyiYEPaNBWGP D3BaiQ4pHkHzCA8Dk1OzVspNsUUTT5tFudA1HuxHce28DJg/ItAPxQ6BsCNrwB8FNFFL1rJN BBmvCVh3Wi0L2EQTbnj0xB12HhQYHknSDJ5gv2ir0dLiXfp8ZXCLwk28gmwVhtfY5F1sCkNZ U+6UiSBENFvaBqqekkss/UdeJRuHcZvZIDqsH6+jGpHU9CT3IDgnnKCDB3V9fm45oCmYbGon wQQZAFUPC2xo/SNIUnV+I54NWNSPG+pjUmD0ahkOKjGnylEoZf6AlrYCQZdnRVGB6dl83mRb ZGkNP9kP71QyS4wdlmsEFFgGxtgvrw+DDiRhhTNnDUeKFY4mthSyBCqHYqJJvuTU7ilmA1Fh ZQfcwpsoVipzVQt5yc30NgiISjMMRxtTQTn5GdMllcIcta4QaWvbTZYQjktOGBeGgSJTBkcE hkcXW4PKgpRaGykwFsAQhJjjqozS/xSjZwDQHu/iyRWJaeAMtFJ72AvIaR6BJpch8U9uHnVm s02gBzU15qYPcslGORjmwPzjektZCUQqdWdqRYCCP0kbkOwLeB8TUw9wIE4yjyy65WJi4MMy XfIOVjP2QxXGLyAAF0tsIoBXJEjAYFMGNhiRURgfFFQWzGJxjy8TD7CVjlVMKY4NdUnH3B5F tosEGMgiVQTTLXBTKBaK1sUEFZjICgyXaAIOnmlNMv8YQg1Bt4RfK7wFcir+BsrHPUGUFZIV A6cVBhpNZN6eFWRNKsqEAdCXO5AYHbMg5QQgVpFVclhwcQ15YzZyJYbUHcziIrE2ktGF+ESC YnguUURwy7ywVxECSVb7V1dFlvY1X7XU0CRj3wp4ZCCvvYEyXETuMr8CM/TG3AyHm0TuFkEH t0pp4oT5ix2O3ekRUg+PPXKExQqzFBARkUP3GI0LflVNNGc8DGyiPGO3Qnt6pmU52uryNWdr Kpwg/uGvio9mpXhXWVCxH3u01wVrGpGHFHgQWN0esUFF1W4jHtlCQgSd48YlnWc+zCYBKXMg VlGIYKAugbxKsDMmQ1De1W5mMZi3SS3Vn4hzTxaiVPWIRBc9hOW9YohZeAQvMzFPwM82PDDT OHsEQsRtDoc0los142pRgIbNbo7mR2EyDSgOJAM38U1SR8DHkJhRGFO19WgJMQsUT0QwThAJ kP/bEGEuplIDdUHJlBmncXXLV6QuZywEPfU0j39Scvy7fEWBg4FmxOYRTg9wQ6TK7kEOHYng gWPiVGkCRAvZysOJ6PhxA3EnRRNJUBcRIhIE9RD51ib2NNSIQlg0VGUFFIZaeAwbIxlOZigW nbBiwB4oEPPNUsCmVF4xHA/ezXIoD0CUZj7qlmJXQY5CVowWHlaFn1NdF9Q5CjhFI6NSeaUQ iOS8RXzebtgJNFzW5g/Cg2jiDWvYBDP2Rv/+Cg1wCT3BGAKeDygIABHQFBpr7iIgQQkDkmtc kUzl9+TOYXvaTSsfbvCMNrxWgRagrcGrAyBAqNttdpoMnrI0QkkRpDLezV4wC7P4J91AbAzA DN3PVJY8SkgLMEKFQARHzLFNGcd8cAhPkSOZQxCzExXwqcH0CV0JGkLTAVjvow6Aj+pAFrGQ KBqDdcMEEJ75YPQcgOyJLrMqFrCMVAwycXfrgwDdCXomVnPVLDy2LV9oWZgwIRDPdhYFpwhv +KYLjeoDtok6GCZdQkQIEhAcFEJNElNqAhDGOWQRaVIGUqbWCQIJxKJ/JFgjTR9EPfzO3gX1 l6U4BBlfsxFNMqL+ENCwBytzFi8aQJxCZ3070GAKEJgR5Qh0sX4kuCVXSVyaLQQaMjaaOXlX bhnqJsCXY3aJOy6fjM1yUgLoDGWoDMAe30jL2C0bdySeUVQXERAcSRJWDgBAa1D0Q94I9AzJ vE7SpKAV5HkGKlnXqQAOlhv1JYkN5N4ndo1GxW5ONhhi2Sk2//xBGFqG4HU+B804lfsCdlN6 cwAGt07sULBoX5genwU7tAE8YPsJ8zXVltneSpQdX56S1bAiEOMSHHii+FAEeRgN3HhwQphR BpBi97JRbNLtSnMeC4cWUnhS8zpacyBJbmGGXM4gD2no4auLiSbJvx81Z5iEk1gRdjaO9AzS G9tNI21jJAuIUEOPGsKzwgtFZy0NIXZL3KSvUCV9E1aqFmTAtyIEcFIELqhBG2J3IsJ3iJIN oiTZOLQaEThb9VQvDYpmWOgTNbIJajeXYqoV01fbmClcSdxN06LIrq5BX0eqFTUMQ0BTolFH Mk2V31N9UWglibtSl0e+V0IuhiemSFHaXFwkolNHDdQhfTJ9U0FRTgxPtFVL2hemTTaNciFD E6KSwAnkwHQ0EGS3cVY5HESPXhrjIEEQOVvyQN+YkiwWRG8bXd44gYbYVdBhh4SVb95sAYVV Sow5GZGIXcCdShp5VWSvxUP/kHvEVRYOW0NmBhWnHLIRtSCcAUXKQBwfGqueFG37ZU20jUDr ZURrcW7QZU2UMm9nAUI0TZQjWSMLTAwZZx+WcQ1WEQcWIVVElFMXnhC52+L9QwgdBUAJGQ5S Bj4LQQ4YC0oGBSRAHSwJve3r/VoWHR9LDhgPQBQLF08FERFMBjQeTgYSB0Ewy9zwfxgKTAUe CUsbOR1UDQMcQA0RI7p2b2lPADcWThQdM0QRUCQqOO/9uS+PiXFFMjlPEPpvWBIPb0MkSRg6 VSUNZA4HZblbf29ic0UAaAl2IFs6NjdAs+L99G0HO0RIICJWEBgRCAeJYEIA7/27P2caehRU HlI0ImBaBjQvtoMVIX5lDB5H/+v9HQAxaLY9FXmTPOQeRFBYInJMXE5aGeQGQPBl8rlv6wBk H97yUgJMvLZBECwhUORiR/CMALZeFf2ZuqufVScKJXwaI75GuQQwMh0mSVB6vEFg7ev9nX5E Fn4BunjxNzIzdzeXwvVz5K9ETzk9OcLr2Tl2VBZeEBALBn0EI2FTyUFphEKkuQUC/A18MVci 8LM6A7F/8rQAVx5rv+n9q0MwOmUoVCJmFAUGZVyQImxYegEIGQQJTvYb8CIANApCFAYGSEQg WmjlVzS9OBgGVhUQDE4SGPK5t+snYwgIJG8lNyoPLDAsd1iDOjMxtlxrEl99v9/KcChXNRBH MgZCVBWLVVgPLA1wDwZ00DXo/XgObyB+Jwwqekt6f354sgQwfZMRsHkZONvHMBJ4/3iDwCYE E0IRHF9aBJuysEkcEloQtjdOGOvdtv8CBrYWFQ9jDyMeAnlnFWIPPi5WDQREW10NDbn/o/19 8OwCtooVDhcPPRLwHQlX9LU+DVHwaQNWFwQpuf9i4Vs+SJIVEDgVbVjkF0ctCSpUMBMV6hLO tL22PAbJgwKOQhmGETsKcrWEfxAMVLumtH/CNwxQF19Hn6HJjE4oABFgNxT9ov8DlY86TF9J FMGA384AtdlhTFoZG1aatmFNWY6Hkr1bc9z8TRQOHDZEGBLSDgAIPQzNFMAYK7sphUR6ThoB J5/Wr5UZZAkKXwgOH04XFRhl30n6uScwJWciI2RBGzkJdhOYQncEQA+MmH79uX/9BXkxJQNB vT09cl9Zc8YHSQVgBwa7XUNcaPRvyby9wGJ/UMEzHw8iSUxBfUk+QWoePeq77zRhBzYyRS0T KkM6ZvJMAc14pfwZCbYcFysqCDrknAwTr/AQynNUERkhsXBv+blk8ydB8I4D8CpVfGzwKIcd B00wWVg/WXcTlzBWGQu6DGjoThpodCJiw98W2LGkylNaDEVID8r0+3AxHE4kEhp0FhannfrP YlwGCQ5c0BwVWtuX7t0XGBRjLT9bSBASCICuBJRNI4ISNx74/XHbFiYTXDUmWB4PI1hGAQVx d6J2bTkEJnwkLZK2ty0LeigpJGUkBb27T8wSSYqnklUTDxkbLhEn4BMMG7hvz/1fTyUTtn8V J34wFDZH8KADUjNiTgkRa+3wDaKwSjgbBhIIGFQ0RuT9mfo1LIhiKb1NRWQPINqePA/wUgBV 1uTnG4FfLtYgT/J/PQVJ/MGLPq9aFWRMCnvyAo6rwpksJbsMZc5DNST5kVRiXBUZoNT9YGgz ZnGBCWu2Kd96ZOQwQjCDYoFtwhEXRWB+MjX/6/3xAAFCLeQqHbbxFAxRdCFytoYVC2UJMR1S wTfDB4PP/XjE5A5HZJMPZAW+8EdG6zVwvlsJ2om4MERDGPJDATYxti8VF7m/6dntFlAYGxAJ G3UvuBJcFiYuW5I+dlUxWi+7t0/jWiqRy9EWagFmwA+DFTYxBrDNZZdGC6ECTQoGFXy/JESx FB4FRyeABDsSAgRRnUfUh8EOWIBkGiKtxhKHX/zeLf8YXLhlY8cjThTZF2U/aDR8CmUzV5MO G0JtdY572AwHXQwyQTDWbCfnHw4eSl1LyGQ0Dg9BGKQXRK43Aw2lR9TqPQQMpM79FirCEhvY cQc3KwdUBFYMH/NIv+T90TPZnANSRz1wNSY/bhAihmXwkAFWb2WBQHJJGf3QADIB0+n9uR0M E38dQBJURAoPzBFgB2bw9ANDOz8XW//x77leGRxwBbMHcSsNElQdTxwyDYMHxxQZ/Sn8YwNU CixqS5CYPWxNIzM7DTwHYQ0qRXC0MbylPzQTxH4IBfKa6xhz8OvdLFgDFWtYClsIMp57DlEp Mnvw6n3FhXvtPwGnOPgY8nlHQTaXY3jvtbke/WIKt45XYyCJnUdMj0C2EwKQIJY92fCbFVlb NGNeRDrsp7kFF5HCNw8kQygbQEOfcv35tNQ52CxdGbYyFYC2EBY3SDbkCkcv6/25yAooAuuH z3dcA35UDWEHMwz232MmeneEwhamTfzr/VZLJQ9qBaQMxMANW10ea0V7Yla3th8gF7n/xtC2 ykPHwKAVkvNwSMQnEAd5VqgEeITto/paOgAhS1ohDUMYEdBAGnVTvgtLrj4xRf1GHlYbWHvE esm2/Q1E7xbntxo4LusKFg4cDJKJoO7vAUMFEQmwZnoACeAbCXUECC1M7tXVhhsYHFwCCuZF 7YLZ3xsEFmADtQ5bIhg2RY03+xcORDlRr/Q0Dj8XRVUpuo/fbhcfbzoNFVQ7oO3LuQEKZxZU SF8XuWkxDZoURxs6KykNDAtw969AJgcNJm4MASNIIgLv6/tyA14nPytMFwgXYCW/slbe/Axf E/4eWCKaNzZzucpejyEaZ/4PvhLgwGRnI0QoWxsxHv0gjwJUXw4YfSjvz5QgC0ddBVkICUYs wwb4fh8vHuQS5xVAoggaAFxJuvpChx4JIxU6bAkrDKskZykxAnTX5DV2IjUqYCYwFWUGmkQi r5cKQjy1sMe5ssuBGxkUviYbH0gefhiR3pRSnyTqHHQaPjp6NIkCp4q4oz+AKRBmYIcSbigE xHtNwgJedgGzZ4W6BA/uNgwVFEID5yV6222sTq/TAuKLYC5hAlAATxQ3JiC1DZRuC04Ha41R HAFVQRIPtvErGQtWBxSMQFTqGR3/KR1QJAJeWXktB1gFHQRTDhIJuQLrNVcFRhoSPEM5cCk/ gvGhHV9P8Jg+X7nsA3Tw4wIyZDYDQP/ip0SyEATwESUCaN9iFMFwBEKl/+vejrHkaURFNxm2 FxUNbVlKChdMvJau+qtNVDFElyAcWcZNDz04i/+r9l0YCJMQIgDoSBswN1VsG0QPBVUtA7/p 3aQvbBuggTpSUiXNTnULGYpLC8Cjtuc6vLtZFrV2bQmFp8QTqx4wO2Ad/OuVb/AuAA4eO/Ig AQI0UCw6Fjrx/LS+v3lxUVMb8mEBPIG2/BQtXAtjgR0FiUpkK28RfgPuWStwOBpVDgevXhIL ECuB6/25s5YeEBo+iW6KPxQ+IgwNXDctNdo+GzzfJh8VbtGCCkgDVGRRI+sJXfz3W0wa5DKx EjpA+SgKOWPmA222/0v6tlEW6SaE5BZHDMxdSPBlA1cOiQV+HXsv8wt9IUmFDEWvGWQZudLJ AJFtE3d0M3Uebw/GHR4L9W229g5AVh6+r8VBbxwOCFQNBpJW+UNadvVeFr0fQ0IO2WP4kYta InyU8xXkYIjwkdkwgxrvtuEXmGQiBTos6OuHbjdxKQEPCyJDPj0tb6Udee+HIehE1LaRZkgb AvlbobRrCjlHZ80YAmynkP25ApMRTUIBy1x2MiMvQpLy3wKrwITG4h1iAgRCCy+fCdIFFTBj 2w5dvgoDDVZ2AQRLETYFTgWs8rlClctURQYHZxFnv1txChNAv8VsccEREEATDeJ1H2cUZizT vXb+MZIvGCvA1H7k10Qh+Thn4BJ+Tw+TA1VIsQ7x/+sE8QsAdShwMYVxDytPtk8VL1DmUxO5 wg/9KykMINkaCzvbIAkUFQcWJGykNzwqjusZAWx8nbbJFRtvTZzmWgiR0HEqowJABg9PDZUS rABDUxWav6e9R62Xa10O1ypbHwwXKlI/qXWQlRZGOVSEWhhEYcfQebWG0T7ryPePGg8Lo/Zc IiAitf+6g2DXBV9dAwpmFkAkcgpAUQo6+1hWPlxQADp0cE54hCQorQ6GoG/gRiEnOEYQZMg6 rg7a0uZCABbJBIErBlzB3uI2RRzlRsKMEmgMQ6lYIIVyrg1Dis6/xVjKRwgjQCUAE7ayK2Yq X8BGDAkeklOq5KFHaFPTXWjuL1gtV0AuhbaNfEcS3aY3riIDYSsU4xIfPEQJBxF6LunQuTZ3 OUsJHRkHClnYQQ4fBF/iGgfnpU+3KvYSECYLai8TqlV7zZgeb/HSWXdLFQdXVRIzLGZWf8fw Oz0mTOERDfKire/AEFUEQTdvvxfpSR5XHjcM/dAirl1ar9dsjq6BbQx6Avb1Fo/nPBIfTZEH vZu2OrdlMpIKFwdDMGAVEwRZ3g6ruRGbc1Y+MydDHWpuTwVWq/F4laQqK3NIWkJING38a2m2 NOQjR5U5FndA2/JdASRXmfAlWbnWHwvxAW7vBgEwDWqCKpYl08v8ufAXAxc4LnZB8E8Df/CH AFBD5M9HTStys1+sV099ExViRx0jtkoWsRHtsRRodOTecZjMBjDIm9m5dhdSKco8ArYBFgm2 JhV60iMV/av/6wz3RtsMKPAfAWJjARByHDUptikki3Ud0fI6ATP3cTD172E+dtdP4GkSD3c6 vadLO9DfPgyhNkivdzGmCDRyOi3+Hb/FEHBdfHceK5vs6AF9MkgcMpQs2wY1TmK9Bh4Le3e/ 32K7R8/kJ0WR5KnwZRwZOgsP3qbCCxwlHSNmUSCrmpn9S4BHPUFVcmtzkmHwyQBpUxZ9mBS5 /HH45CFHLAJKScnkP0Arn/Ls1TvSnW/6QkJK5EzYwLUfzqkSYvzbD7ZAUg4rfJxOhkfQMTK6 /xkgURFmxhlDKjQplX85VNAzWqZvxC+SS+RDRKUKqNPf1K9QicWhGSVyEHRMVfKTxhb9hQJH eX4eLGFxIyLOvbapsv5DdLRWzE/rJCEMtlkI6m3DbWMlV1QWje9eCuURSCSOdP/5h/HIhzVc PxVLHLh8AbZzFXz/Bfdh8wCAQfF1CeFZN9xZxVrllUQFHwdcv9VVS/AG2VA0GhVTLm8ZXQWq PkmiGANf2KKPKwxUJ24gFggCCSNI+u1YDkguIQ5BIkoaTBx8gvYIFA38BXqHAOOkf0EsuYiZ AhNPZhkfH0EW9EDjViMA4hIMUoRWAl6MJFxqTEFMIiIQVRn0Rs0acBAYR+lWUimN0CS4HVnI F1AVC1QOXQ2PxQ5yp3bDURIaq0IU9JDAvKHkVmKMLdldSQ4gZk00GADAGMzInyVd6FYGkxZQ DBoqbYnPyjy5CyMWLGmTVvkcgF3wMv1N/R8RVCERVz0ZIsYIBw0mQxpPDQff9merGg8aQU9M DhVAEbdjjUriKWQ7NJQOcS7xBw4yVYi8/bmeYiFcEl59O1N5P8NKOEt7HJ8Acd3hSEFqvS0C FUon+LVAlldFOs5rTdO9hv/5TnAyDPlGFlsfahkxVQkbRmoLJj39GerrO1B3CThqN745DpAz LVBICTZcRAlnWD8x/bnboypIKSVhYRJLH3NRW14yMQhJXswtll6YDOyE/xZ7WwGhBXcHdkZy rLoFEwapv4OSFfZBzTXLhgeXXOSt5AFOzFw5/EnBFZS/ed/4HnpIW9IRLkoPdAdhhE/T5tFR gj5fBN3k3/5MiA8fKVp/Lh+wBypRcP+Z/Ot8fofNOxtU80RE8UYnLxFjd0LVAKjG2DWvbAxG gAT8OXtfGBBB9CljDg2XwQQ3BneEJSUYZZFJQSXw02NP6hr5xBk8tmcVdD8NKZNI4QezKhWx bCmWLww+0eQNj9trgvbSNauLJDAsNjp2cemXfr+G8JvmSylBQ3AFRVedmhQ9iQde/RStOftL SRIuQyMPf+YRJrLvN+w3L+Wc71IsFQQlEPaWHmCvIEF1d8sz+qmKFP8PPiovL+QkY5kNdl6d QGrgHA1VP2fGhxpsEFUIEwVHIAbZpla2hR9pDRxiPxzxqHujBSoEHCFKQRJzTQ0KEAELaAK9 PB8hCgcEJ03GjQbc32FjRxjrEV8bGRtSBSczDv4XDE8FmzAr0CeoU/HNB+/ElcNgmxgBXyAS rBKBOgpA1bY1br0tN1oo9ZnrLAaV/vz79H8jPUgdDgoTUjE1j8/1FDJjzeyLY4ZVEsfTGCJC UjGLp7KXwqYQNxbICC9IyBQM/rkDtROuQVQeUfBEAAdM/RDLF8/LuYAVTvv1sSkbtq3y3QKk DmUtey+6LxQndDoeJFofBijeD4g4ZinxYCXjeClfaxtyfJxpobm/1wpsER23SB0dPlIPA3Fp uFIVZA7p/cMuKAVVyRMLfR4/DVJjE6J1Ghu+aErrbZASAE5qNRsNZBJFDFswIGTL3hEER1IT +ynd4156AhQkRQV+KFwevUT50ORe8bsCK0gb7ABE/1JfRQm5HV4JAAxSHlS0Lv7rDGUiGxJO FRwfS88sBUsZyAkT4A8395TkOEcRXELAyB7gRwiXSF2h5gndFD8/atkVAlQWyAwyg0ZZ9SZb WVIMY6+5C18TVsY9BUG/L03yiBQNVz7hXaa3PSNOUZGpQV9DVikySjm2nJEUnGo0on6nv9un Qp21XQId8ozySBpS/8bGj2AY7FVOKwy51kYBee18rw4BY00AE2KvkhLoRgc0GBnVwijnOtYW WDOGAmyZcJEQ0oB4rwK32VId3w618REGCFHc9EDlC1h2TkB/Ili0hKlbixkxPNkdXSbhO9BB Ik0Kwx6vbksJUQtQax8V8B4tMfQqHZFAHAFqDdtWqVg8PuheFh9D5y2BIjg7JqybtfkmWBAA WHoxRQVWcgfXOet6auEoLlhNIwwjXxkFCk+bvV2F5gIDZg623dCBmUSdAgReUGpldizt69k5 8PoDERwgFnIzVy9PMh03bliYDU8pHVjnv+kkFkTkVkcVNidtFZcHu8VWofO1cKpV8ZtcXVvp xFRtGqVKFlhPLt+V9Cm/5QoOPknCtnUVIgHQSQEKEOSxR18O/sTjVxS/iwQFFBFUn56ojzjI BwkxXz7VDcOtf0bu14cF2AkG3tNoFnqMGRlnT188bimTHRFIF0IkhB0sKko3tALjHwuw+AkQ h70dee1YlAAPSzIRD8qtVaNrExEAWQxd4QRzjxdRDRwBoBsA20mBkVBRJwHVShfKTlFKVvNP pR5CDhIwBPULI9hnDjt9FQeFuXG56yO2nxc6ewUPA84OfQdnAT4H0/gG/QUF8gfZBYYT3gUC BxSUsVysvwhFR6wRK0MoJghqMo6O9tCi9HpMDEDQgRCQtjUfGTobHxBNGuc9qm63v3PgGV9O RxULEyNiu7MXgpjBa3yHekUGNHUdr8aZWns/ZHcQ2UNZNBJVxn+VTG0MwzyGHxmD3JlEJaED u1crbujrsVBpuhM2NBoVPNaYCm9AD0sE3ONW7AmZvxtWSlQWREsxIlVWISgog1YO1bsNLbW+ F0wCX/R6AFEuDzJlJBshgsECCMxLAQJQxX/CKagw5bbxFwV/Bz6aw5tPoax9HQ5E8IABCSDL xShLHlFDLhI1aBSF0pgOZi+7BXcsbxtkLvK/tYDnEFRlGEV8ka/DGIdd3F516sc6/joo3P1L xx9cTEYt4+yY8Q/aNgcubh15q7i8Gbh8EztQxxUsnVZU94fjKWQhnig6G1C9FJFo0gGyIkgM HwVQf8JphRMJanJ4FgWuqrfrFyYHO1MELGwIk938BRnPfgEHSY0Y5AVHYbWJKXdcHFMaBxBG sZYPu5dO4BUGIDZNNgJGSj1hh8Mm6jJJYYAUXgbGFm8vLQqGDx/6MK24NVVjtWGMHgAqRyVa Bznb4hUuVdEHmwUDBxINVwAsbvbvqzoRSkMjEUdCGXcHJ0ofg21w9d2wQqwH3RkRazEFTnZt tRlB+T0iVEOrZNmmqa/FK+HLBz4FXgcuBaoe+kksjF9u+RncORZ5lwv27lBtA/kA38gxZyk5 40NYEfANBS0HB7qaOTiLESxD4osgQzicdFNa+gkq5IfkeaIRXUNvPctwQ5ow7bwGFUbNFR6O NriaWAP4A73KNB5GIB86ZkAV9D+kLx5BJDBCWipAAhr4kRE4HBo6wIiff8YOOKCqwHu7ZhM3 ERlcFsoA2C0KXwBcHKqqHOe2RB108IKfPHkMFzpIEtlrEaEMZhRYndVCXxgDAADBDgKJm9pG upKrDOX8e1cMOnDoewwGXi0zUVWG2mFGIDAaPoe6KUY3PzJmhDQGQb0defEoFxJqMBBSK5gd 3IpseTWZMR8UPeYYDs4fmh3Ya99cdqBJABj2CkqmAdQuZpswb+i9Yxb0Rsl0biz1ZPXN3QZC ZYo/QAsYcrbTkWzeod8dVxddmUeguGw2DSbuQjgQC+pFaKpiINjnXcCaQq7QNF78PFS+kZ6P bl6puwBPjVCvbuAYt17rY/6rBRJ2ZvA8AUoMMMJiHOSKwtVTYzKUFSe2PBMDdDJ0U04Uy3yZ bzryonRIC3ICaFZC8GRm8SOEAHY6nBJGULyyoiAY4C/AKkXn6LIdURARlIQOn0xHv/Ieh94d BdbIEw8DkJkfUgYQApNB6v1GUFECRkwVBUZOuL19APQC9m4/s98LYgp2A7QWruwJblYDVAdC CxZ+HhIU7kEA1ARLIFS2QFUE/WrfjzFPJzThtgUU12OMHshzMBiSEmCvAyYXTAJGsQ1Gki66 4XMXwn/WKBMEOyA6Q/xDEEu9oHpshL5KPkMnVPcJbGcCL7rd3qYnFo5y3QNuL1D/8mEmmiBK 8oBCaGUEKcwBsNthCKBwRyFCor3HV1LkDqS+YWW/PyMDxlEm7DNSRrCU9D+7DzK7F7/EQOvm BEYAFAJGAFQAuQAUAkYAFAJGAJR+YggVDcOGFQJGYKosxkQUj/jSm/m5V5fPuesZktaQngQA iBNFR9thBc0el+y6Ec9wq7gVAkYAFdkzB58cxe7oE50R1AOdc/t3T4sKgaj8Bdk15CXLxegX cEvB9ArMBlKBtv9gds/FFdkzB58cxe7oE50R3QOddROJWIP6/lfbBcszIFUDnXUTiViD+v5X 2wXLR9tn7TMJnxzF7ugTnXPwgYcClf9G8+v9xdEVj1Ivl/+6dhuIREKcBQFJYfWvY+v9uZCf AMXCEItBg9MGxekQdbcB2+sK/+v9GInju/gnFALMB1MurjwVdbGAKw8z8p8FzF8QZIfoHMOG EJLGb/iU6a4B5ItBg9MHz9j228u+FLJAAJ8FT8BgR81fEI/CMMwXQQAV8RaD0wq5lrQUQQCB iEFHHMIy3J37PwcbtUFHREX/V1zw6FXrlOIWEwJPwGAFzwOXwULrzGN3wNYORoPTBste6DOG ihNFT8BgIHrvYxNHw58BwMTVwlaG0AO2iRfppCQbw6YQcolBg9MAreJ16xz17P1GABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJCABUCRgAkAkaAEgJGAIQDRoAeAkYA9AFG gBgCRgBEBkaAFAJGAK1LASsUAkYAFAJBABUCRgBsAkaAFgJGALQCRoAXAkYA3AJGgBACRgDk AkaAEQJGAAwDRoASAkYAVANGgBMCRgB8A0aAFAJGAK1LASsUAkYAFAJHABQCRgCEAkYAzDdA ACADRgAUAkYAFAJGABQCRgCtSwErFAJGABQCRwAUAkYArAJGABg1QAAgA0YAFAJGABQCRgAU AkYArUsBKxQCRgAUAkcAFAJGAPQCRgBUOkAAIANGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJH ABQCRgAcA0YAYDtAACADRgAUAkYAFAJGABQCRgCtSwErFAJGABQCRwAUAkYAJANGALw4QAAg A0YAFAJGABQCRgAUAkYArUsBKxQCRgAUAkcAFAJGAEwDRgDIOUAAIANGABQCRgAUAkYAFAJG AK1LASsUAkYAFAJHABQCRgCUA0YABD9AACADRgAUAkYAFAJGABQCRgCtSwErFAJGABQCSgDh DUYAFABGgOINRgA8AEaA4w1GAEQARoDsDUYAbABGgO0NRgC0AEaA7g1GANwARoDvDUYA5ABG gOgNRgAMAUaA6Q1GAFQBRoDqDUYAfAFGgOsNRgCEAUaAFBJGAKwBRoAUAkYArUsBKxQCRgAU AkcAFAJGAAwARgBQPEAAVAJGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJHABQCRgBUAEYAkDxA AOACRgAUAkYAFAJGABQCRgCtSwErFAJGABQCRwAUAkYAfABGAGw9QADQAkYAFAJGABQCRgAU AkYArUsBKxQCRgAUAkcAFAJGAIQARgAoQkAAwABGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJH ABQCRgCsAEYABEFAAFgBRgAUAkYAFAJGABQCRgCtSwErFAJGABQCRwAUAkYA9ABGAEhEQAC0 AEYAFAJGABQCRgAUAkYArUsBKxQCRgAUAkcAFAJGABwBRgDoSkAABAZGABQCRgAUAkYAFAJG AK1LASsUAkYAFAJHABQCRgAkAUYAGE9AADQDRgAUAkYAFAJGABQCRgCtSwErFAJGABQCRwAU AkYATAFGADhMQACUAUYAFAJGABQCRgAUAkYArUsBKxQCRgAUAkcAFAJGAJQBRgC4U0AAwAFG ABQCRgAUAkYAFAJGAK1LASsUAkYAFAJHABQCRgC8AUYAlFdAAMgBRgAUAkYAFAJGABQCRgCt SwErFAJGABQCRwAUAkYAxAFGAEhbQADcAEYAFAJGABQCRgAUAkYArUsBKxQCRgAWAkYApAdG gBQGRoCqB0aAPAZGgBQCRgCtSwErFAJGABQCRwAUAkYADAZGADBeQAAEAkYAFAJGABQCRgAU AkYArUsBKxQCRgAUAkcAFAJGAFQGRgAgXkAAfwNGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJB AO19RgCMBkaA7n1GANQGRoDvfUYA/AZGgOh9RgAEB0aA6X1GACwHRoDqfUYAdAdGgOt9RgCc B0aAFAJGAK1LASsUAkYAFAJHABQCRgCkBkYAtF9AAAACRgAUAkYAFAJGABQCRgCtSwErFAJG ABQCRwAUAkYAzAZGAKBfQAAAAkYAFAJGABQCRgAUAkYArUsBKxQCRgAUAkcAFAJGABQHRgDc X0AAAAJGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJHABQCRgA8B0YAyF9AAAACRgAUAkYAFAJG ABQCRgCtSwErFAJGABQCRwAUAkYARAdGAORfQAAAAkYAFAJGABQCRgAUAkYArUsBKxQCRgAU AkcAFAJGAGwHRgAQXEAAAAJGABQCRgAUAkYAFAJGAK1LASsUAkYAFAJHABQCRgC0B0YADFxA AAACRgAUAkYAFAJGABICAgBCAgUAWAIHAFgCTQBAAgAAQQIIAFcCCwBbAgIAQQIKAFECRgAU AkYAFAJGABQCRgD4JEEAtCRBABQCRgAUAkYAFAJGAO0kQQC4JEEAFAJGABQCRgAUAkYAEiVB AKAkQQAUAkYAFAJGABQCRgAHJUEAqCRBABQCRgAUAkYAFAJGAAklQQDQJEEAFAJGABQCRgAU AkYAMSVBANgkQQAUAkYAFAJGABQCRgA7JUEAwCRBABQCRgAUAkYAFAJGACglQQDIJEEAFAJG ABQCRgAUAkYAUyVBAPAkQQAUAkYAFAJGABQCRgAUAkYAFAJGAEYlQQB0JUEAFAJGAGQlQQAU AkYAaiVBABQCRgCaJUEAFAJGAIIlQQAUAkYAsiVBABQCRgCgJUEAFAJGANYlQQAUAkYAFgJG gBQCRgBfRxROUU51MjpGCkwUQwJWVVIPMyYsAkxYAgVPWUESTCcwaERYTkZHUEt1MjpGCkwU TxZSOkYKTBRNCkUnMGhEWE5GT1hHB1VAMXQuUE4KAEFRA1InMGhEWE5GV0dNBUsnMGhEWE5G AFhtJ2RYayRydXA/QRQCAWVgUjRvd0MiZGZnNXMUAhRlc0Eqb2dnDWVtAkYAXW8nZ3FOL3Ng XQdkcAJGAFZrMkJ4dkYAQ0wjdFduKXNxRyh1eQJGAF1xA3FhYypHQUsCABQCFXlnUTJyfWwh THFsRgBTZzJEVwJGABQCRgAUAkYAFAJGAN4rQQAVAkYAOwJGADsCRgDgJUEApCpBAHgrQQCo HEYAqB1GAAQjRgBUSUYARElGAHBZRgBgWUYA8GtGAOBrRgAQaEYAGGhGAABoRgAIaEYAMGhG ADhoRgAgaEYAKGhGAFBoRgBYaEYAtGhGAKBoRgDMaEYACGlGAERpRgC8aUYAxGlGAARuRgCE bkYA/G5GAJBsRgDkbUYAJHJGAABzRgC0c0YAYHFGAGh3RgBQdUYAPHpGANx6RgBce0YAnHtG AGh4RgCIeEYA1HhGAOR4RgCMQUMA9EFDAMMrQQD/K0EAFihBAA4oQQAgKEEAWihBAH0oQQCQ KEEAtChBAK0oQQDAKEEA/ChBAOooQQAGKUEAPClBAFUpQQBEKUEAaSlBAIIpQQCjKUEAxSlB AOwpQQAPLkEAXi5BAHsuQQCGLkEA1S5BAPUuQQAQL0EALS9BAHMvQQBoL0EAhi9BAL4vQQDU L0EAwi9BAPgvQQAVLEEADixBADssQQBQLEEASixBAG0sQQCQLEEAnixBAIcsQQCLLEEACAJQ AAMCXwAAAl4AAQJcABACRQAcAkEAEgJDAD8CXQAJAlgAMAJmADwCbAA9AmcANwJkAAsCYwAy AmEABwJXAAYCSgAEAkgAGwJLAB8CTAAdAmoAFAJEABUCaAA5AkYAFAJGABQCRgAUAkZAMHo2 JCUwCG1hZjZAQEwLVVBSRkAwejYkJTcIbWFmNkBATShTYGMydWcCBiRscmIxIkwrdXByBlRb bBRld2cvdnECBiRscmIxLEwrdXByBlRWdyBmXWwwYXhrIgBUJj5wMDN+Tnl3InBUVwJQR20l a1FwNG9mAgYkbHJiMS1MK3VwcgZUXGMoZHhnNEViZyh0FEJieGQmdzlabzNkZEIST3pHNHJ7 cAN2cWwyAFQmPnAwMHZOeXcicFRWFXRmZydtXWwwYXhrIgBUQgB1emEyaXtsNXV6azJAUmso YXhrPGUUQgZGYWwldH1tKHNhbC90VEsoaWBrJ2x9eCMAVEIAdXphM259dgZGfWwnbH14IwBU QgB1emEzbn12Bkl6azJpdW4venECBkBYayBlYWwvdFREL251bi96cQIGQFhrIGVhbC90VEso aWBrJ2x9eCMAVEwrdXByBkZ9bCdsfXgndH1tKCRlczR2FEIIbWFmNkBATAtVUFIGAFRMK3Vw cgZUWk8TRERCYmJ3djQkZXM0cCU6BWx1cTVlZ0ISQ3tvNm96Zyh0FEIIbWFmNkBATAtVUFIG JHZmMnIwczdyYgIGTnl3InBUVghNQUYWQFFwNG9mTydudWUjcjBzN3JhcUZAWm8zZGRCEk5Z VwJQVE4pYXBnIiRlczR2FEIIbWFmNkBATAtVUFIGUGZtJWVncQ9ud20raXplImFgY2JxZXAw AFRMK3VwcgZUWk8TRERCFGV1ZgR1cmQjcjBzN3JkYT5pZmtGQFpvM2RkQhJOWVcCUFRQI2Fw UTJycWMrJGVzNHAlNwVsdXE1ZWdCElNgcCNheQIGTnl3InBUVghNQUYWQEZnNW94dCNScW8p dHFKKXNgJjdxZnRGQFpvM2RkQhJOWVcCUFRRI25wQDNmcmc0JGVzNHBsYT5pfQIGTnl3InBU VghNQUYWQEdnKGRHdjRldW9icWVwNjEhQSphZ3Ejc1RWFXRmZydtFEIIbWFmNkBATAtVUFIG U3F2Cm93YypQe3AyJGVzNGkUQghtYWY2QEBMC1VQUgZTe2EtZWBHNHJ7cBV0ZiY3cWZ3NQBU TCt1cHIGVFpPE0REQhV0dXYzc1lnNXN1ZSMkZXM0dXczcVNtcTJleUIHbmdrFXRmayhnFEII bWFmNkBATAtVUFIGV3pmFnJ7YWJxZXA0MSNPI3NnYyFlZ0ISTXFxNWFzZ0ZAWm8zZGRCE0RE USljf0c0cntwBgBUTCt1cHIGX1dtKHNLRzRyS0MiZGYCBk55dyJwVF0Fb3pxGUVmcBlCYWQg ZWYCBk55dyJwVF0Fb3pxGU1nZRlEdXYnAFRMK3VwcgZfV20oc0tPNWdLRwprZAIGTnl3InBU XQVvenEZTWdlGUV3ai0AVEwrdXByBl9XbShzS081Z0tHKG8UQghtYWY2QEtBKW5nXQtzc10P bmJRMnJ5AgZOeXcicFRdBW96cRlNZ2UZTH9yRkBabzNkZEIZQ3tsNV9ZcSFfQ3EtAFRMK3Vw cgZfV20oc0tSJ2xxdjJlS0soZWACBk55dyJwVGsoaWBrJ2x9eCd0fW0oJGVzNHYUQzJ0dWEu SHttLQBQZyR1cwIPbn12L2FgZ0ZfUncoY1ltInV4Z0ZfS10FUERmI2JhZQ5ve2lGABQSQQAY AkYACTtGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJG ABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAUAkYAFAJGABQCRgAU AkYAFAJGAFBLAQIUAAoAAAAAAOUxcTKhPkD33lUDAN5VAwBXAAAAAAAAAAAAIAAAAAAAAABk YXRhLnJ0ZiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgICAgICAgICAgICAgICAgICAgICAgICAgIC5zY3JQSwUGAAAAAAEAAQCFAAAAU1YDAAAA ------=_NextPart_000_0016----=_NextPart_000_0016-- From owner-v6ops@ops.ietf.org Fri Mar 18 02:29:59 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA02488 for ; Fri, 18 Mar 2005 02:29:58 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCBrP-0003Hv-Id for