freeradius-server-3.2.3-150400.1.16<>,i{EBU=ue[B7!t$+h,mؙ7@5(10DIkīK.OT^.W;?'c[Tl&)oyu6T9ֿvJlMH22zuzՒ"ڼoJ#?Cbi9F(&-}F.886ߌ)Zt+@d}H6xAbBT-qkF]wۭ2JO̐ Z Nk@S >@܎؀u >Q ?d & 4HLX\z   66 6 !6 *\6 6 <66466<;(;q; (#8,191:1=j>r?z@BFG6H 6I\6XYZ[\6]!6^BF+bFcGdHeHfH lH uH 6vPGwt6x}6y:ztCfreeradius-server3.2.3150400.1.16RADIUS ServerRemote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. FreeRADIUS is a modular RADIUS implementation.i{i03-ch2d9home:pvarkoly:CRANIX:leap15.4obs://build.opensuse.org/home:pvarkolyGPL-2.0-only AND LGPL-2.1-onlyProductivity/Networking/Radius/Servershttp://www.freeradius.org/linuxx86_64getent group radiusd >/dev/null || /usr/sbin/groupadd -r radiusd getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd \ -s /bin/false -c "Radius daemon" -d /var/lib/radiusd \ radiusd # boo#912714: add radiusd to winbind group for ntlm_auth # add winbind group and fail silently if it already exists /usr/bin/getent group winbind >/dev/null \ || /usr/sbin/groupadd -r winbind # add radiusd to winbind group /usr/bin/gpasswd -a radiusd winbind if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : for service in radiusd.service ; do sysv_service=${service%.*} if [ ! -e /usr/lib/systemd/system/$service ] && [ ! -e /etc/init.d/$sysv_service ]; then mkdir -p /run/systemd/rpm/needs-preset touch /run/systemd/rpm/needs-preset/$service elif [ -e /etc/init.d/$sysv_service ] && [ ! -e /var/lib/systemd/migrated/$sysv_service ]; then /usr/sbin/systemd-sysv-convert --save $sysv_service || : mkdir -p /run/systemd/rpm/needs-sysv-convert touch /run/systemd/rpm/needs-sysv-convert/$service fi done fi if [ -x /usr/bin/systemctl ]; then test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" ]; then /usr/bin/systemctl daemon-reload || : fi for service in radiusd.service ; do sysv_service=${service%.*} if [ -e /run/systemd/rpm/needs-preset/$service ]; then /usr/bin/systemctl preset $service || : rm "/run/systemd/rpm/needs-preset/$service" || : elif [ -e /run/systemd/rpm/needs-sysv-convert/$service ]; then /usr/sbin/systemd-sysv-convert --apply $sysv_service || : rm "/run/systemd/rpm/needs-sysv-convert/$service" || : touch /var/lib/systemd/migrated/$sysv_service || : fi done fi systemd-tmpfiles --create /usr/lib/tmpfiles.d/radiusd.conf test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable radiusd.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop radiusd.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ $1 -eq 0 ]; then # Package removal for service in radiusd.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done fi if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart radiusd.service ) || : fi fiQA a O  e!%nR ` o<h6jd "(0L' 8 #_,P p!.M(1 YP8+ Di   Wb!4  E-T +JtSx2! &]6 F? WG  6n41O44VY m  !X&UY830EY]HF1i82ZEpC1@P@3`EVנED`E01EX(mEG82XV0FhUD`4(03H1`WE1FU`21@XFE8{`Y8*o@B&'7 *' ]) E8 p.&!]MZ}O .=O)Eu Q" #B:J+&<FF7x`;{2=%F BuQ DS+q?wXV# %[@VRxT krSL  k @RF "'YL61 emh/1kc_hn  aA5f /n AE)lva VmL?J#] d&!g9 U" ]jL1<Z [ 'F[5 xxawwG'8 } XY A聠A聠聠A聠A聠A聠A聠A聠A聠AAAAAAA聠A聠AAAAAA聠AA聠A聠AAȁAA큤A큤A큤AAAiuiuivisiuisisitisisisisisisisisisiviviuisisisisisisisisisisisisisisisisisisisisisisisisisisisisisisiriririririririririririririririririririririririririririririririririririririritititititititititiuiuiuiuiuitititititiriririuiuiuitititititiuiriuiuiuiuiuitiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuiuisiuiuiuiuiuiuiuiuiuiuiuiuiuisiuiuiririririririririririririririririririririririririririririririuiuiuisisiviuiuiuiuioioioioioioioioioioioioioinininininininininininininininininininininininimimimimimimimimimimimimimimimimimimimimimimioioioioioivivdpdpikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikikijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijijiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiivdpdpilililililililililililililililililililikikikikikikikikikikikinikihiuiuiuiue8b345d7f553e880ce863a3689dc11e248d332e8b0733d8a62d6e5ce166eef41537dc913ca617dd3b64e0a0d6726a8d60661b44afd2836ca2e3362f5232c1af7381f27467aad36c65f6f8e79d10d5f4c5eee0a30d1f25fca3682c0e42b7d09a384c9c4aea89bb55f4ef6032f707de48c428fcc519bd5227d95806d218ba9704d1aa60f6c31a6fed23af3fd986c098f39ab86efdd45aaac3ad7eba5b81e382b5c8ae096c15cc0e12c19fc104579a775b111be461dfc954d5067a0cc568f53f14612cab60855fcbae684e860277611de20ba736e8ade46571791d6def116d5ba4e9d4b49900dc46af19ace46878a20367408156166199dc83015c0c6c48c5323e1fc12f4ec8225dd5455801f1b198677231b64f6ade2c8f36ac90caa9a1a8d627e7bb0950fd01b446eebd65c3e7eac66ffdf8a7067c006a034460cb78f3d3ed36f9e5d5524e142a8d4af9b4802b8f47b46c58f12a65ea869151e7cd74343226f4ca02caeb6df36f4ef5fa8e34b8b3e860968b7704d208fa59a06daecaa83ad33713ec8438bc78c1e4ffd7c2c8e6c87c742f51b5843d9c15a10d7d0b9829e08917a627a8f2a063a2d53a5d4c1c050043ea12fe2ef996706dd08243ff4305ffe884edc2d3545e0192a82d1ec1ea7d7c2e2c3a534cff700e1f6d6c0878fec2e0a3e9c1f2b05ce22abe7428bbc6094677ac16b00c86dc4e249aef6203742b277a2cb78bb5c7433891120096e7465aa5aae8662ddb72a3dd56676d523243d38319613ae76e7b11e3fcc28444c0371c7eab110c845ffc542abfe479385d5ec3cafcc8d524e8eaf6089b86ad600167aa0268c002ca4a7f424440d17045843f25795850bbfbc51991fa33a5689dc96c9a75666e2b4414e6c2bafcb0087ba78ac6b6b36e330065ca53e68bce8e6bd43b3de93542e0ca218f3af07808e5670a38258ce9ecd62aaf7dc46c2291470b6648fc7313e849a7db0730b25064529d19fe3c4612f036737b6581b6a66f267fa38ab7fedbb2489bd74c8415df5f68b0f1d613bcad565d7ca598d0b56b147c7b6633627643041391eb33b57af2173f1278c47be5a8b35967464899f00893d018b608fa3e94c776065542b2230657e8dcb8afca113c4dacd2797aab1fcc7e66f306e48d3de55832d7886a071c5f9f941a1a871f2679b303100db82a312a978d656f38ae6808dcfd3b7e34356d58c8fcc94ec80194b49aff72fc4b9e7144988b03445c239d9d4b2e3c650048c0823dedc70d1378854eed596a0aa6e073400498c189d2b34f8ff4d1c3e0d05587256fadf737b53f780c8b4caca010f402df850d5c9190872d7df1dbbd2d57203bcf6ed127d0d012f1022221d68f5ee29d7510bc37c2bf3606e037488ab9a6c94e77266d5c9098b8df79a06cf85f6c11757a77837702062eb8d34ff862ee02691a173eac007da2330190835b14a85ca1b955b97bc048ac4a8dea70ff31a348b257031cdd57fefb41878d9a47ba4934e90a625ca2224d46c2c3d5d11584d61628d478575dd6099b7947c87fd2dded3bc6435fe032dbfbddd12b60507a9de63ca436350d21f77fa901c8d0230a775c48be55250620694124e9582b09268b01406a8b1794adf8648c4488bfd709e7ee4d8e6fd244040fe2120e88e3ccebc3ce407af9ea4abc76df67c26de768bc1852792cd6172b70305150d428e48b71de06bc0a2aeb212f735128735e0ba2e5b14865b8964d231b6f6542d5cefcd8b8d5515c54c834e54948860d9786c4e931a3acc0ab0e1aaa5e97f39ef896a9eba5273df312212ba68abddbf497ed5244e5f624311fb4e4427558c8ac2db869bec2ab1118a5affa190ad23ebc39834dd22277e62a19e4e57c2d0cc107a002042917b2789e4cc357efc30c36863ecef6eb2d9eb32e433ec3f9fe04530b8212d98ce0031a0c04c94e594941691d8c27f07c7d38cb1f1f46fe063a18d6acacde6eb155332e9004c935ac861b16b0c19b0f5fa237defcd03bf00824e13dbc54143ec4e2a6a9b1733a57f02b80f47967c47612f8eafcb5dec8a34f46c350b21224d0cd0d59d246e5f09fa120d74dd8af1c885af12c2b9c8223918d8d8fc036f72413c550a1c04eae31793c736ff7f7447348f15263f26476f6a5e61756a32a87f0fedaa71db87b9173e28ce05b687f4f4e7b97793f856c5927950b61b793ad9fff4dbbc23f85dd6d154f6e63ebd84f2f417a3a1d06b8837273ff2e4715ecd66ea703276208d9f35348541bc6c6a1f5a72b05542d6e5ca46374e11b94d501e1d803be1e311ecda722c5baeb89bbdf0e932ac460748c060b1ee65a84b81e75d13810894cddabaf7b3cd40ec218ad90d14b0edec0abd16ee8e72face9b296b4bfbdd89f62716387dcdfeef35d379406368944c7ac491a95d8b732d211159374dde21e8b0858dbc1acd6f4a1526cf880d69c1def15fd9307334ca6079afdc06b31b2337657270ea117f2d0408ea93f7e40607ff55b8817e3348dbe9cb662b83d8797b5658ad0b6f31cc4daba7f5b54f261de25be6958f9023aafcaa93905a86701ae696b4dfec480abc9e11042aab9aa7f2015b43b17b93bf4b9752e10d32ef5aef8192f95a52e736dcfe6914ae49e5e2b70b5ea578c9d0cef6642d68af6836c7cbc4e4f2c017969227754ebfd82e55ff169140b5553c2760436c3fe44d81376fc4729607735f711230e7b3584f2dc5bdba4a41240c12e2b4a702651f56a07b6dd3933100f7262a61506eb4e61534f755f7a02c572efc25a469797a11b727ade2666a29553b7e12ed204c88235ef4e36cf025b9830c9a3e521762c6e98c9d3b84abad6c72f823cf7b019c48a9c7c5e7e4dae7231a3cd8fdc082d0719875a82133ebe9001296d20f3304980c838313f41cbbdd4fe25e87d79a91c3a9d146fcdf77ffe6941ba3b6df9bcdad3dd7f4810ff382e3ad7309856c4512ecac7159f41243cb3fb12e6ba8821f691cffaec1630d70f9bdd3ff79bf203127879deab9ee4318d7282df4ae31b81e3d9273ea6be1e8338ec2cce02babc8d3fb50e37632e1a296ef791f94e6f78efd6221f8984d19dbb21a231e1b340f2bf2753d0dd98d1bb1c5a6720d922567c796ad0266ecf03cc2715fbe9471ddfcc391de752a6ab6500853e680e32789b8cce3b47bb057fe5a828ed3b1ef3c512d47ace6ef63feff73d84a1efe4f7cef0951ba73ccd175eca9193bd3449485450320366028f407ed34ca3d3491ecf72f7dcb0d17c6127145fa1a193382bad2009b15654962d2b1197037d4e3405bb8a99a26dbfd4e8dc1cce2c47a1c7d8d507f1fca92cb82956aa8f22b98ab424e2cb1cdaf6d4727bcbc5a16d04bd24dd7355dcf8e1904254568c91944da2e09e01462e94776bf14be53af88862bc14cceeb30ffa824dcfb1c532e6d2f0b142741544636f6ec2ad3a12b4257c9f88f2bfe5f1c8d474019b0ad4bd098fc20094e15c6cee98fd844d509d645e8b7fd570852e72d04c7342ce0800c4b3bb2315e0b9e7757c083ac05ac0dac0c90002bbdbc979b2b53e5bf8d3b6ba14995a46195739d5b9f213e2dd236b4e25c04d940fbda7bf6a2716d3efe314075f2ede43eb1e997568427bfd650162dec28d659599a57c0723ec0df57142e94726ff9d1be37236c8b100047c811864b0b55920c1ebac2222a26cad8890aa6b1affc58a1d6b331f471d9c791d07e96f89a8d6c77d3363b9b926730edae36fc78eb7f0d99f4052e8468a17766d7ea291d6bf5190b6d443e8316ef9b276f515bb218c810640770c3a00d6d8bf069e3a02145e4961db39e3c7a71be428d19246828d2427457805e758300ce6f0fb67136812b0c6f55a117bedabb6073df5f1adc98f67f9f67a965d3e4d85372a1a4904b87e5217c904770adbba65b3bf0207b821cfb5d139f857d846c6070fcff545ec965dc1198895e37601b9ab056d7bf00987faa6535240b0023ac01be5f7b9a9b7fb1797c6bff1a66791696bd3a077ab0e92a8558f7bfc633bb068898097c075d8ddb91bc179b4eded7e5b9084dde9a32c1fc85c789b9defc86cf6c071242428b7dfce876c22a63ef7021ca911aa