v6ops-data@psg.com; Fri, 18 Mar 2005 07:25:31 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCBrL-0003HQ-5m for v6ops@ops.ietf.org; Fri, 18 Mar 2005 07:25:28 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id D239D62ACE; Fri, 18 Mar 2005 17:55:22 +1030 (CST) Date: Fri, 18 Mar 2005 17:55:22 +1030 From: Mark Smith To: "John Spence, CCSI, CCNA, CISSP" Cc: v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <200503170321.j2H3LcwT028094@hestia.native6.com> References: <200503170321.j2H3LcwT028094@hestia.native6.com> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Hi John, On Wed, 16 Mar 2005 19:21:38 -0800 "John Spence, CCSI, CCNA, CISSP" wrote: > > This draft does a great job of summarizing why engineered network security > (NAP) is much better than side-effect security (NAT). > > There are probably a few places to expand upon the discussion of proxy > servers within a NAP-based security program. NAT and proxies are not the > just the same thing at different levels of the ISO stack. NAT does simple > address translation, whereas proxy implementations - especially in larger > enterprises - do much more, including caching, L4-L7 security functions, and > policy enforcement. Proxies also do a great job of topology hiding. > Unfortunately, proxys break the end-to-end argument, as they maintain state within the network. If the proxy breaks, devices would not be able to access the resources they may still have an IP layer path to. Proxys are worth avoiding for the same reason NAT is. Geoff Huston wrote an execellent paper discribing the issues that "middleware" (the generic name for things such as proxys) cause in networks. You can download it at http://www.potaroo.net/ispcol/2001-04/2001-04-midware.pdf He has a number of other insightful papers on his "ISP Column" web page at http://www.potaroo.net/ispcol/index.html All the policy mechanisms you mention really are best done on the end host itself. There are two main reasons. Firstly, the application of policy doesn't rely on a known topology of the network. Consider a non-IT person bringing in a cheap wireless AP they bought on the week end, and inserting it at their wired wall point. Upstream "policy applying devices", such as firewalls, proxy servers etc, aren't necessarily effective anymore, as they won't see the wireless traffic. If the corporate policy was deployed to the node itself, it doesn't matter what the network topology is anymore, nor whether it changes surrepticiously or not. I first came across this idea in Steve Bellovin's paper, "Distributed Firewalls", http://www.cs.columbia.edu/~smb/papers/distfw.html Secondly, deploying policy to the end hosts also provides the best user granularity with the policy, as generally, it is one end-user to one host. Identifying users at a per-host level tends to be easier than network based identification mechanisms. They also tend to be more fault tolerant, as a failed policy (e.g., deny all access) on a user's host only effects the single user, rather than a significantly larger user population. I'm not necessarily saying all the mechanisms currently exist to a level of maturaty to do what I'm suggesting. However, when we are considering the future, such as IPv6, I think it is better to move on from less useful mechanisms, such as NAT and proxys, sooner rather than later. Specific topology hiding mechanisms such as NAT or Proxys aren't that useful in IPv6, as, due to the size of the IPv6 address space, topology discovery techniques such as "sweep pings" become impractical. Tony Hain pointed this out a while back on the IPv6 mailing list. For example, (and I've explored this a bit more at http://www.circleid.com/article.php?id=805_0_1_0_C/ ), assuming the ability to sweep ping 100 IPv6 addresses per second on a /64, and assuming a hit within the first 50%, it would take 2 924 712 086.77 years to find a single host. Of course, the odds go up with more hosts, however, the time to sweep ping would still be impractical. Regards, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Fri Mar 18 02:40:05 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA03243 for ; Fri, 18 Mar 2005 02:40:04 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCC3y-0004Xk-42 for v6ops-data@psg.com; Fri, 18 Mar 2005 07:38:30 +0000 Received: from [171.71.176.72] (helo=sj-iport-3.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCC3x-0004XG-Dh for v6ops@ops.ietf.org; Fri, 18 Mar 2005 07:38:29 +0000 Received: from sj-core-5.cisco.com (171.71.177.238) by sj-iport-3.cisco.com with ESMTP; 17 Mar 2005 23:38:29 -0800 X-IronPort-AV: i="3.91,100,1110182400"; d="scan'208"; a="237139896:sNHT27308868" Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id j2I7cQZV012713; Thu, 17 Mar 2005 23:38:27 -0800 (PST) Received: from [10.71.0.134] (sjc-vpn6-178.cisco.com [10.21.120.178]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with ESMTP id BDA41023; Thu, 17 Mar 2005 23:38:26 -0800 (PST) In-Reply-To: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: "John Spence, CCSI, CCNA, CISSP" , v6ops@ops.ietf.org From: Baker Fred Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Fri, 18 Mar 2005 02:38:25 -0500 To: Mark Smith X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit On Mar 18, 2005, at 2:25 AM, Mark Smith wrote: > Tony Hain pointed this out a while back on the IPv6 mailing list. For > example, (and I've explored this a bit more at > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), assuming the > ability to sweep ping 100 IPv6 addresses per second on a /64, and > assuming a hit within the first 50%, it would take 2 924 712 086.77 > years to find a single host. Of course, the odds go up with more > hosts, however, the time to sweep ping would still be impractical. I don't know why people bring that fact up. It is true, but the fact that it is true means the problem will be solved another way. I'll bet it is done by letter-bombs. From owner-v6ops@ops.ietf.org Fri Mar 18 02:58:58 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA04954 for ; Fri, 18 Mar 2005 02:58:58 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCCME-0007kq-QF for v6ops-data@psg.com; Fri, 18 Mar 2005 07:57:22 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCCMC-0007kR-8Z for v6ops@ops.ietf.org; Fri, 18 Mar 2005 07:57:21 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id D7E8B62ACE; Fri, 18 Mar 2005 18:27:18 +1030 (CST) Date: Fri, 18 Mar 2005 18:27:18 +1030 From: Mark Smith To: Baker Fred Cc: jspence@native6.com, v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050318182718.0743ccc5.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Hi Fred, On Fri, 18 Mar 2005 02:38:25 -0500 Baker Fred wrote: > On Mar 18, 2005, at 2:25 AM, Mark Smith wrote: > > Tony Hain pointed this out a while back on the IPv6 mailing list. For > > example, (and I've explored this a bit more at > > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), assuming the > > ability to sweep ping 100 IPv6 addresses per second on a /64, and > > assuming a hit within the first 50%, it would take 2 924 712 086.77 > > years to find a single host. Of course, the odds go up with more > > hosts, however, the time to sweep ping would still be impractical. > > I don't know why people bring that fact up. It is true, but the fact > that it is true means the problem will be solved another way. I'll bet > it is done by letter-bombs. Admittedly I don't exactly know what you're refering to with "letter-bombs", however, I'll guess you're describing using other techniques to identify devices, such as emails with URLs, with the web server then recording source IPv6 addresses. Am I correct ? If I am correct, I completely agree. I consider hiding devices to be a useful defence mechanism, however, it certainly shouldn't be the only one. Unfortunately, a lot of pro-NAT people, including those who think NAT should be implemented in IPv6 because of that property, seem to consider it the best thing since sliced bread, and talk about it like it is the "only" security mechanism that is needed. Social engineering via emails with enclosed URLs, or malware attached to software, are far more bigger and common threats today, and of course, IPv4 + NAT or IPv6 by itself won't (and I'm pretty sure will never) be effective against either of them, or any other attacks that socially engineer the user. I only bring it up to show that using NAT-style or middleware topology hiding techniques probably isn't necessary in IPv6, due to the huge effort involved in sweep pinging a /64. Blocking incoming pings, or outgoing ICMP unreachables/echo-replies etc. will be effective enough for those who want further protection than what the huge address space of IPv6 inherently provides. Regards, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Fri Mar 18 03:31:58 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA07981 for ; Fri, 18 Mar 2005 03:31:58 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCCrN-000BkT-O9 for v6ops-data@psg.com; Fri, 18 Mar 2005 08:29:33 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCCrM-000Bjs-Bk for v6ops@ops.ietf.org; Fri, 18 Mar 2005 08:29:32 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j2I8TVV13311 for ; Fri, 18 Mar 2005 10:29:31 +0200 Date: Fri, 18 Mar 2005 10:29:31 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org Subject: Re: Take NAP as WG document? In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Hi, (probably the last thing with the co-chair hat on) There seem to have been no objections to taking NAP a WG item, though there has been some good discussion for improvement (thanks!). Authors, please submit the next version as draft-ietf-v6ops-nap-00.txt (if you'd be revising it within the next 2 weeks, and if not, just publish the current version as -00.) Please also state when sending the draft to internet-drafts@ietf.org that the submission obsoletes draft-vandevelde-v6ops-nap-01.txt. (hat off) On Thu, 10 Mar 2005, Pekka Savola wrote: > (co-chair hat on, still for a while :) > > In the v6ops session, there seemed to be strong consensus to take "IPv6 > Network Architecture Protection" as a WG > item for Informational. > > If you have issues with this, please raise them within a week, by 16th March. > > Thanks! > > (hat off) > -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Fri Mar 18 03:34:16 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA08210 for ; Fri, 18 Mar 2005 03:34:15 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCCug-000C6w-9R for v6ops-data@psg.com; Fri, 18 Mar 2005 08:32:58 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCCuf-000C6g-9w for v6ops@ops.ietf.org; Fri, 18 Mar 2005 08:32:57 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j2I8WhW13388; Fri, 18 Mar 2005 10:32:43 +0200 Date: Fri, 18 Mar 2005 10:32:43 +0200 (EET) From: Pekka Savola To: Mark Smith cc: "John Spence, CCSI, CCNA, CISSP" , v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." In-Reply-To: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> Message-ID: References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk On Fri, 18 Mar 2005, Mark Smith wrote: >> >> There are probably a few places to expand upon the discussion of proxy >> servers within a NAP-based security program. NAT and proxies are not the >> just the same thing at different levels of the ISO stack. NAT does simple >> address translation, whereas proxy implementations - especially in larger >> enterprises - do much more, including caching, L4-L7 security functions, and >> policy enforcement. Proxies also do a great job of topology hiding. >> > > Unfortunately, proxys break the end-to-end argument, as they maintain > state within the network. If the proxy breaks, devices would not be able > to access the resources they may still have an IP layer path to. Proxys > are worth avoiding for the same reason NAT is. [...] Personally, I have to agree with John Spence here, I think. While proxys are not nice from the architectural perspective, they're the lesser of the evils in some sense. If the users need to solve a problem (e.g., internal addressing stability using ULAs, ...), they're going to do it somehow in any case. It's just the question whether they use NAT, NAT-PT, proxies, or whatever for the task. At least from that list, proxies look the least of the evils.. -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Fri Mar 18 05:20:49 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA16756 for ; Fri, 18 Mar 2005 05:20:48 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCEZh-000P8z-QG for v6ops-data@psg.com; Fri, 18 Mar 2005 10:19:25 +0000 Received: from [195.212.29.135] (helo=mtagate2.uk.ibm.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DCEZf-000P8j-GB for v6ops@ops.ietf.org; Fri, 18 Mar 2005 10:19:23 +0000 Received: from d06nrmr1407.portsmouth.uk.ibm.com (d06nrmr1407.portsmouth.uk.ibm.com [9.149.38.185]) by mtagate2.uk.ibm.com (8.12.10/8.12.10) with ESMTP id j2IAJLpW333248 for ; Fri, 18 Mar 2005 10:19:21 GMT Received: from d06av02.portsmouth.uk.ibm.com (d06av02.portsmouth.uk.ibm.com [9.149.37.228]) by d06nrmr1407.portsmouth.uk.ibm.com (8.12.10/NCO/VER6.6) with ESMTP id j2IAJL2b170092 for ; Fri, 18 Mar 2005 10:19:21 GMT Received: from d06av02.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av02.portsmouth.uk.ibm.com (8.12.11/8.12.11) with ESMTP id j2IAJKtd019460 for ; Fri, 18 Mar 2005 10:19:21 GMT Received: from sihl.zurich.ibm.com (sihl.zurich.ibm.com [9.4.16.232]) by d06av02.portsmouth.uk.ibm.com (8.12.11/8.12.11) with ESMTP id j2IAJKoq019455; Fri, 18 Mar 2005 10:19:20 GMT Received: from zurich.ibm.com (sig-9-145-254-17.de.ibm.com [9.145.254.17]) by sihl.zurich.ibm.com (AIX4.3/8.9.3p2/8.9.3) with ESMTP id LAA79794; Fri, 18 Mar 2005 11:19:19 +0100 Message-ID: <423AAB2D.3070607@zurich.ibm.com> Date: Fri, 18 Mar 2005 11:19:25 +0100 From: Brian E Carpenter Organization: IBM User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en, fr, de MIME-Version: 1.0 To: Mark Smith CC: "John Spence, CCSI, CCNA, CISSP" , v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Mark Smith wrote: > Hi John, > > On Wed, 16 Mar 2005 19:21:38 -0800 > "John Spence, CCSI, CCNA, CISSP" wrote: > > >>This draft does a great job of summarizing why engineered network security >>(NAP) is much better than side-effect security (NAT). >> >>There are probably a few places to expand upon the discussion of proxy >>servers within a NAP-based security program. NAT and proxies are not the >>just the same thing at different levels of the ISO stack. NAT does simple >>address translation, whereas proxy implementations - especially in larger >>enterprises - do much more, including caching, L4-L7 security functions, and >>policy enforcement. Proxies also do a great job of topology hiding. >> > > > Unfortunately, proxys break the end-to-end argument, as they maintain > state within the network. If the proxy breaks, devices would not be able > to access the resources they may still have an IP layer path to. Proxys > are worth avoiding for the same reason NAT is. RFC 2775 and RFC 3234 addressed these issues, I believe. While I wouldn't be as negative as that about proxies, I do think that it would divert from the main argument in the NAP draft if we expanded that topic. Brian From owner-v6ops@ops.ietf.org Fri Mar 18 06:40:22 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id GAA23888 for ; Fri, 18 Mar 2005 06:40:22 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCFon-000Ago-C4 for v6ops-data@psg.com; Fri, 18 Mar 2005 11:39:05 +0000 Received: from [66.54.152.27] (helo=jive.SoftHome.net) by psg.com with smtp (Exim 4.44 (FreeBSD)) id 1DCFok-000AgY-Ra for v6ops@ops.ietf.org; Fri, 18 Mar 2005 11:39:03 +0000 Received: (qmail 2145 invoked by uid 417); 18 Mar 2005 11:39:02 -0000 Received: from shunt-smtp-out-0 (HELO softhome.net) (172.16.3.12) by shunt-smtp-out-0 with SMTP; 18 Mar 2005 11:39:02 -0000 Received: from XPNERICK ([132.70.218.89]) (AUTH: LOGIN ericlklein@softhome.net) by softhome.net with esmtp; Fri, 18 Mar 2005 04:39:00 -0700 Message-ID: <002501c52bae$e91ec960$0201a8c0@ttitelecom.com> From: "EricLKlein" To: v6ops@ops.ietf.org References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Fri, 18 Mar 2005 13:37:46 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00, RCVD_IN_SORBS_WEB autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Mark Smith wrote > Specific topology hiding mechanisms such as NAT or Proxys aren't that > useful in IPv6, as, due to the size of the IPv6 address space, topology > discovery techniques such as "sweep pings" become impractical. Tony Hain > pointed this out a while back on the IPv6 mailing list. For example, > (and I've explored this a bit more at > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), assuming the > ability to sweep ping 100 IPv6 addresses per second on a /64, and > assuming a hit within the first 50%, it would take 2 924 712 086.77 > years to find a single host. Of course, the odds go up with more hosts, > however, the time to sweep ping would still be impractical. This might be true in theory, but in practice it is usually not. In my experience you can scan the first 20 IP addresses in a subnet and you are likely to get at least 5 to 10 hits. This is not inherent in the protocol, but tends to be part of human nature. Network Admins tend (in an enterprise setting) to like to number things sequentially as it makes it easier for them to maintain the address pool and to monitor hardware. So unless they work 100% with DHCP and it is set to random, there will be many fixed devices (printers, application servers, etc) that reside in that first 20 addresses. It is like cash machine pin numbers, people tend to make things easier for themselves. So if you know the person you can usually guess the pin by their or someone that they care about's birthday. In general, people will be lazy and do what is easiest for them. Eric From owner-v6ops@ops.ietf.org Fri Mar 18 14:20:37 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id OAA13014 for ; Fri, 18 Mar 2005 14:20:37 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCN03-000Hbd-2M for v6ops-data@psg.com; Fri, 18 Mar 2005 19:19:11 +0000 Received: from [216.52.23.28] (helo=whisker.bluecoat.