14374f347b6b43b6f4a8800a12adfdb29a8fcc0f4484c4261fed88a6d5c377b1f2dd83f954dd9cea1345e05ce40438f5b045f4d92db6be31f22a160ed38126cafc54c4ab217a741c0273388dd56b888e4718ad4e26fe964ed316c79a4642101d736d360be66c53e14548722bb10cb002e2a0c9ecb3fdd1893b4e97952222040f5ae2a745e8e22f5653bbeca416506f850783083598e0758a5c0385c22b71a465eddab5ce281b400caefcb14c09a2e50e14b2d872bd168b846edc1d5250d1addff7f445e6f2483597681853ebc3635a9c89df5a5abd4d08be46286b17f304bdef9133b448f192d408754f89c0deb1f5459a265c5f8c16eae918dacdfbb793216edaaf62f2d0ba2309b72fdf1596c476312931820f16e85bd49479ba49e462570c99e68b752a6d41e960263a373ccb0e9349323527b861ba030703a02da680b764976c7e6090504cb23aad5a3defe69d8f23baa1dfc3a571ff3b6efe294d00440ae45769a537f47a00cde9a92d21f0d3c474dd65b69272046cdc4d4750bb0449c3b014abf7848b1fa3fdb21cafff9efadd1226e408ec45ced777523581ce2bd68e0c5fe7b61b745268821681001e6fea4dedacc29a103317afa86619b88b32c317955cfd9717864940adee017d5205ab68298c82d348e3ba017cc908430b5e0ca77257083eda9e428d66bf4f60c76e0ab118e567d30cbe0e65bcb869f1daf94fcbf00f18291304e553a9b3bf5e8ba73a031af3ed70cf495926c798c1998a429071c6a9a9c12d5301262f28efc78e9871bb29bf1cc19d82ef20dcef84b0c8f2ad854ddd6608005e806ca2703a776759f81dd64cbca323e5f3e1623cbfc279abcbafcdfc2bf8be06bd9a782c7d9ad5db7ddc094d2893cd2d2e156fe2abdf6d7e22799f8115154851851da96240ed8a57ed750b659b18794e90ef897602df3dd83a57df4ed17c8553a5377d39d17a8fabca93890e91b4a4c411098c685b41f89be0b307c11130506b594b822535e760c058d305a61c3aac7d758e0d7033c95945a892c5df13cc423e4febdd8050175d6afca21467af23c8b55c1f2008d4dc16bf81bfed77607097ef69d14f57f68276aeb40f8861c6a7fa199357008be5054f4959563c1b2a006e96b603b3ca1b2424ac242131da9e7852a7f9f83b0866501012ecd84e257250150e4d9bee89af3f9b7383c23010f8891dba566550df87e125b545e8de5dd79d2017d345d502346788a8da5225bc316be774c1971c97fd3d5f1f0f2ae4dcc1920bebeee6d15f99706a309ea843028bb7c2777179c8a7f4700b8587967def9561c0a8a86a416cfa8ea2061e699ef1a2fd9ac80c05cf6c71cf8e53f5769806c7477b68da015f05292d6dfb71cb0abadf844a7a13eb96cf140641e7ea1f9d7ac3de565405dc2e150e78f29e7f8a724ed4ca2db7fb0aba8fb50713219370b3b1ea43a6a973bcbf1a9b103c8dd5d8f8792b6ee3c8c2107d94ceb66a5cb3d8ab9da96b686cacf6f33f1f4beb009ab20f4fb568aae6ffba2c94ed1e2e50ae573d86f617df48b9ed955d669b216af18d3e770b6fd079dfb3760a1e1f8976dbf95c0ff0131d909a85d7fbe751009fa4385ffdeb3ec0a9d337e239e62671d9ab164dbcf3b80c295287e5ebe6a345120ac11f9752835f382fa6150ed4d3a5daa532cb92ac7db629b4fc7260f80af940cbea80cd2510a465a858455d70c034bcf14d09c24e0ed65eb73128f866312cec1941b0d5222d8fa9bd842a55e079efdd6e25a2b275588c1a2b63dbc66c72d08e58bb48fab86cb70b59f4ee2d32e125df2b2491663fa6c23eedc86f7e81068c4eba56cd09a9bab6398289a50750c75e17fce9fb803ed2faa99d7c9a8687e4bd76d90441fa77920a99fc72e92e42869a9919ebf9ab875de51857142d3b7c628bdb107bfca998cc860f7fe044d00e7ef4e8b5e2644ac4e9e1df9d3d710b074159041e472831f457865a4a5072966a2825a7819192c55a75e86b331a68bb43422b82f36ba30aab2b559694b76f572f7bf909af3830563de78b86e985dd1fdc544bb47e0c706279d389e9fd375eec4c7a0c00ed1890938fea9918fe2ee1d3814d28e2414cb2a6e81d74acd62d8f6efe54ec38ef622c8580c205f4fe64daf2a46ec96819cd6ca8c1de3ffbedab5042908b909f86681c242a5868135643bc4b18cbc36af83ba9cccbe321e6c522ae1ebc2609a5fb70dce4cde39a38372139e2e4b192898940ab5b454f4fc5cba2ed846a8306a0dbeec0cf05acf31d0506f051e2dd34eb8b4a00a9b1c36fb3a6f09a7bdafc58fd678519d4f288e9938aa8da1700341f33e93ac4af48a8e3837ac6d21ddec906bf99e84d99d6e63a5dea16812ff583cb38a4e6577a0b18a809f98c34c3f7ba2d05d19da101b0b5ae11685d2ed0a1bd666bb4444197eada43df3a3e7d13df56e326bcbd8fe71cccae11cea4de359e81c0df74ff13ac1dd3eca738f46ded036f2114d929240189ef8b716bce2fcc264fa228bd2b5d610f22adc261a9c37aca78ac3d23292c80f8014c53e10de98ebb40d6f302a316959c8301feb7cf29fd9ee9239afbef51801817bb9a0682bcbd6cb4ad47e988a97295b66795ed5288ffd3389d2007f401bf28f9790b293083f6ee0ed4dcc2ef94de86d9c510fd19da3c2a0a100ca7c99ab92a55c77d3face92e736bc31446c4a374a78f4c701c0000dfc152d2d56989e3415cdafa98c5d62d432eb59c04498f3e8a46e9a7aa2d151be36072df097e8b9d2d423e7a6baf10cb408106e0a26ca1f4427a061b57dd9a2199e15d5a63e8c33f281a49fa3adf09b0d66e0aeed09cde6bb7880c91fed6e20881bdada310b6171e1977ea3d5672bd3dbc2dfe64b91cfb53bd3c9f46dd7fbe3584b9fafe5d3232ecdba48209dff51d073fa14f921ff9138ed54d05c1c8e9d3d5321bd632a07ba125b30adfdee54a4ae3865e7a75ad71b91c1385190a2d3fb876cf20cfc923a080af5e250cc6619216ce09d025699f0ffaff8c452ac6f40f03c810360b39f4a066513afb3c127e31ccc9f9ea006ba219ff1d67d88da887f970f547867faca90022ae3c9b9e842d99532271c3ef0714ed70bbf3fb0e9307eef995e849e6e0a639ec93250a0ff8a1c47c3f695df09cc537aed21591a8ada770224309d32984b918715da0980da128b83a08e9cbdbab7f072654b8854d57471fe05b41be9b429061c583da688f0c94cbed5920c90b03e9b22fe7ad8f06f0de30cd67896f45c8d0b90d25b327b05d4645e1737fb8569f33a456775922164283a53dde30b4db1a689b6c39e63fed438069067655b2df6c635b6261c0d3c1698d31e28b80ad1ae12a6ee2ce446a78771cbd73fc0799a41b548bcc6190734d7f5387f9419496ae4e7bcbc82aa5b621bd9688dbfb6e9131f3a670a214ef5490d46b1a99bf32fa7778a3a8138339c45b8a495c0a96053f927a4a4ac114966a229e80756aedf1a8aa6fe2cd772ac74812885cfec9133b85099ca31f864a16ae6a9b0363f0490d5b4055f366f8cf1bb1be4786451caf9e9bcb99d8c6b05ae04723481f0164b81cb400e41e4ab117ef439614159ca8d2ca2645d9c01f66acfa44ec496d7119090b2f175d88c819da701b0a0329498dcd42c7e7cf5e3b139f2d853241e5316fca07d1d2c2b08a1d0bc2a9aa2fcc3970ca7d2776b28d18729331fe743e58f5b7f3f3759453bb8cfc4e2d110eaf418be63f0e83dc64e5e58c3c78ae98f6820f04ae72957fbe56d41c4e938dc9fefc8c5bd7b96fbe661aa7d809960f21ea354e69ebabd845436f5fffda5d072c6a8d54a18a25771475f1630de993b3db320596ef1cb421ff356230fd0848694afef258c42953316b69a6cb43064e77c4e64c47552e9b39debbeaab23d7e64ea206ddcb972a75752e0e2fcf6cb4a30ee8c63c9f02a37a074ecc56ce75fe6f98e3272e58c9384422fbe50534203bd1a7507ddd07906462c619923eb66948802b53cb67bbcc35538c4545a611ee4d2d05499219b173c9ea58bf4a270132af69b8c59138132a815671827bca83ac2dba88a4ec497b82ba96dea39c62a6d00816d7501138abc917e15e55b867da41bbfa2aeafd0c2474daa48960505ae99c2e3aa4def1b2dceea82571093c104d7d62490cba26ac4d3c4bb368cb3626866529f7024edd7ce67df714affc296398b78016cd58f0e75329d3cd349ef349452d42e20cbee9470e43ac067b8136b20686de0c059a80dbe20063433fc7b2bf1521bfb57693c6163b4079a039fb22becc1c4168e345c1f72b4a2f04fb9f98ff3659f43a77ccb2a665b217bfbf4f9118c2ce7d7a1f6dad2965e0cb315ec98df2e8ebb7646e264c00ce6b395779759ab28004ad41f745e96d4a218cdbeea05a289b716854630a9a8444fdccbd9006de4d2d0c55979c19d55478782836397473d98f9520d4cb4d92e808db1daa999e37c4059800004615d904d354248aa70e24c55c69aba4d65f3ab2af09b9177debbb467eb29b47570e1ac92a226e58165412ff314505d74ddc4cf334b5f174bff233b1808117eb1e386821b382437e1aa3f2b48122f7943daf69dc1dfa935e14d712dd8ca82be4ad65f5e76d015ed86f37f05daa49b2edb14a4a99d816e6afc6d56ddd7391387cc9ec10a1eca09d04551ddf03abfb5f0d116cbe641d28c8554f412822375088e99633636e32a2c0db83c13a57bfcac87d0b84ea2e88aea7e14bce299047bef1fd38f614da34b7c57c4c88a85d1c5fe4371bb9c225aebd41b82ebdb09ed5600a49d2c57210ce5bbf4adf48aeb3c2fb6bd67cbfde48e4f41650c8ed4a1e4a70ca7218f84c78c68ab862dc483f57d4f9210b14cc775188b13ce64e70354445cc14d323793fa20b8ff30f24c8532a1d7ea78c92fffc7f635343d4a269d30c1769482d54144f3285b964261c6b1bbf36b192e5df5c2a4cb6fa560068acc38b5f30751fcadb056e1bbbf7a02784ee93f40cd4761d5bebd206aa899b673be92aa962be2186461037477493528205c750c1139eb912c074cb244118869b1da3457b8f2575a352fcff2936968975876f17fbbccdf11cb1c13610cb47d156a16edc1a747d9af1b26ea34e96e29de4df7e78cabc92fe3e0d75acbc71bd6c82e1d0635ce215b8005a1776f4f0066fc3bd4877061dd1f1e8f81be9bcf8de1c208944eeeb2d28b574ea2b4717d4e9cac701f808daa6e49a8903db17e6451375e1392e5e8f618d7143c08a8035a444c217d342980c663a7d2fff4297d7f64887e23ca7ecca2d4d898830ba1a0bb6734e692ca142832c895f9ac65872b9486c8c531c5749a8009dd518153fc18b369896461815373cac1cbd10908d12d4b24ded806b3756398771ee29d414d093dfb0515f8aff896feb78d9212a80aa4f0220fdd9bb9436dbd52fd69bacc34585e9ae657acc9e4f3383fee8b962859333541330aa6302e260ccfbf628f19b6556b2ee81cd0ed4a7b04facc011cfef2a97ad5c7d8a2c567aed483d7a79e247a220e5a02ab046c954cfc9d1b4b6ead25c342838308973982a399e58ae5977945609646a9210cb7d3150b26f8184c36a8e6a07afcc7a978afe33bdd4ecca439d566e1eea526934ce2ce9e253a0c4fec6404ee299f04f97f2009998611b845a4ceebd62d954dd964fc70ce0bed6d9d976be005dd4bbcbd395535e9fab9176172cf6c90625060b4507e682b416c48f3389e2bd4cbd88ce8f54be7ea11a06a4d8a60cbc4bfdbb78534ed99bfc2bedc61c4ca5e141704b0d4e2240f94dec3846795d644463ecb0bc4b1c4911d416c48f3389e2bd4cbd88ce8f54be7ea11a06a4d8a60cbc4bfdbb78534ed99bfd1e3ae7c32562723ae3a56b9153f7a6dbf2518ee7844d513b5fd02043d61f4eb4f7ff355113a2f932578d600a4b92cdfabdd0ac032171b41b32d865c698936c4b76a5e341b40603a40a864a422408869c851ef75ac67845badefca74531ba00536529c207f3d537a22f865916c81b611e404a31bf7dc59de44f111fc09b1c2fa79659ba31d6e74751a223e7ff36a2d784cae1d91e965ce9af08513a80ededdd740809687105eb0164d0a52928630628505b0b1f5f75d27ebf11bf20f25dfcce04d8bbd652f45cd366b79e185fb9589bfb98b6793455893767759e68e231938f855b9cd33c20d7f953921174fc221b4d72eb8178282186728199d0d1bcc52313f4d01b99f4c42ce9148858d22db6fe001745019a74b9c42c65c533f6454f751f2b0628cac686194c463c75a008032456f96dece439e82a96bc3c3da57189828c0d1bb94ae45d22e168ace194115a7b1f70c93d02697fa2a9f916e60c984da7e38ca3cd7de911ea68dcb133214c9effbd87c7ee730803ef5d28ac645ecd87533bf42f084c9d385869142e0d4cb034eda19eec8ff0b1ed1a8082848d253c05a4f28c5cbdf119e0c504a7ea2e70fc954bb50513f2d2973f8711e239ac63be25b39ccb30fcf48340a899b72da408c56b01f8c8889ea8d70032bd8333ddd8431f58166dd6dc3c0b0ac79139f42b5bc5e2b5bd9028b65fc5b82083b61e8a4d28c8522b56fb563ef703f37ac260764812f5e0759a93e608aff71c7b2cfd19312872877a63161b357940f91ce8e38b7861e18b06bc5e628078381a2914221b1986222ec9e8fd32ca89e0068dfb7127550fcf123183cc3ae270a926105d7acfb2d3d0e890324ecab633e2021387dc97dca3cfad1c5b8887dc7dcd5a558b39e48099d860b05f15f493c5a6ab75614ad25c3573bdac3be378b21108c185a64b803b16f2a93edd72956653fae3429b7