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCMzt-000Hb0-12 for v6ops@ops.ietf.org; Fri, 18 Mar 2005 19:19:01 +0000 Received: from bcs-mail.bluecoat.com (bcs-mail.bluecoat.com [216.52.23.69]) by whisker.bluecoat.com (8.13.0/8.13.0) with ESMTP id j2IJIfIP013697; Fri, 18 Mar 2005 11:18:42 -0800 (PST) X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Fri, 18 Mar 2005 11:18:35 -0800 Message-ID: <00CDF9AA240E204FA6E923BD35BC643609043B7B@bcs-mail.internal.cacheflow.com> Thread-Topic: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Thread-Index: AcUrph4y1RlpnkkxRJWpHVIwXs7DPgAR/XvQ From: "Li, Qing" To: "Brian E Carpenter" , "Mark Smith" Cc: "John Spence, CCSI, CCNA, CISSP" , X-Scanned-By: MIMEDefang 2.49 on 216.52.23.28 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable >=20 > RFC 2775 and RFC 3234 addressed these issues, I believe.=20 > While I wouldn't be as negative as that about proxies, I do=20 > think that it would divert from the main argument in the NAP=20 > draft if we expanded that topic. >=20 Since a good portion of the document discusses untraceable addresses,=20 therefore I also believe the document should have some discussion=20 on proxies.=20 In the SOHO/home environment, privacy and secure end-to-end=20 communication is of main concern, which are not necessarily desirable=20 or applicable in the enterprise environment. One has very little=20 control and right to claim privacy in the enterprise environment.=20 Think of individual users on the DoD networks. In the enterprise environment proxies are deployed to enforce enterprise network access policies. The privacy extension of generating temporary=20 addresses and making addresses difficult to trace would make the=20 enforcement task a difficult one. For example, a fixed policy rule=20 such as: address time-of-day week-day bandwidth-alloc -------------------------------------------------------------- IPv6-addr-X 9:00AM - 3:00PM M,W,TH,F X-kbps would be difficult to enforce if IPv6-addr-X either constantly remaps to a different node, or if the node constantly replaces IPv6-addr-X with something else. In other words, some of the goals of NAP (probably more accurately the goals of address privacy extension) are contrary to the=20 enterprise network management goals, which are identification, control, and enforcement. So I guess my question is how does=20 NAP fit in this type of enterprise environments ? =20 A secure proxy can be means to NAP. Many of the proxy functions=20 require connection termination and if the policy allows, another=20 connection is originated by the proxy on behalf of the client,=20 effectively hiding the identity of the client. The argument that a proxy breaks the end-to-end model is not entirely true. Once the initial authentication and authorization step is complete, later communication would require a simple connection-splicing in the proxy, much like what a bridge/route does.=20 Of course in the case of HTTPS termination the proxy does more work=20 for decrypting/re-encrypting traffic. Secure proxy appliance usually require NIAP and/or FIPS certification. The other argument about the proxy breaks the security model whereby the origin server identifies the client based on its IP address is flawed. Identification on IP cannot identify the individual users on the node, so origin server cannot personalize=20 the content by IP alone. You don't need a proxy to get into trouble. If the node acquires globally routable address from a DHCP server we run into the same issue. -- Qing From owner-v6ops@ops.ietf.org Fri Mar 18 15:39:05 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24636 for ; Fri, 18 Mar 2005 15:39:04 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCODt-0001Vo-Dr for v6ops-data@psg.com; Fri, 18 Mar 2005 20:37:33 +0000 Received: from [132.151.1.176] (helo=ietf.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCODr-0001U7-Qn for v6ops@ops.ietf.org; Fri, 18 Mar 2005 20:37:32 +0000 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA24127; Fri, 18 Mar 2005 15:37:27 -0500 (EST) Message-Id: <200503182037.PAA24127@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org Cc: v6ops@ops.ietf.org From: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-v6ops-renumbering-procedure-05.txt Date: Fri, 18 Mar 2005 15:37:27 -0500 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,MIME_BOUND_NEXTPART, NO_REAL_NAME autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IPv6 Operations Working Group of the IETF. Title : Procedures for Renumbering an IPv6 Network without a Flag Day Author(s) : F. Baker, et al. Filename : draft-ietf-v6ops-renumbering-procedure-05.txt Pages : 25 Date : 2005-3-18 This document describes a procedure that can be used to renumber a network from one prefix to another. It uses IPv6's intrinsic ability to assign multiple addresses to a network interface to provide continuity of network service through a "make-before-break" transition, as well as addressing naming and configuration management issues. It also uses other IPv6 features to minimize the effort and time required to complete the transition from the old prefix to the new prefix. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-v6ops-renumbering-procedure-05.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-v6ops-renumbering-procedure-05.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-v6ops-renumbering-procedure-05.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2005-3-18153859.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-v6ops-renumbering-procedure-05.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-v6ops-renumbering-procedure-05.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2005-3-18153859.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-v6ops@ops.ietf.org Fri Mar 18 16:11:42 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id QAA05421 for ; Fri, 18 Mar 2005 16:11:41 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCOk6-0005il-Ld for v6ops-data@psg.com; Fri, 18 Mar 2005 21:10:50 +0000 Received: from [216.52.23.28] (helo=whisker.bluecoat.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCOk4-0005iN-Od for v6ops@ops.ietf.org; Fri, 18 Mar 2005 21:10:48 +0000 Received: from bcs-mail.bluecoat.com (bcs-mail.bluecoat.com [216.52.23.69]) by whisker.bluecoat.com (8.13.0/8.13.0) with ESMTP id j2ILAcKZ018855; Fri, 18 Mar 2005 13:10:38 -0800 (PST) X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Fri, 18 Mar 2005 13:10:32 -0800 Message-ID: <00CDF9AA240E204FA6E923BD35BC643609043BC0@bcs-mail.internal.cacheflow.com> Thread-Topic: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Thread-Index: AcUrjub1iMfk2IbjQZ2JrAKbet96nwAb9TRA From: "Li, Qing" To: "Mark Smith" , "John Spence, CCSI, CCNA, CISSP" Cc: X-Scanned-By: MIMEDefang 2.49 on 216.52.23.28 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable >=20 > If the proxy breaks,=20 > devices would not be able to access the resources they may=20 > still have an IP layer path to. Proxys are worth avoiding for=20 > the same reason NAT is. >=20 Actually for a transparent proxy if it breaks, and you still a valid path then the requests go directly to the origin server. This is more of a problem for explicit proxy but then=20 in that case user can easily discover the proxy is broken. > > whether it changes surrepticiously or not. I first came=20 > across this idea in Steve Bellovin's paper, "Distributed Firewalls",=20 >=20 > http://www.cs.columbia.edu/~smb/papers/distfw.html >=20 > Secondly, deploying policy to the end hosts also provides the=20 > best user granularity with the policy, as generally, it is=20 > one end-user to one host. Identifying users at a per-host=20 > level tends to be easier than network based identification=20 > mechanisms. They also tend to be more fault tolerant, as a=20 > failed policy (e.g., deny all access) on a user's host only=20 > effects the single user, rather than a significantly larger=20 > user population. > =20 I haven't read the paper, but just reading the above, I wonder why would tie in one end-user to one host be a=20 benefit ? A host can be used by multiple users, and each user needs to be authenticated possibly centrally to determine what network resources the user is allowed to access. The policy should be managed centrally and should follow the=20 user and should be session based. When a host crashes it does=20 not take down any policy and the user just go somewhere else=20 and resume work. =20 -- Qing From owner-v6ops@ops.ietf.org Fri Mar 18 18:12:39 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA21287 for ; Fri, 18 Mar 2005 18:12:38 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCQcD-000Ir5-1H for v6ops-data@psg.com; Fri, 18 Mar 2005 23:10:49 +0000 Received: from [171.71.176.70] (helo=sj-iport-1.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCQcB-000Iqq-2n for v6ops@ops.ietf.org; Fri, 18 Mar 2005 23:10:47 +0000 Received: from sj-core-1.cisco.com (171.71.177.237) by sj-iport-1.cisco.com with ESMTP; 18 Mar 2005 15:27:21 -0800 X-IronPort-AV: i="3.91,103,1110182400"; d="scan'208"; a="621034831:sNHT944016296" Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j2INAEDr007338; Fri, 18 Mar 2005 15:10:14 -0800 (PST) Received: from [65.74.234.234] (sjc-vpn1-443.cisco.com [10.21.97.187]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with ESMTP id BDB28229; Fri, 18 Mar 2005 15:10:15 -0800 (PST) In-Reply-To: <20050318182718.0743ccc5.ipng@69706e6720323030352d30312d31340a.nosense.org> References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <20050318182718.0743ccc5.ipng@69706e6720323030352d30312d31340a.nosense.org> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <82201c21584869714a51a5afa6f7ccbb@cisco.com> Content-Transfer-Encoding: 7bit Cc: jspence@native6.com, v6ops@ops.ietf.org From: Baker Fred Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Fri, 18 Mar 2005 06:58:31 -0500 To: Mark Smith X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Multicast in various forms. The most useful ones would be the All-Nodes Multicast Address (link-local) and the All-Routers Multicast Address (site-local). In IPv4, a simple letter-bomb is subnet broadcast. If you know or think that 123.45.67.0/24 is a subnet in a company, pinging 123.45.67.255 might very well get you an ICMP Echo Response from each host on that LAN. In IPv6, pinging any multicast address should get you an ICMPv6 Echo Response from each host in the multicast group. The pinging All-Routers should get you a list of the routers in a network, and therefore a list of the transit subnets in a network (but not necessarily the edge LANs that have only one router on them). Subnet-router anycast address will certainly find a router in your subnet, and (rather than arping for each of your neighbors as is currently done by viruses), pinging the All-Nodes Multicast Address should get you an echo response from every node on your local LAN. Solicited-Node Multicast also gives you some sweeping capability, albeit only on your local lan. So the counterpart of today's IPv4 virus that sweeps its local LAN is a virus that sends two pings, one to All-Nodes and one to All-Routers. The echo responses give the application information about the network. On Mar 18, 2005, at 2:57 AM, Mark Smith wrote: > Hi Fred, > > On Fri, 18 Mar 2005 02:38:25 -0500 > Baker Fred wrote: > >> On Mar 18, 2005, at 2:25 AM, Mark Smith wrote: >>> Tony Hain pointed this out a while back on the IPv6 mailing list. For >>> example, (and I've explored this a bit more at >>> http://www.circleid.com/article.php?id=805_0_1_0_C/ ), assuming the >>> ability to sweep ping 100 IPv6 addresses per second on a /64, and >>> assuming a hit within the first 50%, it would take 2 924 712 086.77 >>> years to find a single host. Of course, the odds go up with more >>> hosts, however, the time to sweep ping would still be impractical. >> >> I don't know why people bring that fact up. It is true, but the fact >> that it is true means the problem will be solved another way. I'll bet >> it is done by letter-bombs. > > Admittedly I don't exactly know what you're refering to with > "letter-bombs", however, I'll guess you're describing using other > techniques to identify devices, such as emails with URLs, with the web > server then recording source IPv6 addresses. Am I correct ? > > If I am correct, I completely agree. I consider hiding devices to be a > useful defence mechanism, however, it certainly shouldn't be the only > one. Unfortunately, a lot of pro-NAT people, including those who think > NAT should be implemented in IPv6 because of that property, seem to > consider it the best thing since sliced bread, and talk about it like > it > is the "only" security mechanism that is needed. Social engineering via > emails with enclosed URLs, or malware attached to software, are far > more > bigger and common threats today, and of course, IPv4 + NAT or IPv6 by > itself won't (and I'm pretty sure will never) be effective against > either of them, or any other attacks that socially engineer the user. > > I only bring it up to show that using NAT-style or middleware topology > hiding techniques probably isn't necessary in IPv6, due to the huge > effort involved in sweep pinging a /64. Blocking incoming pings, or > outgoing ICMP unreachables/echo-replies etc. will be effective enough > for those who want further protection than what the huge address space > of IPv6 inherently provides. > > Regards, > Mark. > > -- > > The Internet's nature is peer to peer. > From owner-v6ops@ops.ietf.org Fri Mar 18 23:42:21 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA17348 for ; Fri, 18 Mar 2005 23:42:21 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCVl5-0002pw-JE for v6ops-data@psg.com; Sat, 19 Mar 2005 04:40:19 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCVl2-0002pS-Rn for v6ops@ops.ietf.org; Sat, 19 Mar 2005 04:40:17 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id 50F7462ACE; Sat, 19 Mar 2005 15:10:11 +1030 (CST) Date: Sat, 19 Mar 2005 15:10:11 +1030 From: Mark Smith To: Baker Fred Cc: jspence@native6.com, v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050319151011.3acd7723.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <82201c21584869714a51a5afa6f7ccbb@cisco.com> References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <20050318182718.0743ccc5.ipng@69706e6720323030352d30312d31340a.nosense.org> <82201c21584869714a51a5afa6f7ccbb@cisco.com> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Hi Fred, On Fri, 18 Mar 2005 06:58:31 -0500 Baker Fred wrote: > Multicast in various forms. The most useful ones would be the All-Nodes > Multicast Address (link-local) and the All-Routers Multicast Address > (site-local). > Oh, OK, the good old "broadcast ping", using m/c in IPv6. I don't think I've heard of them being called "letter-bombs" before. > In IPv4, a simple letter-bomb is subnet broadcast. If you know or think > that 123.45.67.0/24 is a subnet in a company, pinging 123.45.67.255 > might very well get you an ICMP Echo Response from each host on that > LAN. In IPv6, pinging any multicast address should get you an ICMPv6 > Echo Response from each host in the multicast group. The pinging > All-Routers should get you a list of the routers in a network, and > therefore a list of the transit subnets in a network (but not > necessarily the edge LANs that have only one router on them). > Subnet-router anycast address will certainly find a router in your > subnet, and (rather than arping for each of your neighbors as is > currently done by viruses), pinging the All-Nodes Multicast Address > should get you an echo response from every node on your local LAN. > Solicited-Node Multicast also gives you some sweeping capability, > albeit only on your local lan. > It's a bit of a surprise to me that the offlink sourced methods you've described would work in IPv6, because I've assumed that as directed broadcast style techniques had been deprecated in IPv4, they also wouldn't be available in IPv6. It seems that isn't the case. Based on my assumption, unicast sweep pinging seemed to be the only possible way to find remote hosts. Is there some mechanism in IPv6 that would allow selective responses to multicast ICMPv6 echo requests, somehow based on the source address or a combination of the source address and multicast scope ? For example, an echo-reply to a multicast echo-request would only be sent if the scope of the destination multicast address was site, and the source IPv6 address was a member of the same site or possibly the source address as the same /48 prefix as one of the unicast addresses assigned to one of the interfaces on the possibly responding host. I've had a look at the ICMPv6 RFC, the section on Echo-requests/replys doesn't mention any selective response mechanisms. I'll start looking at some others, it will also help me brush up on IPv6 details again. If there are any other pointers to RFCs covering this area, I'd appreciate it. > So the counterpart of today's IPv4 virus that sweeps its local LAN is a > virus that sends two pings, one to All-Nodes and one to All-Routers. > The echo responses give the application information about the network. > I'd think they'd be quite common, as it seems pretty easy today to get an user to install software they don't know about behind their NAT box or proxy server. Thanks, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Fri Mar 18 23:50:34 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id XAA17810 for ; Fri, 18 Mar 2005 23:50:34 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCVuh-000414-0X for v6ops-data@psg.com; Sat, 19 Mar 2005 04:50:15 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCVud-00040c-FP for v6ops@ops.ietf.org; Sat, 19 Mar 2005 04:50:12 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id 2E20F62ACE; Sat, 19 Mar 2005 15:20:10 +1030 (CST) Date: Sat, 19 Mar 2005 15:20:09 +1030 From: Mark Smith To: "EricLKlein" Cc: v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050319152009.178672a3.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <002501c52bae$e91ec960$0201a8c0@ttitelecom.com> References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <002501c52bae$e91ec960$0201a8c0@ttitelecom.com> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Hi Eric, On Fri, 18 Mar 2005 13:37:46 +0200 "EricLKlein" wrote: > Mark Smith wrote > > Specific topology hiding mechanisms such as NAT or Proxys aren't that > > useful in IPv6, as, due to the size of the IPv6 address space, topology > > discovery techniques such as "sweep pings" become impractical. Tony Hain > > pointed this out a while back on the IPv6 mailing list. For example, > > (and I've explored this a bit more at > > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), assuming the > > ability to sweep ping 100 IPv6 addresses per second on a /64, and > > assuming a hit within the first 50%, it would take 2 924 712 086.77 > > years to find a single host. Of course, the odds go up with more hosts, > > however, the time to sweep ping would still be impractical. > > This might be true in theory, but in practice it is usually not. In my > experience you can scan the first 20 IP addresses in a subnet and you are > likely to get at least 5 to 10 hits. This is not inherent in the protocol, > but tends to be part of human nature. Network Admins tend (in an enterprise > setting) to like to number things sequentially as it makes it easier for > them to maintain the address pool and to monitor hardware. So unless they > work 100% with DHCP and it is set to random, there will be many fixed > devices (printers, application servers, etc) that reside in that first 20 > addresses. I'd agree in IPv4 that is common. In IPv6, I'd suggest less so, although I am assuming that the most common address allocation method would be based on EUI-64s, making end node addresses would be far less predictable. If that is still too predictable, I've understood that enabling Privacy Extensions should elminate all predictability. Of course, if people implement stateful addressing, then I would expect the sort of allocation ordering you're describing. That may be likely in enterprises, and "easy of topology discovery" should possibly be something enterprises will need to keep in mind as a risk if they choose to implement stateful addressing. Regards, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Sat Mar 19 01:34:08 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA26420 for ; Sat, 19 Mar 2005 01:34:07 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCXUZ-000G6P-5D for v6ops-data@psg.com; Sat, 19 Mar 2005 06:31:23 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCXUU-000G5u-Sk for v6ops@ops.ietf.org; Sat, 19 Mar 2005 06:31:20 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id 879A662ACE; Sat, 19 Mar 2005 17:01:17 +1030 (CST) Date: Sat, 19 Mar 2005 17:01:17 +1030 From: Mark Smith To: "Li, Qing" Cc: brc@zurich.ibm.com, jspence@native6.com, v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050319170117.65952b8f.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <00CDF9AA240E204FA6E923BD35BC643609043B7B@bcs-mail.internal.cacheflow.com> References: <00CDF9AA240E204FA6E923BD35BC643609043B7B@bcs-mail.internal.cacheflow.com> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Hi Qing, On Fri, 18 Mar 2005 11:18:35 -0800 "Li, Qing" wrote: > > > > > RFC 2775 and RFC 3234 addressed these issues, I believe. > > While I wouldn't be as negative as that about proxies, I do > > think that it would divert from the main argument in the NAP > > draft if we expanded that topic. > > > > Since a good portion of the document discusses untraceable addresses, > therefore I also believe the document should have some discussion > on proxies. > > In the SOHO/home environment, privacy and secure end-to-end > communication is of main concern, which are not necessarily desirable > or applicable in the enterprise environment. One has very little > control and right to claim privacy in the enterprise environment. > Think of individual users on the DoD networks. > > In the enterprise environment proxies are deployed to enforce enterprise > > network access policies. The privacy extension of generating temporary > addresses and making addresses difficult to trace would make the > enforcement task a difficult one. For example, a fixed policy rule > such as: > > address time-of-day week-day bandwidth-alloc > -------------------------------------------------------------- > IPv6-addr-X 9:00AM - 3:00PM M,W,TH,F X-kbps > > would be difficult to enforce if IPv6-addr-X either constantly > remaps to a different node, or if the node constantly replaces > IPv6-addr-X with something else. > > In other words, some of the goals of NAP (probably more accurately > the goals of address privacy extension) are contrary to the > enterprise network management goals, which are identification, > control, and enforcement. The key term here is identification. When you identify using a network layer address, you aren't really identifying a person, you are identifying a node, and then basing all your security and policy on the assumption that the person the policy is applying to will always use that node. While humans continue to be portable and mobile, that is a relatively weak assumption. I've seen that assumption broken often enough when, for example, people in an enterprise network who don't have Internet access or special application access want it temporarily - they just move to another node that does. Obviously those people are breaking the access policy, the question is, are they bothering to try because the policy barriers are quite low and therefore their chances of success are high ? Because it isn't too hard, they may not consider they are breaking important rules. Ideally, policy should be able to be applied to the user no matter which node they happen to be using at the time. A network location independant user identification method would be better, such as username / password. Once the user has been identified, the specific policy for the user could then be deployed to the node they're currently about to use. So I guess my question is how does > NAP fit in this type of enterprise environments ? > > A secure proxy can be means to NAP. Many of the proxy functions > require connection termination and if the policy allows, another > connection is originated by the proxy on behalf of the client, > effectively hiding the identity of the client. > > The argument that a proxy breaks the end-to-end model is not > entirely true. Once the initial authentication and authorization > step is complete, later communication would require a simple > connection-splicing in the proxy, much like what a bridge/route does. > Of course in the case of HTTPS termination the proxy does more work > for decrypting/re-encrypting traffic. Secure proxy appliance > usually require NIAP and/or FIPS certification. > I've understood that the major benefit of the end-to-end argument, in a networking context, is that you don't build single points of failure inside the network, by chosing to maintain state in an intermediary device, in scenarios where a single point of failure didn't previously exist. Following on from that, if you do maintain state in the network, to then eliminate those single points of failure, significant complexity has to be added. For example, imagine a geographically large network, with Internet connections at two cities, and an private WAN between them. It can cope with one of the Internet connections failing - the traffic will be rerouted from the local Internet connection, across the private WAN, and out the remote Internet connection. Individual TCP connections will survive this sort of transient failure, as they don't rely on the specific devices that are helping them communicate. However, if you were maintaining proxy servers at both sites, for TCP connections to survive a proxy failure, you now have to keep the two proxy server's states synchronised. This is complex, and will be heavy on traffic (every TCP segment each proxy sees will generate another synchronisation packet between the proxies, for example), which may require much higher bandwidth links between these proxy servers than the normal traffic requirements of the private WAN. The stateless, "router only" model is a lot simpler. > The other argument about the proxy breaks the security model > whereby the origin server identifies the client based on its > IP address is flawed. Identification on IP cannot identify > the individual users on the node, so origin server cannot personalize > the content by IP alone. You don't need a proxy to get into trouble. > If the node acquires globally routable address from a > DHCP server we run into the same issue. > That is another good example of where network location and node identity (ie. IP address), are not identifying a person but a node. Regards, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Sat Mar 19 01:53:11 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA27593 for ; Sat, 19 Mar 2005 01:53:10 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCXoS-000Iee-Sh for v6ops-data@psg.com; Sat, 19 Mar 2005 06:51:56 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCXoQ-000Ie3-3v for v6ops@ops.ietf.org; Sat, 19 Mar 2005 06:51:55 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id 8188F62ACE; Sat, 19 Mar 2005 17:21:52 +1030 (CST) Date: Sat, 19 Mar 2005 17:21:52 +1030 From: Mark Smith To: "Li, Qing" Cc: jspence@native6.com, v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050319172152.56e05fbe.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <00CDF9AA240E204FA6E923BD35BC643609043BC0@bcs-mail.internal.cacheflow.com> References: <00CDF9AA240E204FA6E923BD35BC643609043BC0@bcs-mail.internal.cacheflow.com> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Hi Qing, On Fri, 18 Mar 2005 13:10:32 -0800 "Li, Qing" wrote: > > > > > If the proxy breaks, > > devices would not be able to access the resources they may > > still have an IP layer path to. Proxys are worth avoiding for > > the same reason NAT is. > > > > Actually for a transparent proxy if it breaks, and you still > a valid path then the requests go directly to the origin > server. I'm not all that familiar with transparent proxy operation, other than knowing they "catch" TCP port 80 connections as they "go by", and send them to a proxy server instead. Does the router performing this "catching" monitor the availability of the proxy server ? I'd probably assume so. Still, if the proxy server fails, it takes with it any current TCP connections. I think the key thing to remember about the scenarios we are discussing isn't whether subsequent, new TCP connections will work, it is whether existing TCP connections will be destroyed due to a failure in the network. Assuming alternative IP paths exist, in a stateless scenario, existing TCP connections will survive, in a stateful scenario they won't. > > > > whether it changes surrepticiously or not. I first came > > across this idea in Steve Bellovin's paper, "Distributed Firewalls", > > > > http://www.cs.columbia.edu/~smb/papers/distfw.html > > > > Secondly, deploying policy to the end hosts also provides the > > best user granularity with the policy, as generally, it is > > one end-user to one host. Identifying users at a per-host > > level tends to be easier than network based identification > > mechanisms. They also tend to be more fault tolerant, as a > > failed policy (e.g., deny all access) on a user's host only > > effects the single user, rather than a significantly larger > > user population. > > > The above text is going to sound a bit contrary to my last email. In the above text, when I used the term "network based identification mechanisms", I was meaning using IP addresses to identify users on a device remote from the node the user is currently using. eg a centralised firewall. > I haven't read the paper, but just reading the above, > I wonder why would tie in one end-user to one host be a > benefit ? > > A host can be used by multiple users, and each user needs to > be authenticated possibly centrally to determine what network > resources the user is allowed to access. > > The policy should be managed centrally and should follow the > user and should be session based. When a host crashes it does > not take down any policy and the user just go somewhere else > and resume work. > Exactly. Regards, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Sat Mar 19 02:57:07 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22279 for ; Sat, 19 Mar 2005 02:57:07 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCYmP-0001Pb-KA for v6ops-data@psg.com; Sat, 19 Mar 2005 07:53:53 +0000 Received: from [128.9.160.161] (helo=boreas.isi.edu) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCSz9-0009Mh-0d for v6ops@ops.ietf.org; Sat, 19 Mar 2005 01:42:39 +0000 Received: from ISI.EDU (adma.isi.edu [128.9.160.239]) by boreas.isi.edu (8.11.6p2+0917/8.11.2) with ESMTP id j2J1fgq24123; Fri, 18 Mar 2005 17:41:42 -0800 (PST) Message-Id: <200503190141.j2J1fgq24123@boreas.isi.edu> To: ietf-announce@ietf.org Subject: RFC 4029 on Scenarios and Analysis for Introducing IPv6 into ISP Networks Cc: rfc-editor@rfc-editor.org, v6ops@ops.ietf.org From: rfc-editor@rfc-editor.org Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary=NextPart Date: Fri, 18 Mar 2005 17:41:42 -0800 X-ISI-4-39-6-MailScanner: Found to be clean X-MailScanner-From: rfc-ed@isi.edu X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-17.6 required=5.0 tests=AWL,BAYES_00, MIME_BOUND_NEXTPART,NO_REAL_NAME,USER_IN_DEF_WHITELIST autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --NextPart A new Request for Comments is now available in online RFC libraries. RFC 4029 Title: Scenarios and Analysis for Introducing IPv6 into ISP Networks Author(s): M. Lind, V. Ksinant, S. Park, A. Baudot, P. Savola Status: Informational Date: March 2005 Mailbox: mikael.lind@teliasonera.com, vladimir.ksinant@fr.thalesgroup.com, soohong.park@samsung.com, alain.baudot@francetelecom.com, psavola@funet.fi Pages: 28 Characters: 64388 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-v6ops-isp-scenarios-analysis-03.txt URL: ftp://ftp.rfc-editor.org/in-notes/rfc4029.txt This document describes different scenarios for the introduction of IPv6 into an ISP's existing IPv4 network without disrupting the IPv4 service. The scenarios for introducing IPv6 are analyzed, and the relevance of already defined transition mechanisms are evaluated. Known challenges are also identified. This document is a product of the IPv6 Operations Working Group of the IETF. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST@IETF.ORG. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST@RFC-EDITOR.ORG. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info@RFC-EDITOR.ORG with the message body help: ways_to_get_rfcs. For example: To: rfc-info@RFC-EDITOR.ORG Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to RFC-Manager@RFC-EDITOR.ORG. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR@RFC-EDITOR.ORG. Please consult RFC 2223, Instructions to RFC Authors, for further information. Joyce K. Reynolds and Sandy Ginoza USC/Information Sciences Institute ... Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the ASCII version of the RFCs. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="RFC-INFO@RFC-EDITOR.ORG" Content-Type: text/plain Content-ID: <050318174029.RFC@RFC-EDITOR.ORG> RETRIEVE: rfc DOC-ID: rfc4029 --OtherAccess Content-Type: Message/External-body; name="rfc4029.txt"; site="ftp.isi.edu"; access-type="anon-ftp"; directory="in-notes" Content-Type: text/plain Content-ID: <050318174029.RFC@RFC-EDITOR.ORG> --OtherAccess-- --NextPart-- From owner-v6ops@ops.ietf.org Sat Mar 19 02:57:16 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id CAA22299 for ; Sat, 19 Mar 2005 02:57:15 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCYmg-0001RD-QX for v6ops-data@psg.com; Sat, 19 Mar 2005 07:54:10 +0000 Received: from [128.9.160.161] (helo=boreas.isi.edu) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCSz9-0009Mh-0d for v6ops@ops.ietf.org; Sat, 19 Mar 2005 01:42:39 +0000 Received: from ISI.EDU (adma.isi.edu [128.9.160.239]) by boreas.isi.edu (8.11.6p2+0917/8.11.2) with ESMTP id j2J1fgq24123; Fri, 18 Mar 2005 17:41:42 -0800 (PST) Message-Id: <200503190141.j2J1fgq24123@boreas.isi.edu> To: ietf-announce@ietf.org Subject: RFC 4029 on Scenarios and Analysis for Introducing IPv6 into ISP Networks Cc: rfc-editor@rfc-editor.org, v6ops@ops.ietf.org From: rfc-editor@rfc-editor.org Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary=NextPart Date: Fri, 18 Mar 2005 17:41:42 -0800 X-ISI-4-39-6-MailScanner: Found to be clean X-MailScanner-From: rfc-ed@isi.edu X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-17.6 required=5.0 tests=AWL,BAYES_00, MIME_BOUND_NEXTPART,NO_REAL_NAME,USER_IN_DEF_WHITELIST autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --NextPart A new Request for Comments is now available in online RFC libraries. RFC 4029 Title: Scenarios and Analysis for Introducing IPv6 into ISP Networks Author(s): M. Lind, V. Ksinant, S. Park, A. Baudot, P. Savola Status: Informational Date: March 2005 Mailbox: mikael.lind@teliasonera.com, vladimir.ksinant@fr.thalesgroup.com, soohong.park@samsung.com, alain.baudot@francetelecom.com, psavola@funet.fi Pages: 28 Characters: 64388 Updates/Obsoletes/SeeAlso: None I-D Tag: draft-ietf-v6ops-isp-scenarios-analysis-03.txt URL: ftp://ftp.rfc-editor.org/in-notes/rfc4029.txt This document describes different scenarios for the introduction of IPv6 into an ISP's existing IPv4 network without disrupting the IPv4 service. The scenarios for introducing IPv6 are analyzed, and the relevance of already defined transition mechanisms are evaluated. Known challenges are also identified. This document is a product of the IPv6 Operations Working Group of the IETF. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST@IETF.ORG. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST@RFC-EDITOR.ORG. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info@RFC-EDITOR.ORG with the message body help: ways_to_get_rfcs. For example: To: rfc-info@RFC-EDITOR.ORG Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to RFC-Manager@RFC-EDITOR.ORG. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR@RFC-EDITOR.ORG. Please consult RFC 2223, Instructions to RFC Authors, for further information. Joyce K. Reynolds and Sandy Ginoza USC/Information Sciences Institute ... Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the ASCII version of the RFCs. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="RFC-INFO@RFC-EDITOR.ORG" Content-Type: text/plain Content-ID: <050318174029.RFC@RFC-EDITOR.ORG> RETRIEVE: rfc DOC-ID: rfc4029 --OtherAccess Content-Type: Message/External-body; name="rfc4029.txt"; site="ftp.isi.edu"; access-type="anon-ftp"; directory="in-notes" Content-Type: text/plain Content-ID: <050318174029.RFC@RFC-EDITOR.ORG> --OtherAccess-- --NextPart-- From owner-v6ops@ops.ietf.org Sat Mar 19 12:14:53 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA07944 for ; Sat, 19 Mar 2005 12:14:52 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DChV0-000KUy-B4 for v6ops-data@psg.com; Sat, 19 Mar 2005 17:12:30 +0000 Received: from [171.71.176.71] (helo=sj-iport-2.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DChUy-000KUe-AF for v6ops@ops.ietf.org; Sat, 19 Mar 2005 17:12:28 +0000 Received: from sj-core-2.cisco.com (171.71.177.254) by sj-iport-2.cisco.com with ESMTP; 19 Mar 2005 09:12:29 -0800 Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-2.cisco.com (8.12.10/8.12.6) with ESMTP id j2JHCKgE001939; Sat, 19 Mar 2005 09:12:21 -0800 (PST) Received: from [10.32.244.218] (stealth-10-32-244-218.cisco.com [10.32.244.218]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with SMTP id BDB88981; Sat, 19 Mar 2005 09:12:24 -0800 (PST) In-Reply-To: <20050319151011.3acd7723.ipng@69706e6720323030352d30312d31340a.nosense.org> References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <20050318182718.0743ccc5.ipng@69706e6720323030352d30312d31340a.nosense.org> <82201c21584869714a51a5afa6f7ccbb@cisco.com> <20050319151011.3acd7723.ipng@69706e6720323030352d30312d31340a.nosense.org> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: <1907d3f8ff27a141951cd12f4eaaa5eb@cisco.com> Content-Transfer-Encoding: 7bit Cc: jspence@native6.com, v6ops@ops.ietf.org From: Baker Fred Subject: IPv6 security somewhat imperfect Date: Sat, 19 Mar 2005 09:12:23 -0800 To: Mark Smith X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit We're wandering a bit far afield from the original thread, so I changed the thread subject. Here's another one. Viruses today scan one's address book and do interesting things. Imagine a virus that scans the SMTP headers on your incoming mail and learns the names (which will translate to a current address) and the address (the one that was in use at the time of the transmission) of the MUAs and MTAs en route? If a virus can find one host on a remote LAN and infect it, that host can do a link-local ping to all-hosts. My point in this is that I find the discussion of IPv6 security a little self-congratulatory... On Mar 18, 2005, at 8:40 PM, Mark Smith wrote: > Hi Fred, > > On Fri, 18 Mar 2005 06:58:31 -0500 > Baker Fred wrote: > >> Multicast in various forms. The most useful ones would be the >> All-Nodes >> Multicast Address (link-local) and the All-Routers Multicast Address >> (site-local). >> > > Oh, OK, the good old "broadcast ping", using m/c in IPv6. I don't think > I've heard of them being called "letter-bombs" before. > >> In IPv4, a simple letter-bomb is subnet broadcast. If you know or >> think >> that 123.45.67.0/24 is a subnet in a company, pinging 123.45.67.255 >> might very well get you an ICMP Echo Response from each host on that >> LAN. In IPv6, pinging any multicast address should get you an ICMPv6 >> Echo Response from each host in the multicast group. The pinging >> All-Routers should get you a list of the routers in a network, and >> therefore a list of the transit subnets in a network (but not >> necessarily the edge LANs that have only one router on them). >> Subnet-router anycast address will certainly find a router in your >> subnet, and (rather than arping for each of your neighbors as is >> currently done by viruses), pinging the All-Nodes Multicast Address >> should get you an echo response from every node on your local LAN. >> Solicited-Node Multicast also gives you some sweeping capability, >> albeit only on your local lan. >> > > It's a bit of a surprise to me that the offlink sourced methods you've > described would work in IPv6, because I've assumed that as directed > broadcast style techniques had been deprecated in IPv4, they also > wouldn't be available in IPv6. It seems that isn't the case. Based on > my > assumption, unicast sweep pinging seemed to be the only possible way to > find remote hosts. > > Is there some mechanism in IPv6 that would allow selective responses to > multicast ICMPv6 echo requests, somehow based on the source address or > a > combination of the source address and multicast scope ? For example, an > echo-reply to a multicast echo-request would only be sent if the scope > of the destination multicast address was site, and the source IPv6 > address was a member of the same site or possibly the source address as > the same /48 prefix as one of the unicast addresses assigned to one of > the interfaces on the possibly responding host. > > I've had a look at the ICMPv6 RFC, the section on Echo-requests/replys > doesn't mention any selective response mechanisms. I'll start looking > at > some others, it will also help me brush up on IPv6 details again. If > there are any other pointers to RFCs covering this area, I'd > appreciate it. > >> So the counterpart of today's IPv4 virus that sweeps its local LAN is >> a >> virus that sends two pings, one to All-Nodes and one to All-Routers. >> The echo responses give the application information about the network. >> > > I'd think they'd be quite common, as it seems pretty easy today to get > an user to install software they don't know about behind their NAT box > or proxy server. > > Thanks, > Mark. > > -- > > The Internet's nature is peer to peer. > From owner-v6ops@ops.ietf.org Sat Mar 19 12:24:55 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA08434 for ; Sat, 19 Mar 2005 12:24:54 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DChg6-000LsI-DT for v6ops-data@psg.com; Sat, 19 Mar 2005 17:23:58 +0000 Received: from [213.136.24.43] (helo=purgatory.unfix.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DChg4-000Lry-Q2 for v6ops@ops.ietf.org; Sat, 19 Mar 2005 17:23:57 +0000 Received: from firenze.zurich.ibm.com (pat.zurich.ibm.com [195.176.20.45]) (using SSLv3 with cipher RC4-MD5 (128/128 bits)) (No client certificate requested) by purgatory.unfix.org (Postfix) with ESMTP id 9D8B7887D; Sat, 19 Mar 2005 18:23:53 +0100 (CET) Subject: Re: IPv6 security somewhat imperfect From: Jeroen Massar To: Baker Fred Cc: v6ops@ops.ietf.org In-Reply-To: <1907d3f8ff27a141951cd12f4eaaa5eb@cisco.com> References: <200503170321.j2H3LcwT028094@hestia.native6.com> <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <20050318182718.0743ccc5.ipng@69706e6720323030352d30312d31340a.nosense.org> <82201c21584869714a51a5afa6f7ccbb@cisco.com> <20050319151011.3acd7723.ipng@69706e6720323030352d30312d31340a.nosense.org> <1907d3f8ff27a141951cd12f4eaaa5eb@cisco.com> Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="=-Yxyi1f+LN82USjokeXN2" Organization: Unfix Date: Sat, 19 Mar 2005 18:23:50 +0100 Message-Id: <1111253030.31874.6.camel@firenze.zurich.ibm.com> Mime-Version: 1.0 X-Mailer: Evolution 2.1.5 (2.1.5-1) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --=-Yxyi1f+LN82USjokeXN2 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable On Sat, 2005-03-19 at 09:12 -0800, Baker Fred wrote: >We're wandering a bit far afield from the original thread, so I changed=20 >the thread subject. > >Here's another one. Viruses today scan one's address book and do=20 >interesting things. Imagine a virus that scans the SMTP headers on your=20 >incoming mail and learns the names (which will translate to a current=20 >address) and the address (the one that was in use at the time of the=20 >transmission) of the MUAs and MTAs en route? > >If a virus can find one host on a remote LAN and infect it, that host=20 >can do a link-local ping to all-hosts. Or use Samba to find out all the hosts in that domain and all the domains and thus all the hosts in a company, worldwide... And of course many many many many other methods. IP (both IPv4 and IPv6) are about addressing and making computers (and other things :) able to talk to each other end-to-end. IP is *not* about making computers *not* talk to each other. That this indeed has the side effect that some malicious operations are also able to talk, too bad -> use a firewall *and* configure that one correctly, oh and of course don't forget to keep your OS + software up to date ;) Greets, Jeroen --=-Yxyi1f+LN82USjokeXN2 Content-Type: application/pgp-signature; name=signature.asc Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Jeroen Massar / http://unfix.org/~jeroen/ iD8DBQBCPGAmKaooUjM+fCMRAjikAKC9Pn9EYns/rccTBn379OJL2R7tYwCgufzx BoKVKbyw9MfX6tg8T/eQ57o= =ELF7 -----END PGP SIGNATURE----- --=-Yxyi1f+LN82USjokeXN2-- From owner-v6ops@ops.ietf.org Sat Mar 19 18:35:52 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA02169 for ; Sat, 19 Mar 2005 18:35:52 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DCnRP-000GMM-CC for v6ops-data@psg.com; Sat, 19 Mar 2005 23:33:11 +0000 Received: from [131.107.3.124] (helo=mail2.microsoft.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DCnRO-000GMA-LV for v6ops@ops.ietf.org; Sat, 19 Mar 2005 23:33:10 +0000 Received: from mailout1.microsoft.com ([157.54.1.117]) by mail2.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Sat, 19 Mar 2005 15:33:09 -0800 Received: from red-hub-04.redmond.corp.microsoft.com ([157.54.3.6]) by mailout1.microsoft.com with Microsoft SMTPSVC(6.0.3790.1802); Sat, 19 Mar 2005 15:33:09 -0800 Received: from win-imc-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.39]) by red-hub-04.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3790.211); Sat, 19 Mar 2005 15:33:09 -0800 Received: from WIN-MSG-10.wingroup.windeploy.ntdev.microsoft.com ([157.54.12.81]) by win-imc-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3790.1802); Sat, 19 Mar 2005 15:33:09 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Sat, 19 Mar 2005 15:33:07 -0800 Message-ID: Thread-Topic: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Thread-Index: AcUsPsyp94MxmqP3R0CCO+L85UdW2AAnBojw From: "Christian Huitema" To: "Mark Smith" , "Baker Fred" Cc: , X-OriginalArrivalTime: 19 Mar 2005 23:33:09.0128 (UTC) FILETIME=[02337080:01C52CDC] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable > > ... In IPv6, pinging any multicast address should get you an ICMPv6 > > Echo Response from each host in the multicast group. The pinging > > All-Routers should get you a list of the routers in a network, and > > therefore a list of the transit subnets in a network (but not > > necessarily the edge LANs that have only one router on them). > > Subnet-router anycast address will certainly find a router in your > > subnet, and (rather than arping for each of your neighbors as is > > currently done by viruses), pinging the All-Nodes Multicast Address > > should get you an echo response from every node on your local LAN. > > Solicited-Node Multicast also gives you some sweeping capability, > > albeit only on your local lan. > > >=20 > It's a bit of a surprise to me that the offlink sourced methods you've > described would work in IPv6, because I've assumed that as directed > broadcast style techniques had been deprecated in IPv4, they also > wouldn't be available in IPv6. This technique does not work remotely -- the all nodes and all routers multicast addresses are defined in "link local" scope. The virus will only learn about directly connected targets, i.e. 1 hop away. Note that it is in any case very difficult to hide from nodes on the same subnet. The hypothetical virus can collect a list of targets by simply subscribing to local multicast groups, and passively waiting for traffic to come in -- the source address of a multicast describes a potential target. This works quite well for both IPv4 and IPv6. The advantage of IPv6 is that it very hard to perform a "remote scan" -- much hard than "for I=3D1 to 254 ping 123.45.67.$I". -- Christian Huitema From owner-v6ops@ops.ietf.org Sun Mar 20 21:12:09 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id VAA16535 for ; Sun, 20 Mar 2005 21:12:08 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDCLY-0002j4-Si for v6ops-data@psg.com; Mon, 21 Mar 2005 02:08:48 +0000 Received: from [168.103.150.210] (helo=hestia.native6.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DDCLV-0002iQ-AV for v6ops@ops.ietf.org; Mon, 21 Mar 2005 02:08:45 +0000 Received: from JSN6LT (c-24-16-64-144.client.comcast.net [24.16.64.144]) (authenticated bits=0) by hestia.native6.com (8.12.8/8.12.8) with ESMTP id j2L28YwT022796 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Sun, 20 Mar 2005 18:08:36 -0800 Message-Id: <200503210208.j2L28YwT022796@hestia.native6.com> From: "John Spence, CCSI, CCNA, CISSP" To: "'Mark Smith'" Cc: Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Sun, 20 Mar 2005 18:08:35 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 Thread-Index: AcUri6uj6PnRibniR2+lqjEJaEqW+QCG+yiw In-Reply-To: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit How does this sound Yurie? Demonstrating the brand we wish to portray? ---------------------------- Mark, et. al - my comments below, interleaved. > Unfortunately, proxies break the end-to-end argument, as they > maintain state within the network. If the proxy breaks, > devices would not be able to access the resources they may > still have an IP layer path to. Proxies are worth avoiding for > the same reason NAT is. Proxies absolutely break end-to-end. As does NAT. As do stateful firewalls. If NAT can be eliminated, that would be a great step in the right direction. As for stateful firewalls, and I would argue application proxies, companies will continue to deploy these for a number of reasons. These are internal risk/reward decisions for local administrators to make - not a good place for the IETF to try to enforce policy. Believe me, if there is a demand for IPv6-capably proxy servers, the market will provide them. > Geoff Huston wrote an excellent paper describing the issues > that "middleware" (the generic name for things such as > proxies) cause in networks. You can download it at > > http://www.potaroo.net/ispcol/2001-04/2001-04-midware.pdf > > He has a number of other insightful papers on his "ISP > Column" web page at > > http://www.potaroo.net/ispcol/index.html > > > All the policy mechanisms you mention really are best done on > the end host itself. There are two main reasons. Firstly, the > application of policy doesn't rely on a known topology of the > network. Consider a non-IT person bringing in a cheap > wireless AP they bought on the week end, and inserting it at > their wired wall point. Upstream "policy applying devices", > such as firewalls, proxy servers etc, aren't necessarily > effective anymore, as they won't see the wireless traffic. > If the corporate policy was deployed to the node itself, it > doesn't matter what the network topology is anymore, nor > whether it changes surreptitiously or not. I first came > across this idea in Steve Bellovin's paper, "Distributed Firewalls", The example you give - where someone puts an AP onto the enterprise network - upstream firewalls and proxies still work fine. If the firewall is configured to only allow outbound access for tcp80 traffic from known proxy servers, clients on the AP networks will not be able to bypass the proxies. The problem in this example is unauthorized access to the internal enterprise network - not the ability to defeat the edge device security measures of firewalls and proxies. And I agree that distributed tools - like firewalls and policy enforcement are the way to go, and I look forward to their ongoing development. But for awhile, stateful edge firewalls and proxy servers have a role to play. > http://www.cs.columbia.edu/~smb/papers/distfw.html > > Secondly, deploying policy to the end hosts also provides the > best user granularity with the policy, as generally, it is > one end-user to one host. Identifying users at a per-host > level tends to be easier than network based identification > mechanisms. They also tend to be more fault tolerant, as a > failed policy (e.g., deny all access) on a user's host only > effects the single user, rather than a significantly larger > user population. > > I'm not necessarily saying all the mechanisms currently exist > to a level of maturity to do what I'm suggesting. However, > when we are considering the future, such as IPv6, I think it > is better to move on from less useful mechanisms, such as NAT > and proxies, sooner rather than later. Perhaps we agree more than disagree. As a pragmatist, and a deployment engineer, I am interested in practical matters - including near-term issues. For me, the NAP draft is about saying "here is a collection of tools and techniques that allow the elimination of NAT while maintaining a secure network". Right now, I think proxies should be one of the tools. And considering how much Internet traffic is proxyable, and how prevalent proxy-based value-add tools are in enterprises today, I think it warrants more emphasis. > Specific topology hiding mechanisms such as NAT or Proxys > aren't that useful in IPv6, as, due to the size of the IPv6 > address space, topology discovery techniques such as "sweep > pings" become impractical. Tony Hain pointed this out a while > back on the IPv6 mailing list. For example, (and I've > explored this a bit more at > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), > assuming the ability to sweep ping 100 IPv6 addresses per > second on a /64, and assuming a hit within the first 50%, it > would take 2 924 712 086.77 years to find a single host. Of > course, the odds go up with more hosts, however, the time to > sweep ping would still be impractical. Sure. Nonetheless, proxy servers provide host ID and network topology hiding, and should be quick and easy to deploy for IPv6 networks, and can serve a majority of Internet traffic, while allowing the security team to conduct other policy enformcement and packet/session analysis. Plus, the draft does spent quite bit of time talking about topology hiding and how it can be done for IPv6 networks - so I believe the draft is already saying that topology hiding *is* important. From owner-v6ops@ops.ietf.org Sun Mar 20 22:08:00 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id WAA21642 for ; Sun, 20 Mar 2005 22:08:00 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDDGG-000DZh-V3 for v6ops-data@psg.com; Mon, 21 Mar 2005 03:07:24 +0000 Received: from [210.84.239.251] (helo=ubu.nosense.