c51d279bcc431bf57eb7607c799c3f4961c3ea24d6a27068b368d67808bb073da54ebe4d41da5dea5503236c671899d28f9ea98d13079c42f07c0f1fd67abf34b7ea6ac58c950e9f4eeaf5fcda2078bd318d6598b5e9cfa4480610a941518388343cced47c80ca9348297e4a3e1d61f9a964e480d0dc7f97bbb1507f81d4cdd85130de134f9d0d311207d37954277275c54296da280ede3783bb5056a3c0f72496b6cb93a328a0ca2199607f2017e92f3c281f4600662f9506b441b95d327dd5e268b9df1b2a8958395a3f8fd70472824a1a4572540dca3a9982bba40164dbde4085753eb058587c8f01f123324b621612a2193e9d518d9c9c5a529efca8369a5935bd95f5b2334a5ec8da7dce0f62fcd0f318bd3421f45889aac6b21f7bddf11add045a69dfbfa9f3e5e83c56fca3c659b72bc835697d2c194a7882904e6be48d1122c737d73b99ebcf30aa657c3287ae0c5000cdf0a049af584d275a6e5081841a9b7db2c4d2d7c2ddda1d9c05808382a7d50bb0b9f69244697a934dd9f7418787a18faa4ec90ebe6b83d50587f2cd99899cea23300ab2a53ac4995bc2b9450f2cbf9f835e1092678d5ceae054fc600cf647a2a793d9b6aaad7b3e770b7f840ced8f169e094246663adccdd98870bee4494ccd5f6538ce2dc320d338da3259a7f0276b0daf3358d3448579a8efa1365d6319989b303e5e463c7ff4d2024f2694b5f302ca301dbefdb9efc1eae6247df9a00028f7fe3acba40290743cc857ee6e0ee36289a7ec69292c0fa22ef4c16cb324d34f16fca9ae7a0a1415667033a29a41d2d3e47a71ef126690cec11bc3909eebc068f35a0e2dc1e8203bf0dad4a4dfa49490916fff4dc9fef87bf8d3b74c2d8cac018298e764c70bc468d78beb2d702f991af2ba4b923b12a679f9efa51cbd9a2c13f83b33821a5e9f306c31556f8b9d1997d8135080beb2a518e8944f547d6b89ca5a66508c9f1d4609ceaee0f4f2df85cac13f8bcbae5b1b28b1bb9beb2dadcf9b1900239670bb360d1f7ff155c27beb48162bd407c148f5bcecbda471160ad0c206e1ab8dafd8553edd097559ec53df4dc695deec6d4ac611e352c9361d66b13b0943d4496f05d5ee6b256f67f44c863b7bf3d1658978811521073dd8f2764d234496634c74ce545e69eab1bd8f39f6fd138d5d3d75e1ac0cc6ff9da4601cee0b43cb5185d5f3273a1b39606ced1c92c9bad331e4029e266826b3fbe1dff5c18bc628826ba9b5468d392811851dceb8b538a532a595fb4c668ef39f8e9a6ea27420b2b4dc412afd1e91d149fe4b1c8224b4e148d990b9e5a70202aed37beb6fff679928d8df218da66ace64407d3ecc48a6ba49d26f19c3111813c19d22cf68426e15d8eb5e4a9c7dab3a43ed30efbeb42b6014f3ff7d2832f5c4c5408701d6dff6c7114417fe3e4da7fe146a14dba2aceb1677a110ef1196122df112453a1c1cdbc2dfa293ba65126e25891f5a1e8de5cfb8c18dc2f75837ff39ec5ace9021667fde13f9d543199b01338eddc82d5ee57d480376fc548ef8ed0845a66396d60f42a822d5e43be41e47c8c5961fc2dd33678d3f15e805f97f9f7e1a67b8a2fe70f418ded8078dd9c1368475fce3d81e336031d7a3e74931bba8b8b80abf1f623f4719ec41ce860c42f28aa44029cbb1b69bc7ce335777b4cdc7814f3480fd4281c57a72e663c2e34bfd9ae2a12c8e9ed9cabcc081d650ffc52aefbb10620bf8408fbf648840019a1a6b7656fe30253cd05a5b934de6037130161a2a045296e9336c7f12b7bf2e7b3ebfc0f476a1e1e4b2111afeaa05a460a9d84f6b79033c1fae23b654abe958e759e23def9bdb3ae2119937e1cfc1a1298e9cde1d6db280297c729d18e7c58ab264d5225cafebd632cc5a41afc086c618fa08461a054b1e50d2d40554f6bbe38d099f899171969e8974ef6d217e90d063f5854cf4d14a1518010f323f3724b8e1789a45b0ea770cd1a61bf19dbda5093236b8da2869bee1df198ab6ed0596daf60225db8dce8de83b7b9fc889cf301b494865e500cb5fab0febbce9fffc073a1bf235c34e44c71d1c7375c4e4a6efb3b6789523143110c313ca11e1506f0ff1bd1a2442c9bb308c294c7cd6a409e476584f0c9f1f475f25eaf4b89aa4c946d134b81410f9ca6b4a4d1a03659ef693ae91af5f40b922aad5bcf238337a3186c72ec7d7e9f49bf7595ce351c374303ba82f6140066dbdb713032ee64925af1a1ba36ce97e55121e84abd525e300ac7bb3ec031b42e7aa289e8d18f2c7d74b23393ea0abc3c5d1e2d66446ed84c8b5c7dbb1863e42f6626b708e91e8f4bbb9ffcb4118a33d2ded2ee42fa76279f81fabb95b6015f9b22dae53cbe10ef7d37454bdd7de70107b720ea2fd6585475cdb33350d9178463437e48e4f9b353057beb000a2557458f63d4179238bf28f2e0ef2545612b0e7e895eefb0715fe5dca032e9f0c69d235f5bfc86bfbde1a2fb5e896117b6412511375620bc0d9a5a52d28d6bf054079093672d136a4a4e24ac4930bc80be39f07b700ed47600e5e258558bcf04476b59da329892db70fa8d46f9a5fdbf0e7d3a32b2f7819427486b6aa77741f1b08331661e3d78c9294360b4df4013aa64bade84d8526941435842381d0c7fe34dd7e5620c2926b48f16573751a263f32368a2f8aa9325dd47f30e81fc57818f37c94978fb1a51cff91731273347681a489f424ebb0dee0ec83765a0ccec9a8258a5bd89a32b47b4576e29f716e9bee1a7ecdc6771a28673afe4ceca4d354119c913bd8ac4a97ac43a666acecfdd41a615af9fc2abcd8f47ff35c337317610efc619eb3a391e87bfe18a721cf39e7c57e78467237d7c1cf4316221cba850195b97d7c2eeafd66e2541b7273fc977cce84aef9fbf27ae009cdd3f8a57e8695ed5206b3b2b1f57339e40010f3ee5fc3bc7b166b5fc4f70caf551fe42ea5129091a82db0436c025cbfcd74fb839ac7eb538b709a64bd1468c9cd79b8b433b835bbf83a2d2b2a8604c3fe5cd6253db9aa6042ca7c6f3c6815f12d1f11c41145cfb8568563c8572c3c21691a717d282ed0011a7b5f1a60f5159fe0c7b33ad7ff5e2c7d126888c373efaf7f404590f07968140de08c5c80aebea43c85695375812272a35decc7ec6b807ca3126521f0fc11fa2df6dde6dbb4ae6962a01a4d08fe78f1d243e73d5b272c863681b8d9b727cead04cfb6652b74166429147837d9d38ebc51f2f83c339793c1b9f3567df34683290de24fbf7b357b5cfb8db15f05ed1acb10820b9d9b24e36330c0337c394a8491494c4ab9cd877af60ff24c1f1061c453b253316833e50abf9434471fb3ab1aac33b9ad0e90ab703dcd907bc1ed4df641d15a24ac9a8cd987a2ad9a8df1fa333caf87f9c8b402f9a4a474a079cb2d78ef89c22e497a5a7dabf539bc17af6f516fb3c3302cf8cc5776318b31cb85fc9e3d1b12224792700f00eac32caa4ed8a0260608b7c0c5d53e68f7606b94b9755b4d0d0ec5a20e2d7e55dd8da0eb6ee4fc1f8c84133f3daed5f1b21a4dca8dd54db5c968b71c6ee9e7aeca25047ac769cc072b5dfc65fcee22378553e98c9f2282d8fc8bec44ad5d85f636021d98dc9709d8d384a0621a65cb20eb7a09175325d641c15b3234c758120063a46e065fc96f4100e8f9543583a58784c69f6424ff4bed69d893c08b1e19121691932d09f6ed15e9bd277e13ed2a14ba99d82b2cfcb3568de59e9fbe932ab7ef6446f804ce42b693c36aa04e85749eef29761e5f4562cdf284555844409bb277e39eb0ac7ae9892f0cb8eb94abf7f296bcc6a4ee5fee74eda72b26c8040bf7277289c1887e19b37611eb8e62727949012d132d95084f8fb9ec00a971159c0fec42ae49df6396332d86fa91dbbc88c4e43a50884b397cbe376d218c8620ae1ceaa0b74f7a2cfc184ac660ae15aa11a4b2659662152fac731f47deaa8f93def96477ea22326667d165c4e6015b630c19c46e83e70b7782cc93f47a380a3aa412915314db98ff3a9135bf646c8dceb9b77e74415e86f57704a66005bd4c0d93e2e9514244bf5e7767f0d68ee2b112148ca1b1d4c6357391d79046bb3f576838dd6c5667bd69ef2e05ab580d2b5867d6df09062b1623fc0f41cf482353f7c6922debd93be9b9dcdc8cf9434d1882346e570f7dba5a45fbeef5a8d4927fe4d7532bff7f2360789f1290b4a3e6e9907d091b4061c9c87a1c46d4bb13d60519b0a70211acfb84fa3fd31ebdbed10779844440f86cff0c1cb8188c7e549d44a175c2805e5474a624301405ca8b5969963f6ef956da0f0c4b4515018c3c53e4eb5fe05539161320935d3fc5ad11d35a8b8e20d5212e4013458eefd2a9cd9eaf1825540eea76eae03337701581d0ca366b2a4a8fb6b8c3f52f5858a2ca6d3bcfec005c3183b634810735a0f6e470dce8d9da8b96ddb8f86a67a39a70d955a37918f81499016af8f44b73a26683674457d206905df84cde6f859aa24ff1c95a23047c79da4eda1e52951c90059c80896b0885e79ae7bf7e0351b707f62d4c7b40b5ea9038563242ead18b7cbe64ccb07984c9e9fd8e822c5bea1a6f1994954388b427ffb209a0f3335919ec8739a47ac873099995272552ea26cd5a67f69be99c7e16af06065dc6876167833c9ede293b7d9582266b12f360dbc3a8686a6b47989c717c8d8589ff99195e7f186aafab1327c4c0424d0a8fc73aaee79a97a7cc9df952b1d5c06ea145d113ebf98bc9619411f56fae726e785e346e27d1ae96e58b102470a42000ea9222d58a03d014c5431701a918216e87c433a929ed7f5d37097dfa721da22466689dc5fcd6572f2e1c14421a3b9865233375622ecacda1badc94b913172289f03a895a12df94ab3608e13c2d60a702706de66831866eff49347cf03ffa6811d4f27f7526712c8548f0e9ef1549f34f2ddc1cc341227e5e1288e5759dce4bf687e96be18953722fe8c80902be281129de0cdf44ff1893654c367541192eddbafc71f12a1c60461c87a085ea00f64a35f84cef22126bbf1905c81d5e32dc47df07094c3a4340b9b10874a0a1872b61a600b26d4d68d6339c671002433dfc1fd891539ff1580769ffd3bc739356104b74a6bb4f516a7af040451e3027b0592b7299538362366bf0a064c2c4ec067bb4d2e0dc46314e8e13cf78460e84b2ab294ab0b5db4a0186f9423ce6d8a70e22493d4538fd68b48b1ffe29f07d5e34a597830827d4c3d63bb6ee0b9e554d898624ebd8126600da79aed6b9acefd6d9353ba75a010133958c16f58e928eb1821e6911ca1ebeed7a650907e0ef50ce646c11819a90cbf32c1d6abe1591d26dbd93773ea20ac7f037a6cd62c87cd0bee1d15fbe7f18f8a829ee91267b432b09b40bd7b93a2aed3f8e59d9c1ebc92e6ba99da540d0f87bfa088c976df1dafdcaaf2ccc747f2c8f453257535e6a3a0e313d6b78feddba0bedc28c669ca0be0c2d489ca9fe638e6aac76c95cba97f29a890becd784b9f1c97f368e71d3ae696fcf5ca48f3ffa6f6297caea69bbc158e67debd10315d960ad09f3c9df7d367efd0c3e086a33883abddbda1636add0b8d16328f22595f915f1c05d766b68cd5017763afe39836623bb42618ffbcacda10fca203ce60fecb779a282cc3e35f5cea39092acc5f58300c20d13aebe76f9d47d29d4ce2081a9f2d93d4d749f051d206e5d44833515f014798a4d41e00f053f22e435148e91abe57d39619b61c3bfd2730650e5c9139eccfba965f36704a4f24bda33d2f4ff034434eec035e74e99e3aa117c3359b217261a254c50f544209076643c740e44284598809cd52554617db667b3339c8424dafcaf6b10269f8c9548a9ec05e9f6fbca2f59c2ddb8f6cca9a2820872a9ef0f122d8af0381919e4bfd290795d0dd5c9ba9c9cb582c22b007f088ce8522f5db7ecfa6e2237a307b14c10bd074ae9a7377c03672ccc5cf1d9c5baa9e4b39fba6ecba8c1b51b3d2e24f277c4d3cde2b5651ffa524c562e4e0b0607768f46c2505a0f5d6c6bf92b94cdc5864bd4d11a4f274001bbc7c7793bafcadd81f9422dc7123aa683402c8598f1dadc571b8f4ae971caf143f2418f2e07df0beebe2f40a7379dd9f0b0ca21b0c814669db768174f402824bc02d6206629abf2728bdae843bb26588ba4f42c5c6fe479084b28e220cd99ee0552b59ac168eeb1948776d31e48a0eeb07cd08f629c1492af6e304346369d5a140f13696bdf242cc57ea9c66f6ddf3f926398c89b782f3ab9c8fc0a21a9026ec029482d2892562e6728f4dc272b8d3d5a7483dead57f34c1927635398a84eec66faf227785d31d72127ca81713e2b6bd5752edf23dcd2f6be74884441f4d9dc464e03919adcc201e8316efaf2e488e82900a80b71ca1fc19a8dab4d95667e4f2d3ca8da770cc445ac2b8cb05efe24060f7fe5084e1bbe2a563042ef4b6edcdc462035ba31e84cbc0f3021dfee90ca78c4acbf46a3ec15312171494e558c51d56b8976c26a668d1d488bbe1280283f12c63ef3be148c38c204ff8aed77aead4d5cac3077d2ed454cbf03ccd675fd5006d9593edd68ff013c674e4169fdad21b938bd952efb4f13c2d1ab30db54ad55ce92743ea57dd8202dc3c1e2647832c5578c3ad4358cf37dd01522e3de358a16268ccf19eea0f55378b2596a9012496fce0475b962ac92d79e684c4fbc3887f23693781a9b31c65e3a2790d09fba56de41ea7a7bdf7dcc879e716e5eb61f15a1332ed64bc104516dcff6afb7679676fd329d77