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDDGC-000DYo-Fz for v6ops@ops.ietf.org; Mon, 21 Mar 2005 03:07:22 +0000 Received: from ubu.nosense.org (ubu.nosense.org [127.0.0.1]) by ubu.nosense.org (Postfix) with SMTP id 14EC062AAE; Mon, 21 Mar 2005 13:37:18 +1030 (CST) Date: Mon, 21 Mar 2005 13:37:17 +1030 From: Mark Smith To: "John Spence, CCSI, CCNA, CISSP" Cc: v6ops@ops.ietf.org Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Message-Id: <20050321133717.35e7d7f3.ipng@69706e6720323030352d30312d31340a.nosense.org> In-Reply-To: <200503210208.j2L28YwT022796@hestia.native6.com> References: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <200503210208.j2L28YwT022796@hestia.native6.com> X-Mailer: Sylpheed version 1.0.0beta1 (GTK+ 1.2.10; i686-pc-linux-gnu) Mime-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit On Sun, 20 Mar 2005 18:08:35 -0800 "John Spence, CCSI, CCNA, CISSP" wrote: > > How does this sound Yurie? Demonstrating the brand we wish to portray? > > ---------------------------- > > > Mark, et. al - my comments below, interleaved. > > > Unfortunately, proxies break the end-to-end argument, as they > > maintain state within the network. If the proxy breaks, > > devices would not be able to access the resources they may > > still have an IP layer path to. Proxies are worth avoiding for > > the same reason NAT is. > > Proxies absolutely break end-to-end. As does NAT. As do stateful > firewalls. > If NAT can be eliminated, that would be a great step in the right direction. > As > for stateful firewalls, and I would argue application proxies, companies > will > continue to deploy these for a number of reasons. These are internal > risk/reward > decisions for local administrators to make - not a good place for the IETF > to try > to enforce policy. Believe me, if there is a demand for IPv6-capably proxy > servers, > the market will provide them. > I agree that if there is demand, they will be created. I suppose my position tends to be that some technologies shouldn't be encouraged, and going into detail in an RFC tends to be encouraging them. I think a lot of the time, vendors implement things according to RFCs, which is fine, and then customers of those vendors then just buy the product because it states compliance with a list of RFCs, without reading them. Sadly, that means that any limitations or disadvantages identified in the RFCs aren't known by the people who probably most need to be aware of them. NAT is a good example I think. Even the actual NAT RFCs list a number of limitations, yet most NAT propopents aren't aware of them. I start to wonder whether publishing the NAT RFCs was a good idea in the first place, as I think a lot of people just use the existance of an RFC on the technology as a technology blessing ! > > Geoff Huston wrote an excellent paper describing the issues > > that "middleware" (the generic name for things such as > > proxies) cause in networks. You can download it at > > > > http://www.potaroo.net/ispcol/2001-04/2001-04-midware.pdf > > > > He has a number of other insightful papers on his "ISP > > Column" web page at > > > > http://www.potaroo.net/ispcol/index.html > > > > > > All the policy mechanisms you mention really are best done on > > the end host itself. There are two main reasons. Firstly, the > > application of policy doesn't rely on a known topology of the > > network. Consider a non-IT person bringing in a cheap > > wireless AP they bought on the week end, and inserting it at > > their wired wall point. Upstream "policy applying devices", > > such as firewalls, proxy servers etc, aren't necessarily > > effective anymore, as they won't see the wireless traffic. > > If the corporate policy was deployed to the node itself, it > > doesn't matter what the network topology is anymore, nor > > whether it changes surreptitiously or not. I first came > > across this idea in Steve Bellovin's paper, "Distributed Firewalls", > > The example you give - where someone puts an AP onto the enterprise network > - > upstream firewalls and proxies still work fine. If the firewall is > configured to only > allow outbound access for tcp80 traffic from known proxy servers, clients on > the > AP networks will not be able to bypass the proxies. The problem in this > example is > unauthorized access to the internal enterprise network - not the ability to > defeat > the edge device security measures of firewalls and proxies. > True. My example is only really to show how easy network topology based security mechanisms are easy and cheap to violate by fairly "ordinary" end users. > And I agree that distributed tools - like firewalls and policy enforcement > are the > way to go, and I look forward to their ongoing development. But for awhile, > stateful > edge firewalls and proxy servers have a role to play. > I certainly agree that will be the case for IPv4. I wonder whether that needs to be the case with IPv6 ? The introduction of IPv6 could be an opportunity to not only deploy an improved network layer technology, but also an opportunity to change the mindset on some of these common IPv4 technologies. > > http://www.cs.columbia.edu/~smb/papers/distfw.html > > > > Secondly, deploying policy to the end hosts also provides the > > best user granularity with the policy, as generally, it is > > one end-user to one host. Identifying users at a per-host > > level tends to be easier than network based identification > > mechanisms. They also tend to be more fault tolerant, as a > > failed policy (e.g., deny all access) on a user's host only > > effects the single user, rather than a significantly larger > > user population. > > > > I'm not necessarily saying all the mechanisms currently exist > > to a level of maturity to do what I'm suggesting. However, > > when we are considering the future, such as IPv6, I think it > > is better to move on from less useful mechanisms, such as NAT > > and proxies, sooner rather than later. > > Perhaps we agree more than disagree. As a pragmatist, and a deployment > engineer, I am interested in practical matters - including near-term issues. > I think we do. My position on things such as NAT and proxy servers is based on having my fingers burnt a few times by, more broadly, state in the network. I suppose I'm looking to identify opportunities where, in the future, those problems can be avoided, rather than them having to be remedied. I'm hoping that IPv6 will provide those opportunities. That's why I'd like to discourage "legacy" IPv4 technologies in IPv6 if it is possible. > For me, the NAP draft is about saying "here is a collection of tools and > techniques > that allow the elimination of NAT while maintaining a secure network". > Right now, I > think proxies should be one of the tools. And considering how much Internet > traffic > is proxyable, and how prevalent proxy-based value-add tools are in > enterprises today, > I think it warrants more emphasis. > > > Specific topology hiding mechanisms such as NAT or Proxys > > aren't that useful in IPv6, as, due to the size of the IPv6 > > address space, topology discovery techniques such as "sweep > > pings" become impractical. Tony Hain pointed this out a while > > back on the IPv6 mailing list. For example, (and I've > > explored this a bit more at > > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), > > assuming the ability to sweep ping 100 IPv6 addresses per > > second on a /64, and assuming a hit within the first 50%, it > > would take 2 924 712 086.77 years to find a single host. Of > > course, the odds go up with more hosts, however, the time to > > sweep ping would still be impractical. > > Sure. Nonetheless, proxy servers provide host ID and network topology > hiding, and should be quick and easy to deploy for IPv6 networks, and can > serve a majority of Internet traffic, while allowing the security team to > conduct > other policy enformcement and packet/session analysis. > > Plus, the draft does spent quite bit of time talking about topology hiding > and > how it can be done for IPv6 networks - so I believe the draft is already > saying that > topology hiding *is* important. Is it really ? I tend to read the emphasis on topology hiding in the draft to be more that pro-NAT proponents consider it to be important, and the draft is showing how IPv6 can achieve the same levels of topology hiding. I don't necessarily think that the emphasis is stating that topology hiding is actually important or that important. I tend to see this draft as a "rebuttal" document. There are a number of mechanisms in IPv4 that some IPv4 users consider important, such as NAT, and therefore think that they should be just blindly implemented in IPv6 for the same reasons. I think this draft says, "there is no need to, and here is why". Regards, Mark. -- The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Mon Mar 21 03:16:33 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id DAA03600 for ; Mon, 21 Mar 2005 03:16:32 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDI2M-000LmR-RN for v6ops-data@psg.com; Mon, 21 Mar 2005 08:13:22 +0000 Received: from [171.68.10.87] (helo=sj-iport-5.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDI25-000Lk9-Uu for v6ops@ops.ietf.org; Mon, 21 Mar 2005 08:13:05 +0000 Received: from sj-core-3.cisco.com (171.68.223.137) by sj-iport-5.cisco.com with ESMTP; 21 Mar 2005 00:13:06 -0800 Received: from mira-sjc5-b.cisco.com (IDENT:mirapoint@mira-sjc5-b.cisco.com [171.71.163.14]) by sj-core-3.cisco.com (8.12.10/8.12.6) with ESMTP id j2L8D2gS003951; Mon, 21 Mar 2005 00:13:03 -0800 (PST) Received: from [10.32.244.218] (stealth-10-32-244-218.cisco.com [10.32.244.218]) by mira-sjc5-b.cisco.com (MOS 3.4.5-GR) with SMTP id BDC87954; Mon, 21 Mar 2005 00:13:01 -0800 (PST) In-Reply-To: <20050321133717.35e7d7f3.ipng@69706e6720323030352d30312d31340a.nosense.org> References: <20050318175522.2877bd86.ipng@69706e6720323030352d30312d31340a.nosense.org> <200503210208.j2L28YwT022796@hestia.native6.com> <20050321133717.35e7d7f3.ipng@69706e6720323030352d30312d31340a.nosense.org> Mime-Version: 1.0 (Apple Message framework v619.2) Content-Type: text/plain; charset=US-ASCII; format=flowed Message-Id: Content-Transfer-Encoding: 7bit Cc: v6ops From: Baker Fred Subject: Re: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Mon, 21 Mar 2005 00:13:00 -0800 To: Mark Smith X-Mailer: Apple Mail (2.619.2) X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit On Mar 20, 2005, at 7:07 PM, Mark Smith wrote: > I agree that if there is demand, [proxies and stateful firewalls] will > be created. I suppose my position tends to be that some technologies > shouldn't be encouraged, and going into detail in an RFC tends to be > encouraging them. Actually, that isn't the case. The IETF documents the good, the bad, and the ugly, and the purpose is often community memory. For an example, take a look at Transaction TCP (RFC 1644) and the rather large number of experimental and historical RFCs. "Experimental" doesn't mean "bad", but it also doesn't mean "thought well of" either. And something that can be immensely helpful is documenting the purpose being served, the options available for serving it, and giving advice on how to do that in a way that imposes the least damage. Saying nothing gives no guidance; saying "stateful firewalls have limiting characteristics which can be mitigated if attribute is a feature of it and is used in a certain way" can be a very helpful thing. Instead of saying "As a purist I don't like this", I think we're all better off if we can describe how to meet network requirements in a way that minimizes damage to the architecture - which IIRC is what the NAP document is all about. From owner-v6ops@ops.ietf.org Mon Mar 21 12:27:27 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id MAA28816 for ; Mon, 21 Mar 2005 12:27:26 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDQeT-000KtQ-Iw for v6ops-data@psg.com; Mon, 21 Mar 2005 17:25:17 +0000 Received: from [168.103.150.210] (helo=hestia.native6.com) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DDQeQ-000KsS-62 for v6ops@ops.ietf.org; Mon, 21 Mar 2005 17:25:14 +0000 Received: from JSN6LT ([10.128.0.87]) (authenticated bits=0) by hestia.native6.com (8.12.8/8.12.8) with ESMTP id j2LHP6wT025705 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Mon, 21 Mar 2005 09:25:06 -0800 Message-Id: <200503211725.j2LHP6wT025705@hestia.native6.com> From: "John Spence, CCSI, CCNA, CISSP" To: "'Mark Smith'" Cc: Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Mon, 21 Mar 2005 09:25:07 -0800 MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit X-Mailer: Microsoft Office Outlook, Build 11.0.6353 In-Reply-To: <20050321133717.35e7d7f3.ipng@69706e6720323030352d30312d31340a.nosense.org> Thread-Index: AcUtxO6coSj6F26sS3ua9uSB3DtBAwAcbgBg X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1478 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit Mark; I think we've covered the waterfront on this issue. I think we basically have differing views on how much "operational, practical, market-reality" issues should be covered by IETF documents, and how "true to the vision of the protocol" the documents should remain. I think a great outcome for the NAP draft would be to eliminate NAT, and any perception that NAT was something organizations should *want* to deploy - as opposed to something they may have *had* to deploy in the IPv4 world. If maintaining some state in the network for the foreseeable future - stateful firewalls and application proxies - helps advance that cause I think it is a terrific tradeoff. I'm happy to leave it to the authors to decide how much weight proxy servers get as part of the operational security model (if any), and how much text is devoted to it in their document. Good discussion. Spence ------------------------ > > Mark, et. al - my comments below, interleaved. > > > > > Unfortunately, proxies break the end-to-end argument, as they > > > maintain state within the network. If the proxy breaks, devices > > > would not be able to access the resources they may still > have an IP > > > layer path to. Proxies are worth avoiding for the same reason NAT > > > is. > > > > Proxies absolutely break end-to-end. As does NAT. As do stateful > > firewalls. > > If NAT can be eliminated, that would be a great step in the > right direction. > > As > > for stateful firewalls, and I would argue application proxies, > > companies will continue to deploy these for a number of reasons. > > These are internal risk/reward decisions for local > administrators to > > make - not a good place for the IETF to try to enforce policy. > > Believe me, if there is a demand for IPv6-capably proxy > servers, the > > market will provide them. > > > > I agree that if there is demand, they will be created. I > suppose my position tends to be that some technologies > shouldn't be encouraged, and going into detail in an RFC > tends to be encouraging them. > > I think a lot of the time, vendors implement things according > to RFCs, which is fine, and then customers of those vendors > then just buy the product because it states compliance with a > list of RFCs, without reading them. Sadly, that means that > any limitations or disadvantages identified in the RFCs > aren't known by the people who probably most need to be aware of them. > > NAT is a good example I think. Even the actual NAT RFCs list > a number of limitations, yet most NAT proponents aren't