ef24eb1c91628025bc24001f7ea543a706418bf9a9c40c9df6c8b8632289efd17b70846e0acd5957531e01d43b0338df9d9414042bb4700abf1efef4e8b699e254b80e580009ae9247a2230a2ad5aecd5989c4014a4e45eb7c1c7090872674ef7edaf5a38eebf41e0bc917c5b3d215266a8ea8449d2a0dc840e83b7e1d28475e165bda6dece67683d363255447c4a443a0f25b0b74a5e547ad4cb74ad885c9d9a677d0c254b7a95a8f4ac5336db3695f6462c05a9090eede29499e915625ed99154da68806b963b3dcf6834b114925691fa293f5674a0498684045dd0cb071cb0daf49e557fcb2bb268a4da75d99d0f86f38cce76c2204cc961514f13af0a42e253f3cf1f04320316b59e1b11b16f0d930041cb9202e21a50f4fab2cb3bf35d682675dbf21c508b378748cbc422bca98cc777eb617ab0306af768ccd551d49807ac6937cfa740141fcadd448a2e3c71a9ba7c50d49d5d31281f8881c97e06a3e572ad4a1389bb21731230ed55e225fc4d84ce1cf61d357708ebddb518def97ed92db88a57fb4cdcc2698626703f1807bb5c019f713cd56247cd9de2a90ca80f802d9b73e3fdf55ede5dbc072953af560bcc542580ed663e3f10970fbe8d3dcaba0650c72da430faac7afd05964185d1a319ab86dfccb7507bf534c047b1059f6aa3db50328b69fefbd58b8d3d19db009b60d803204117e112660da79983b46f26f2726ed0c44d1e584d0bde2c586f9c5a8213ef8b6a9b139ba23cbd39da287be88c98386e030f293343d94ebfb2c0587d2615d8088ab1193fcf0b15f7c313d10a7f73c04e82ca8c28888fda26b3d3a80145db0db4fefab54cf4d5b52050c5fc2a2d212c52634c1760bbb31b203678a0dcefc0c7f54db6439704a14143993d45b7b0439ba929f9b74353ac0ef84e5edb55cc6ef45cd45a16f44ed1d29abcbafa0fcfb1f7c2d93452fccff1c007391c7bafaac12bf430741c36596d7b64eef081c4421d6d54128e1be0638bd85a6349f000ad4e83ecd61eb57cda7c391fa54a265739ab927356e1a2135bf25f304b914c83e87a1fee3884d2cd374f12b5ed1ca5790857cc4bbcc8f1087f4517fb605403ac7de1d6830b4b49271668dca9cfc9169959a6b2c782c1f5db080ca19e013ac99592d690d90c5be986072b705dcb583e1ea8300f1fa67c2cc5fcc3857b5bd856499279357b340def18a8c6d05a52d546d8f3b6727634998e610e08f695a6e20bb756d636db2a2e719ff80ea03e88aee9208741d0e242b2096fc417a9b2beab03d93f30717458b034d2bd2eaed668754bf959e0ecfe98e17ec88de7eb2ad3ddd37845f736183b7d3b5bee00a0f784f0864dae6d092e1fe8af993c108928fd679b27a5f3b043e84a1fb5dd23f14b47b5d65ae7e127eed1763b39cf7127c4edfa9161810c013c999bb8a3a49ffc34e2f3cad2c9989f660c5846180443560de3181a5bd2679477edfb92da913cc67c845ea42b87a117243479add7b27dc743172481072fc0847829075a4ffa8e1779c016519afd7591030d85f9b9605f481895fa43b1a8ff73bdbbdb8862b178ddf8969a70d14419af5b6fa871feab87c4f808b68f13ce1ad05444137266619827ca199b37ba4c7a8c80ec46b7d2a4d9b390a94967abeaaba0608a5edad8c419e17977dd96625adcb7bc9cb92ad2e6fcddb1334cec48960a185682f133fec1040f3f1b0e93180da657792b1134e038658710c249a3981a4c781cbeb6ca000585fb242836a099fec8707d836678e8f7495ebbc29add32ff5f7cfb235b3e8d4439c59199830f729bb83cabf82bd0fa971ea7c66906874c0a9409b00776303228ad61bd5b997d7229cf4780e528d5ac69401316c9638f163a15bdad8694e628406112d4a9e5f277ab88b23cb7c68bcc688381d1b659953534f26a589244b3872459577a6522364d86e864a32d85fa99a44ec146d1a21504182a4a43fee3a5ff26cd0c29ca28863c729493557b45b2b77193e444fe20ef4467190b68ac7f0c8cd986962efdd0808a7390469b6276b7258d16d883879240f8e598fd8ff5f0badea9775fb31a932e232dfb212c223a27322758c1908703881b384576158e28bf2e0afdc7a59504b146f31936e4633555bb63c7033746d602f3b87f201aa5d064848777271d8035b2dd1523f41ce7f219aab232bb5fb5e1632f47c3221360cd090d35b0c7bb84a069439d0f27727117e8a59d06d348051a746f2432e129f60b66dbc82089d54e5bc064a7629d666303afb1f732689f7e74a7457a01655a50c18a2bd32d9573f861343be4693d7a3bb1f4001ef0713e8dfee0f45f254e10349c416207199bd38f9fb8763fc39f323cc0a4c45fa1046da746f0ccab220f5dd456220cf4698f3c38d701b1eb2ccc6f8b394c29df366f6050f3bee46b9a4bc5a2a8ee50fa860fe5a9b947bde6b1ae6a1bc94be707d72866e9da7f9c84e42348fd8919b75f70a43e1e9810f5b5c93f9b7c2ac661d8b6bd97976a71cbf00c7ee2b36b5385a270d268e3a168343b852345eab5fde4fcb902f47b87f3b1f840d57a5afbc92fbb737e6201ff5102f8ad71fa86b92798adb25daf49733ddf5da69c940d962bb9f714868a40ed2318c7b3dcf918f9c008144e521a1b95e6d7cec45456bd8b72fca2d0b7505f48362058fa16879212b11d0177729477e4b0e7ac7979aaafe0b94206f06a608cceb5d973be7629ee25d252728c1620a6ebacee58ce335f7f368cc1342b70a933c2871fc71a07a6bd181e132a674d31736d6bb2cba7c35f491001b32bb4ce9a157f40f696cbcca1bf5de9ce95042f7088a0d98b59acf402d49214ef2b0939f81b04c1a4af7524f08466e24891366dd40743c64abe619db490d19230a1fea6b851fc079265eccce108402512a0ba02cf0fc0f3e64d0aae5bee23aaa53dae89ca0d86c930520bfbfd20873b0b79e08e0e405a5592947cbb7808b340b7889530a3819c21071d8ccbe1a60c8ec30049a4552ca4b0e790edb73337ae152883141cf198660d45e69cd12ed571753ba639c1e8c3889c41eac7179c5e574d9d95e78a2923fb576b0635b47f5b615a0e492c806d42884c2fdf477f2ee6b2b2a9d281dc3ff11563b6f86b697a8494f9ac3ba90e8ac4f0a0e46014fc2efd5144a30359c0e6e1ea9fa3dd407d3318204150efd7b4caf6ae6d6a009505e345fe949e1310334fcb0747f28dae2856759de102ab66b722cb490c3b6a0d586bb9dfc845b236cd88877065f84483e3bea2153b4b831c34c3055a449d1cc40adc7e874d81fae1ab82c35ce2a0a84cae7141a582eca2b26e94fce81b0f8d115921fdaeee8ed6c5f2f8ba09da74658bc3f1cabeccfc908a891b04354b2d9bafdf8fea757bab853b1cac4c7df00b2256460