aware > of them. I start to wonder whether publishing the NAT RFCs > was a good idea in the first place, as I think a lot of > people just use the existence of an RFC on the technology as > a technology blessing ! > > > > Geoff Huston wrote an excellent paper describing the issues that > > > "middleware" (the generic name for things such as > > > proxies) cause in networks. You can download it at > > > > > > http://www.potaroo.net/ispcol/2001-04/2001-04-midware.pdf > > > > > > He has a number of other insightful papers on his "ISP > Column" web > > > page at > > > > > > http://www.potaroo.net/ispcol/index.html > > > > > > > > > All the policy mechanisms you mention really are best done on the > > > end host itself. There are two main reasons. Firstly, the > > > application of policy doesn't rely on a known topology of the > > > network. Consider a non-IT person bringing in a cheap wireless AP > > > they bought on the week end, and inserting it at their wired wall > > > point. Upstream "policy applying devices", such as > firewalls, proxy > > > servers etc, aren't necessarily effective anymore, as > they won't see > > > the wireless traffic. > > > If the corporate policy was deployed to the node itself, > it doesn't > > > matter what the network topology is anymore, nor whether > it changes > > > surreptitiously or not. I first came across this idea in Steve > > > Bellovin's paper, "Distributed Firewalls", > > > > The example you give - where someone puts an AP onto the enterprise > > network > > - > > upstream firewalls and proxies still work fine. If the firewall is > > configured to only allow outbound access for tcp80 traffic > from known > > proxy servers, clients on the AP networks will not be able > to bypass > > the proxies. The problem in this example is unauthorized > access to the > > internal enterprise network - not the ability to defeat the edge > > device security measures of firewalls and proxies. > > > > True. My example is only really to show how easy network > topology based security mechanisms are easy and cheap to > violate by fairly "ordinary" > end users. > > > > And I agree that distributed tools - like firewalls and policy > > enforcement are the way to go, and I look forward to their ongoing > > development. But for awhile, stateful edge firewalls and proxy > > servers have a role to play. > > > > I certainly agree that will be the case for IPv4. I wonder > whether that needs to be the case with IPv6 ? The > introduction of IPv6 could be an opportunity to not only > deploy an improved network layer technology, but also an > opportunity to change the mindset on some of these common > IPv4 technologies. > > > > > http://www.cs.columbia.edu/~smb/papers/distfw.html > > > > > > Secondly, deploying policy to the end hosts also provides > the best > > > user granularity with the policy, as generally, it is one > end-user > > > to one host. Identifying users at a per-host level tends to be > > > easier than network based identification mechanisms. They > also tend > > > to be more fault tolerant, as a failed policy (e.g., deny all > > > access) on a user's host only effects the single user, > rather than a > > > significantly larger user population. > > > > > > I'm not necessarily saying all the mechanisms currently > exist to a > > > level of maturity to do what I'm suggesting. However, when we are > > > considering the future, such as IPv6, I think it is > better to move > > > on from less useful mechanisms, such as NAT and proxies, sooner > > > rather than later. > > > > Perhaps we agree more than disagree. As a pragmatist, and a > > deployment engineer, I am interested in practical matters - > including near-term issues. > > > > I think we do. My position on things such as NAT and proxy > servers is based on having my fingers burnt a few times by, > more broadly, state in the network. I suppose I'm looking to > identify opportunities where, in the future, those problems > can be avoided, rather than them having to be remedied. > I'm hoping that IPv6 will provide those opportunities. That's > why I'd like to discourage "legacy" IPv4 technologies in IPv6 > if it is possible. > > > For me, the NAP draft is about saying "here is a collection > of tools > > and techniques that allow the elimination of NAT while > maintaining a > > secure network". > > Right now, I > > think proxies should be one of the tools. And considering how much > > Internet traffic is proxyable, and how prevalent > proxy-based value-add > > tools are in enterprises today, I think it warrants more emphasis. > > > > > Specific topology hiding mechanisms such as NAT or Proxys aren't > > > that useful in IPv6, as, due to the size of the IPv6 > address space, > > > topology discovery techniques such as "sweep pings" become > > > impractical. Tony Hain pointed this out a while back on the IPv6 > > > mailing list. For example, (and I've explored this a bit more at > > > http://www.circleid.com/article.php?id=805_0_1_0_C/ ), > assuming the > > > ability to sweep ping 100 IPv6 addresses per second on a /64, and > > > assuming a hit within the first 50%, it would take 2 924 > 712 086.77 > > > years to find a single host. Of course, the odds go up with more > > > hosts, however, the time to sweep ping would still be impractical. > > > > Sure. Nonetheless, proxy servers provide host ID and > network topology > > hiding, and should be quick and easy to deploy for IPv6 > networks, and > > can serve a majority of Internet traffic, while allowing > the security > > team to conduct other policy enforcement and > packet/session analysis. > > > > Plus, the draft does spent quite bit of time talking about > topology > > hiding and how it can be done for IPv6 networks - so I believe the > > draft is already saying that topology hiding *is* important. > > Is it really ? I tend to read the emphasis on topology hiding > in the draft to be more that pro-NAT proponents consider it > to be important, and the draft is showing how IPv6 can > achieve the same levels of topology hiding. I don't > necessarily think that the emphasis is stating that topology > hiding is actually important or that important. > > I tend to see this draft as a "rebuttal" document. There are > a number of mechanisms in IPv4 that some IPv4 users consider > important, such as NAT, and therefore think that they should > be just blindly implemented in IPv6 for the same reasons. I > think this draft says, "there is no need to, and here is why". > > Regards, > Mark. > > -- > > The Internet's nature is peer to peer. From owner-v6ops@ops.ietf.org Mon Mar 21 15:35:28 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA15704 for ; Mon, 21 Mar 2005 15:35:27 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDTax-000ERe-LV for v6ops-data@psg.com; Mon, 21 Mar 2005 20:33:51 +0000 Received: from [216.52.23.28] (helo=whisker.bluecoat.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDTaw-000ERH-Jf for v6ops@ops.ietf.org; Mon, 21 Mar 2005 20:33:50 +0000 Received: from bcs-mail.bluecoat.com (bcs-mail.bluecoat.com [216.52.23.69]) by whisker.bluecoat.com (8.13.0/8.13.0) with ESMTP id j2LKXYcP009106; Mon, 21 Mar 2005 12:33:35 -0800 (PST) X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Mon, 21 Mar 2005 12:33:28 -0800 Message-ID: <00CDF9AA240E204FA6E923BD35BC643609043FC9@bcs-mail.internal.cacheflow.com> Thread-Topic: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Thread-Index: AcUsTUSTCd2bA68qTcGFMv4HPRSS2gCA/Sdg From: "Li, Qing" To: "Mark Smith" Cc: , , X-Scanned-By: MIMEDefang 2.49 on 216.52.23.28 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable > >=20 > > address time-of-day week-day bandwidth-alloc > > -------------------------------------------------------------- > > IPv6-addr-X 9:00AM - 3:00PM M,W,TH,F X-kbps > >=20 > > would be difficult to enforce if IPv6-addr-X either=20 > constantly remaps=20 > > to a different node, or if the node constantly replaces IPv6-addr-X=20 > > with something else. > >=20 >=20 > The key term here is identification. When you identify using=20 > a network layer address, you aren't really identifying a=20 > person, you are identifying a node,=20 > No disagreement here at all WRT to node vs. user identification and the corresponding level of policy application and enforcement. One important differentiator between a proxy and a firewall is in proxy's ability to define higher level rules and enforce those rules. The point of the discussion, however, was that there may exist situations where a network administrator may want to write a policy based on a node id instead of a policy based on individual users. For example, a large corporation may have designated nodes=20 on designated subnets for access by contractors and interns. The=20 egress proxy may contain such policies. I also don't want to assume=20 the various network topologies in which the proxies are deployed and the types of policy rules that make sense in those different topologies. The discussions carried in the NAP draft document on the addresses and mechanisms on hiding networks, IMHO, impact the deployment and operations of proxies that are becoming ever more popular in enterprise environments. Therefore, I feel the doc should address the proxy space. -- Qing From owner-v6ops@ops.ietf.org Mon Mar 21 17:38:01 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id RAA04670 for ; Mon, 21 Mar 2005 17:38:00 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDVVh-000IgJ-0P for v6ops-data@psg.com; Mon, 21 Mar 2005 22:36:33 +0000 Received: from [216.52.23.28] (helo=whisker.bluecoat.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDVVe-000IfO-3Z for v6ops@ops.ietf.org; Mon, 21 Mar 2005 22:36:30 +0000 Received: from bcs-mail.bluecoat.com (bcs-mail.bluecoat.com [216.52.23.69]) by whisker.bluecoat.com (8.13.0/8.13.0) with ESMTP id j2LMaJCh015776; Mon, 21 Mar 2005 14:36:19 -0800 (PST) X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Mon, 21 Mar 2005 14:36:13 -0800 Message-ID: <00CDF9AA240E204FA6E923BD35BC643609044064@bcs-mail.internal.cacheflow.com> Thread-Topic: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Thread-Index: AcUri6uj6PnRibniR2+lqjEJaEqW+QCG+yiwAC+RVdA= From: "Li, Qing" To: "John Spence, CCSI, CCNA, CISSP" , "Mark Smith" Cc: X-Scanned-By: MIMEDefang 2.49 on 216.52.23.28 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable >=20 > For me, the NAP draft is about saying "here is a collection=20 > of tools and techniques that allow the elimination of NAT=20 > while maintaining a secure network". > Right now, I think proxies should be one of the tools. And considering=20 > how much Internet traffic is proxyable, and how prevalent=20 > proxy-based value-add tools are in enterprises today,=20 > I think it warrants more emphasis. >=20 Yes. >=20 > Nonetheless, proxy servers provide host ID and network=20 > topology hiding, and should be quick and easy to deploy for=20 > IPv6 networks, and can serve a majority of Internet traffic,=20 > while allowing the security team to conduct other policy=20 > enformcement and packet/session analysis. >=20 Yup. -- Qing From owner-v6ops@ops.ietf.org Mon Mar 21 18:05:49 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id SAA08828 for ; Mon, 21 Mar 2005 18:05:48 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDVxS-0000Uj-Mw for v6ops-data@psg.com; Mon, 21 Mar 2005 23:05:14 +0000 Received: from [216.52.23.28] (helo=whisker.bluecoat.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDVxR-0000US-Ot for v6ops@ops.ietf.org; Mon, 21 Mar 2005 23:05:13 +0000 Received: from bcs-mail.bluecoat.com (bcs-mail.bluecoat.com [216.52.23.69]) by whisker.bluecoat.com (8.13.0/8.13.0) with ESMTP id j2LN555l017301; Mon, 21 Mar 2005 15:05:05 -0800 (PST) X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Date: Mon, 21 Mar 2005 15:04:58 -0800 Message-ID: <00CDF9AA240E204FA6E923BD35BC643609044079@bcs-mail.internal.cacheflow.com> Thread-Topic: draft-vandevelde-v6ops-nap-01.txt - "maybe add a bit more on proxy servers ..." Thread-Index: AcUtxJVVUg7O/FofSKe3EQr3X0RG8gAoyUqA From: "Li, Qing" To: "Mark Smith" , "John Spence, CCSI, CCNA, CISSP" Cc: X-Scanned-By: MIMEDefang 2.49 on 216.52.23.28 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable >=20 > I think we do. My position on things such as NAT and proxy=20 > servers is based on having my fingers burnt a few times by,=20 > more broadly, state in the network. I suppose I'm looking to=20 > identify opportunities where, in the future, those problems=20 > can be avoided, rather than them having to be remedied. > I'm hoping that IPv6 will provide those opportunities. That's=20 > why I'd like to discourage "legacy" IPv4 technologies in IPv6=20 > if it is possible. >=20 You are certainly right in that some proxy functions are=20 provided to circumvent the limitations in IPv4 deployment.=20 However, many proxy functions are developed for other good=20 reasons. I think classifying proxy servers in general as=20 "legacy" IPv4 technologies is something we should avoid.=20 For example, having a reverse proxy placed in front of a set of web servers hides the identities of those servers and can improve performance. Such a proxy would still be necessary in the IPv6 environment. -- Qing From owner-v6ops@ops.ietf.org Tue Mar 22 01:09:15 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id BAA14996 for ; Tue, 22 Mar 2005 01:09:14 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDcWO-000NJO-AU for v6ops-data@psg.com; Tue, 22 Mar 2005 06:05:44 +0000 Received: from [193.94.160.1] (helo=netcore.fi) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDcWM-000NIl-Uk for v6ops@ops.ietf.org; Tue, 22 Mar 2005 06:05:43 +0000 Received: from localhost (pekkas@localhost) by netcore.fi (8.11.6/8.11.6) with ESMTP id j2M65fG02979; Tue, 22 Mar 2005 08:05:41 +0200 Date: Tue, 22 Mar 2005 08:05:41 +0200 (EET) From: Pekka Savola To: v6ops@ops.ietf.org cc: Elwyn Davies Subject: Re: WG last call on NAT-PT to Experimental In-Reply-To: Message-ID: References: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.5 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Folks -- The WG last call ends in a couple of days. More comments, feedback, suggestions for improvement etc. would be welcome... On Thu, 10 Mar 2005, Pekka Savola wrote: > (co-chair hat on) > > This is a working group last call on publishing "Reasons to Move NAT-PT to > Experimental" (draft-ietf-v6ops-natpt-to-exprmntl-00.txt) as an Informational > RFC. > > Please send any substantive comments on the list. The deadline for comments > is in about two weeks, 24th March. > > Thanks! > > (hat off) > -- Pekka Savola "You each name yourselves king, yet the Netcore Oy kingdom bleeds." Systems. Networks. Security. -- George R.R. Martin: A Clash of Kings From owner-v6ops@ops.ietf.org Tue Mar 22 05:38:11 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA27839 for ; Tue, 22 Mar 2005 05:38:11 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DDgjF-000IQe-NS for v6ops-data@psg.com; Tue, 22 Mar 2005 10:35:17 +0000 Received: from [144.254.224.140] (helo=ams-iport-1.cisco.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DDgjE-000IQP-Hx for v6ops@ops.ietf.org; Tue, 22 Mar 2005 10:35:16 +0000 Received: from ams-core-1.cisco.com (144.254.224.150) by ams-iport-1.cisco.com with ESMTP; 22 Mar 2005 11:35:16 +0100 Received: from xbh-ams-332.emea.cisco.com (xbh-ams-332.cisco.com [144.254.231.87]) by ams-core-1.cisco.com (8.12.10/8.12.6) with ESMTP id j2MAYpmG016183; Tue, 22 Mar 2005 11:35:12 +0100 (MET) Received: from xfe-ams-331.emea.cisco.com ([144.254.231.72]) by xbh-ams-332.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.0); Tue, 22 Mar 2005 11:34:50 +0100 Received: from evyncke-w2k02.cisco.com ([10.55.1.162]) by xfe-ams-331.emea.cisco.com with Microsoft SMTPSVC(6.0.3790.211); Tue, 22 Mar 2005 11:34:50 +0100 Message-Id: <5.1.0.14.2.20050322111024.04bbc718@127.0.0.1> X-Sender: evyncke@127.0.0.1 X-Mailer: QUALCOMM Windows Eudora Version 5.1 Date: Tue, 22 Mar 2005 11:34:33 +0100 To: Pekka Savola From: Eric Vyncke Subject: Re: Some comments on draft-tschofenig-v6ops-secure-tunnels Cc: Mohan Parthasarathy , v6ops@ops.ietf.org In-Reply-To: References: <02de01c52509$f7cc1e50$6601a8c0@adithya> <5.1.0.14.2.20050309174157.042609a0@127.0.0.1> <02de01c52509$f7cc1e50$6601a8c0@adithya> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-OriginalArrivalTime: 22 Mar 2005 10:34:50.0430 (UTC) FILETIME=[C6D8DDE0:01C52ECA] X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Sorry for late reply to your reply ;) At 03:21 10/03/2005 +0200, Pekka Savola wrote: ... >>>5) another use case scenario can be (and actually I've seen it deployed): using this IPsec protected IPv6 tunnel as a back-up link of a 'real native' IPv6 link in order to provide resiliency. This of course requires routing protocols hence the use of the 'transport mode' variant. >> >>I don't know whether it is relevant to the current document or not. I will let Pekka answer this. > >(This is my opinion only, of course. :) > >As far as I understand, the above is only an issue if the tunnel mode SA is not modelled as an interface (based on the touch-vpn, now RFC3884, right? If it's an interface, it could be used to run a routing protocol (as long as it's not IS-IS :-) just fine? Correct indeed. Except, that AFAIK IPsec/IKEv2 do not allow multicast traffic over ESP and as most routing protocols rely on multicast to discover neighbour. But, this is a kind of minor detail since a lot of implementations allow it. ... >So, I guess we already have all the technical bases covered (unless I'm missing something?), and the issue is just whether this usage scenario is should be explicitly mentioned in the draft. I'd say not, because this seems to be a much more specific example case than the ones we currently have in the draft, and listing a specific one might be misleading. It is indeed a variation of router to router scenario as a parallel link. I would not call this a specific case but a variation. Whether it is worth to add is another question of course ;-) Hope it helps -eric From owner-v6ops@ops.ietf.org Fri Mar 25 05:13:14 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA07322 for ; Fri, 25 Mar 2005 05:13:13 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DEllD-0005IL-Ur for v6ops-data@psg.com; Fri, 25 Mar 2005 10:09:47 +0000 Received: from [203.175.98.6] (helo=mail.hamdard.net.pk) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DEllA-0005Hh-HN for v6ops@ops.ietf.org; Fri, 25 Mar 2005 10:09:45 +0000 Received: from acad10 ([203.175.98.15]) by mail.hamdard.net.pk (8.11.6/8.11.6) with SMTP id j2P9oFR30179 for ; Fri, 25 Mar 2005 14:50:15 +0500 Message-ID: <005801c53122$c06b3e30$4300a8c0@hamdard.net.pk> From: "Abid Ghufran" To: Subject: generic network model Date: Fri, 25 Mar 2005 15:09:37 +0500 MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2800.1437 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441 X-Hamdard_Net-MailScanner-Information: Please contact the ISP for more information X-Hamdard_Net-MailScanner: Found to be clean X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit I am helping someone do an MS thesis. For that it is required to have a "generic network model" over which to simulate various transport mechanisms. Among all the documents specifying IPv6, is there any set of documents, which could be used to come up with a generic network model, including parameters/elements which later on, could be adapted according to the specifics of IPv4 and/or IPv6. I know this is a very vague situation but I would really appreciate any help in this regard, providing a clue or pointer whatsoever. Regards, Abid Ghufran. From owner-v6ops@ops.ietf.org Tue Mar 29 04:52:35 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id EAA08791 for ; Tue, 29 Mar 2005 04:52:35 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DGDLy-000EE0-Oi for v6ops-data@psg.com; Tue, 29 Mar 2005 09:49:42 +0000 Received: from [132.151.6.50] (helo=newodin.ietf.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DFxw1-000C6i-Oa for v6ops@ops.ietf.org; Mon, 28 Mar 2005 17:21:53 +0000 Received: from apache by newodin.ietf.org with local (Exim 4.43) id 1DFxvy-0003ac-JI; Mon, 28 Mar 2005 12:21:50 -0500 X-test-idtracker: no From: The IESG To: IETF-Announce Cc: Internet Architecture Board , RFC Editor , v6ops mailing list , v6ops chair , v6ops chair Subject: Document Action: 'Procedures for Renumbering an IPv6 Network without a Flag Day' to Informational RFC Message-Id: Date: Mon, 28 Mar 2005 12:21:50 -0500 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk The IESG has approved the following document: - 'Procedures for Renumbering an IPv6 Network without a Flag Day ' as an Informational RFC This document is the product of the IPv6 Operations Working Group. The IESG contact persons are David Kessens and Bert Wijnen. Technical Summary This document describes the steps that can be used to transition from the use of an existing ipv6 prefix to a new prefix in a network. Working Group Summary This document is a product of the v6ops working group. Review was solicited from the multi6 working group and the research community Protocol Quality This document was reviewed for the IESG by David Kessens From owner-v6ops@ops.ietf.org Tue Mar 29 11:03:24 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA13504 for ; Tue, 29 Mar 2005 11:03:24 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DGJA7-000GMh-6J for v6ops-data@psg.com; Tue, 29 Mar 2005 16:01:51 +0000 Received: from [132.151.1.176] (helo=ietf.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DGJA6-000GMG-0w for v6ops@ops.ietf.org; Tue, 29 Mar 2005 16:01:50 +0000 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA13050; Tue, 29 Mar 2005 11:01:47 -0500 (EST) Message-Id: <200503291601.LAA13050@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org Cc: v6ops@ops.ietf.org From: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-v6ops-nap-00.txt Date: Tue, 29 Mar 2005 11:01:47 -0500 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=BAYES_00,MIME_BOUND_NEXTPART, NO_REAL_NAME autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IPv6 Operations Working Group of the IETF. Title : IPv6 Network Architecture Protection Author(s) : G. Van de Velde, et al. Filename : draft-ietf-v6ops-nap-00.txt Pages : 30 Date : 2005-3-28 Although there are many perceived benefits to Network Address Translation (NAT), its primary benefit of "amplifying" available address space is not needed in IPv6. In addition to NAT's many serious disadvantages, there is a perception that other benefits exist, such as a variety of management and security attributes that could be useful for an Internet Protocol site. IPv6 does not support NAT by design and this document shows how Network Architecture Protection (NAP) using IPv6 can provide the same or more benefits without the need for NAT. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-v6ops-nap-00.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-v6ops-nap-00.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-v6ops-nap-00.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2005-3-29113048.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-v6ops-nap-00.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-v6ops-nap-00.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2005-3-29113048.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-v6ops@ops.ietf.org Wed Mar 30 15:45:19 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA09439 for ; Wed, 30 Mar 2005 15:45:19 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DGk0m-0005zw-5C for v6ops-data@psg.com; Wed, 30 Mar 2005 20:42:00 +0000 Received: from [132.151.1.176] (helo=ietf.org) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DGk0k-0005zV-Ta for v6ops@ops.ietf.org; Wed, 30 Mar 2005 20:41:59 +0000 Received: from CNRI.Reston.VA.US (localhost [127.0.0.1]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id PAA08428; Wed, 30 Mar 2005 15:41:56 -0500 (EST) Message-Id: <200503302041.PAA08428@ietf.org> Mime-Version: 1.0 Content-Type: Multipart/Mixed; Boundary="NextPart" To: i-d-announce@ietf.org Cc: v6ops@ops.ietf.org From: Internet-Drafts@ietf.org Subject: I-D ACTION:draft-ietf-v6ops-mech-v2-07.txt Date: Wed, 30 Mar 2005 15:41:56 -0500 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00, MIME_BOUND_NEXTPART,NO_REAL_NAME autolearn=no version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk --NextPart A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the IPv6 Operations Working Group of the IETF. Title : Basic Transition Mechanisms for IPv6 Hosts and Routers Author(s) : E. Nordmark, R. Gilligan Filename : draft-ietf-v6ops-mech-v2-07.txt Pages : 29 Date : 2005-3-30 This document specifies IPv4 compatibility mechanisms that can be implemented by IPv6 hosts and routers. Two mechanisms are specified, 'dual stack' and configured tunneling. Dual stack implies providing complete implementations of both versions of the Internet Protocol (IPv4 and IPv6) and configured tunneling provides a means to carry IPv6 packets over unmodified IPv4 routing infrastructures. This document obsoletes RFC 2893. A URL for this Internet-Draft is: http://www.ietf.org/internet-drafts/draft-ietf-v6ops-mech-v2-07.txt To remove yourself from the I-D Announcement list, send a message to i-d-announce-request@ietf.org with the word unsubscribe in the body of the message. You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce to change your subscription settings. Internet-Drafts are also available by anonymous FTP. Login with the username "anonymous" and a password of your e-mail address. After logging in, type "cd internet-drafts" and then "get draft-ietf-v6ops-mech-v2-07.txt". A list of Internet-Drafts directories can be found in http://www.ietf.org/shadow.html or ftp://ftp.ietf.org/ietf/1shadow-sites.txt Internet-Drafts can also be obtained by e-mail. Send a message to: mailserv@ietf.org. In the body type: "FILE /internet-drafts/draft-ietf-v6ops-mech-v2-07.txt". NOTE: The mail server at ietf.org can return the document in MIME-encoded form by using the "mpack" utility. To use this feature, insert the command "ENCODING mime" before the "FILE" command. To decode the response(s), you will need "munpack" or a MIME-compliant mail reader. Different MIME-compliant mail readers exhibit different behavior, especially when dealing with "multipart" MIME messages (i.e. documents which have been split up into multiple messages), so check your local documentation on how to manipulate these messages. Below is the data which will enable a MIME compliant mail reader implementation to automatically retrieve the ASCII version of the Internet-Draft. --NextPart Content-Type: Multipart/Alternative; Boundary="OtherAccess" --OtherAccess Content-Type: Message/External-body; access-type="mail-server"; server="mailserv@ietf.org" Content-Type: text/plain Content-ID: <2005-3-30151148.I-D@ietf.org> ENCODING mime FILE /internet-drafts/draft-ietf-v6ops-mech-v2-07.txt --OtherAccess Content-Type: Message/External-body; name="draft-ietf-v6ops-mech-v2-07.txt"; site="ftp.ietf.org"; access-type="anon-ftp"; directory="internet-drafts" Content-Type: text/plain Content-ID: <2005-3-30151148.I-D@ietf.org> --OtherAccess-- --NextPart-- From owner-v6ops@ops.ietf.org Thu Mar 31 05:16:03 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id FAA29817 for ; Thu, 31 Mar 2005 05:16:03 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DGwfv-000GEe-Sv for v6ops-data@psg.com; Thu, 31 Mar 2005 10:13:19 +0000 Received: from [66.54.152.27] (helo=jive.SoftHome.net) by psg.com with smtp (Exim 4.44 (FreeBSD)) id 1DGwfr-000GEF-KF for v6ops@ops.ietf.org; Thu, 31 Mar 2005 10:13:15 +0000 Received: (qmail 20633 invoked by uid 417); 31 Mar 2005 10:13:14 -0000 Received: from shunt-smtp-out-0 (HELO softhome.net) (172.16.3.12) by shunt-smtp-out-0 with SMTP; 31 Mar 2005 10:13:14 -0000 Received: from XPNERICK ([132.70.218.18]) (AUTH: LOGIN ericlklein@softhome.net) by softhome.net with esmtp; Thu, 31 Mar 2005 03:13:13 -0700 Message-ID: <002801c535da$0fcbe310$0201a8c0@ttitelecom.com> From: "EricLKlein" To: v6ops@ops.ietf.org References: <200503291601.LAA13050@ietf.org> Subject: Re:draft-ietf-v6ops-nap-00.txt Date: Thu, 31 Mar 2005 12:11:51 +0200 MIME-Version: 1.0 Content-Type: text/plain; format=flowed; charset="iso-8859-1"; reply-type=original Content-Transfer-Encoding: 7bit X-Priority: 3 X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook Express 6.00.2900.2180 X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: 7bit just prior to this being published as draft-ietf-v6ops-nap-00 there was some WG discussion about adding proxies to raft-vandevelde-v6ops-nap-01. Are there strong feelings about adding this section? If so I will start to draft some text based on the comments from the WG that will be aimed at inclusion in the -01 version and will submit them to the list. Eric ----- Original Message ----- From: To: Cc: Sent: Tuesday, March 29, 2005 6:01 PM Subject: I-D ACTION:draft-ietf-v6ops-nap-00.txt >A New Internet-Draft is available from the on-line Internet-Drafts >directories. > This draft is a work item of the IPv6 Operations Working Group of the > IETF. > > Title : IPv6 Network Architecture Protection > Author(s) : G. Van de Velde, et al. > Filename : draft-ietf-v6ops-nap-00.txt > Pages : 30 > Date : 2005-3-28 > > Although there are many perceived benefits to Network Address > Translation (NAT), its primary benefit of "amplifying" available > address space is not needed in IPv6. In addition to NAT's many > serious disadvantages, there is a perception that other benefits > exist, such as a variety of management and security attributes that > could be useful for an Internet Protocol site. IPv6 does not support > NAT by design and this document shows how Network Architecture > Protection (NAP) using IPv6 can provide the same or more benefits > without the need for NAT. > > A URL for this Internet-Draft is: > http://www.ietf.org/internet-drafts/draft-ietf-v6ops-nap-00.txt > > To remove yourself from the I-D Announcement list, send a message to > i-d-announce-request@ietf.org with the word unsubscribe in the body of the > message. > You can also visit https://www1.ietf.org/mailman/listinfo/I-D-announce > to change your subscription settings. > > > Internet-Drafts are also available by anonymous FTP. Login with the > username > "anonymous" and a password of your e-mail address. After logging in, > type "cd internet-drafts" and then > "get draft-ietf-v6ops-nap-00.txt". > > A list of Internet-Drafts directories can be found in > http://www.ietf.org/shadow.html > or ftp://ftp.ietf.org/ietf/1shadow-sites.txt > > > Internet-Drafts can also be obtained by e-mail. > > Send a message to: > mailserv@ietf.org. > In the body type: > "FILE /internet-drafts/draft-ietf-v6ops-nap-00.txt". > > NOTE: The mail server at ietf.org can return the document in > MIME-encoded form by using the "mpack" utility. To use this > feature, insert the command "ENCODING mime" before the "FILE" > command. To decode the response(s), you will need "munpack" or > a MIME-compliant mail reader. Different MIME-compliant mail readers > exhibit different behavior, especially when dealing with > "multipart" MIME messages (i.e. documents which have been split > up into multiple messages), so check your local documentation on > how to manipulate these messages. > > > Below is the data which will enable a MIME compliant mail reader > implementation to automatically retrieve the ASCII version of the > Internet-Draft. > From owner-v6ops@ops.ietf.org Thu Mar 31 10:34:24 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id KAA03937 for ; Thu, 31 Mar 2005 10:34:24 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DH1es-000Mt7-Sz for v6ops-data@psg.com; Thu, 31 Mar 2005 15:32:34 +0000 Received: from [132.151.6.50] (helo=newodin.ietf.org) by psg.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.44 (FreeBSD)) id 1DH1ZR-000KfB-8e for v6ops@ops.ietf.org; Thu, 31 Mar 2005 15:26:57 +0000 Received: from apache by newodin.ietf.org with local (Exim 4.43) id 1DH1ZQ-0005Vt-3W; Thu, 31 Mar 2005 10:26:56 -0500 X-test-idtracker: no From: The IESG To: IETF-Announce Cc: Internet Architecture Board , RFC Editor , v6ops mailing list , v6ops chair , v6ops chair Subject: Protocol Action: 'Basic Transition Mechanisms for IPv6 Hosts and Routers' to Proposed Standard Message-Id: Date: Thu, 31 Mar 2005 10:26:56 -0500 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk The IESG has approved the following document: - 'Basic Transition Mechanisms for IPv6 Hosts and Routers ' as a Proposed Standard This document is the product of the IPv6 Operations Working Group. The IESG contact persons are David Kessens and Bert Wijnen. Technical Summary This document specifies IPv4 compatibility mechanisms that can be implemented by IPv6 hosts and routers. Two mechanisms are specified, "dual stack" and configured tunneling. Dual stack implies providing complete implementations of both versions of the Internet Protocol (IPv4 and IPv6) and configured tunneling provides a means to carry IPv6 packets over unmodified IPv4 routing infrastructures. This document obsoletes RFC 2893. Working Group Summary This document is the product of the IPv6 Operations Working Group. Protocol Quality This document was reviewed by David Kessens. From owner-v6ops@ops.ietf.org Thu Mar 31 11:50:40 2005 Received: from psg.com (mailnull@psg.com [147.28.0.62]) by ietf.org (8.9.1a/8.9.1a) with ESMTP id LAA11125 for ; Thu, 31 Mar 2005 11:50:40 -0500 (EST) Received: from majordom by psg.com with local (Exim 4.44 (FreeBSD)) id 1DH2r6-000Dki-9b for v6ops-data@psg.com; Thu, 31 Mar 2005 16:49:16 +0000 Received: from [216.52.23.28] (helo=whisker.bluecoat.com) by psg.com with esmtp (Exim 4.44 (FreeBSD)) id 1DH2r4-000DjZ-Gu for v6ops@ops.ietf.org; Thu, 31 Mar 2005 16:49:14 +0000 Received: from bcs-mail.bluecoat.com (bcs-mail.bluecoat.com [216.52.23.69]) by whisker.bluecoat.com (8.13.0/8.13.0) with ESMTP id j2VGnDEA023274; Thu, 31 Mar 2005 08:49:13 -0800 (PST) Received: from bcs-mail3.bluecoat.com ([10.2.2.59]) by bcs-mail.bluecoat.com with Microsoft SMTPSVC(5.0.2195.5329); Thu, 31 Mar 2005 08:49:05 -0800 X-MimeOLE: Produced By Microsoft Exchange V6.0.6603.0 content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Subject: RE: draft-ietf-v6ops-nap-00.txt Date: Thu, 31 Mar 2005 08:49:05 -0800 Message-ID: <48D44BB27BDE3840BDF18E59CB169A5C5A8619@bcs-mail3.internal.cacheflow.com> Thread-Topic: draft-ietf-v6ops-nap-00.txt Thread-Index: AcU13SwY7mhMkP32QAae9wmZEwUENwAM0prg From: "Li, Qing" To: "EricLKlein" , X-OriginalArrivalTime: 31 Mar 2005 16:49:05.0619 (UTC) FILETIME=[8CE68A30:01C53611] X-Scanned-By: MIMEDefang 2.49 on 216.52.23.28 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on psg.com X-Spam-Status: No, score=-2.6 required=5.0 tests=AWL,BAYES_00 autolearn=ham version=3.0.1 Sender: owner-v6ops@ops.ietf.org Precedence: bulk Content-Transfer-Encoding: quoted-printable >=20 > just prior to this being published as draft-ietf-v6ops-nap-00=20 > there was some WG discussion about adding proxies to=20 > raft-vandevelde-v6ops-nap-01. >=20 > Are there strong feelings about adding this section? If so I=20 > will start to draft some text based on the comments from the=20 > WG that will be aimed at inclusion in the -01 version and=20 > will submit them to the list. >=20 I would prefer seeing a section on proxies. If you like, I could help you with this section and=20 contributing text and scenario in addition to those discussed on the mailing list. -- Qing