e95c7193a028e1917dce5a517d0766fad40dd7abb8dfc75b687bf505cea3bf4a099a14f67ed23b18b15d94ab6def9ab2eafab299f858750ada144f1ad8aa9e42828bbe7dd063003eee8189bda802c3e35623236807dc79ef77f294376add03f2970d4fa96ea0fdd4fa12ed39e2d25679f6645a7052f2701548c529785eacd99df8ea6ca27c3f016e7c5c94cb58892c0b0361499056ffefb9a7a4a3de3b3044d3618f9c277719126154309e80944c93f907bff96183db70e139d0887c167d4ed6047f8c24a4e703ec34feb912fcc11dd1f8b605914b19fd67e4bf66a19b57b1785b1b0664b81a6cd2946d802cb127acf803dcdf2e6b06c6db39d416371ea2fb8694f1f94719ec702c22db0cb8b225676c8487997f15132b44256786f2b0cb73950832080a884d31c1a66b6afa1792e427bac44a074273293fb9a1c9f7eafb75ceec91121930cf0e5e58ee17eb0afb848744651f08d895e5ea0eea2ec6e692cd11e988fd8ceb24c996fc3fe2244f9a8c0a9e09b39ea53083ba528ddb4c7d4366aead52621621b03d9c037bb0e302a80bc4bd241b4c28ed1fe72a0e4738e9c2da636b9bda1be63f446cea1e3b565a59d9783dee9a4e7e1306d547d9cecfaa7d3b5b53749ddba7e5a7629b7825269091b829ae657b72c293188c78d0056b46a2db685e0e028f6c0b483779f8434370cbd280649ccf7443a0fdabdc65e6624298b8bb29fd7228075f9166c461f9e8914d01ed80e90541a91004b6b5cb86dc9855fc5930f1580a7878088be0941fdffa1236a0dffb4cd31696eaaf1982178afbb6784674fc27f6555ca8588f9ea9526620814cbd12823b7e45c9f7322c84a1924d1d8fa3c3ae32991f8f5bd54b21a8f2c8863fdc7c7efb652cd25eb62a3120ebe02c0450c30735b839c813427a20da414c79a46a3304f60b896a6b3da0bb0b63c590d16593e70f0e13cc70b7bbaa3383b27ec15fd446c35e834215e2073c44cdbcb0c6cb06a3b2bfc4bb4906daf32af74f6596f6f832397eab7f15c793af1a06a2dfed2910533b65a78a78a422cee268c7c30e91e3b88333dc55b86c9c472d007f86d5762f6f461117dca84de98d76fbf811c4179dfd9775d3aa635e005f4d8fa251cdd4c8b50987f5eb15bf1653b6cb7dab9742ddf9b1faaebf1ceadf760731dcb3e3028f9e89c156fad6cdc22f91501b7eb343884cd47243de731000d4628ec0620458e4bd2226e25fc922e8a81669f24b9e3a90faa923d5229496bfb1d292508521ff50d7dac2f7baba932ae3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855mods-config/preprocess/hintsmods-config/preprocess/huntgroups../mods-available/always../mods-available/attr_filter../mods-available/chap../mods-available/date../mods-available/detail../mods-available/detail.log../mods-available/digest../mods-available/dynamic_clients../mods-available/eap../mods-available/echo../mods-available/exec../mods-available/expiration../mods-available/expr../mods-available/files../mods-available/linelog../mods-available/logintime../mods-available/mschap../mods-available/ntlm_auth../mods-available/pap../mods-available/passwd../mods-available/preprocess../mods-available/radutmp../mods-available/realm../mods-available/replicate../mods-available/soh../mods-available/sradutmp../mods-available/totp../mods-available/unix../mods-available/unpack../mods-available/utf8../sites-available/default../sites-available/inner-tunnelmods-config/files/authorizeservice  @rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdradiusdradiusdradiusdradiusdrootrootradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdradiusdrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootradiusdradiusdradiusdradiusdradiusdfreeradius-server-3.2.3-150400.1.16.src.rpmconfig(freeradius-server)freeradiusfreeradius-serverfreeradius-server(x86-64)radiusd @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@     /bin/sh/bin/sh/bin/sh/bin/sh/bin/sh/usr/bin/perlconfig(freeradius-server)coreutilsfreeradius-server-libslibc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.27)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.7)(64bit)libcrypt.so.1()(64bit)libcrypt.so.1(XCRYPT_2.0)(64bit)libcrypto.so.1.1()(64bit)libcrypto.so.1.1(OPENSSL_1_1_0)(64bit)libct.so.4()(64bit)libcurl.so.4()(64bit)libdl.so.2()(64bit)libdl.so.2(GLIBC_2.2.5)(64bit)libfreeradius-dhcp.so()(64bit)libfreeradius-eap.so()(64bit)libfreeradius-radius.so()(64bit)libfreeradius-server.so()(64bit)libgdbm.so.4()(64bit)libjson-c.so.3()(64bit)libmemcached.so.11()(64bit)libodbc.so.2()(64bit)libpam.so.0()(64bit)libpam.so.0(LIBPAM_1.0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2.5)(64bit)libssl.so.1.1()(64bit)libssl.so.1.1(OPENSSL_1_1_0)(64bit)libssl.so.1.1(OPENSSL_1_1_1)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libunbound.so.8()(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.12)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)opensslperlperlpwdutilsrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PartialHardlinkSets)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)systemdsystemdsystemdsystemd3.2.3-150400.1.163.2.35.26.13.0.4-14.6.0-14.0.4-14.0-15.2-1icradiusradiusd-cistronradiusd-livingston4.14.3dccGc5b?ar@a^@a^@`h@`_@_0@_FN^y@^p^h^@\\v{\u*@[<[2*ZZWQYY@YlY, @XO@X@X*Xh@X.@W@WiV@V.Vf@UĝU@U@UU8U7@TZ@TTT~@T|X@Adam Majer Adam Majer Stefan Schubert Michael Ströder William Brown Samuel Cabrero Michael Ströder Adam Majer Ferdinand Thiessen Ferdinand Thiessen Adam Majer pgajdos@suse.comAdam Majer Adam Majer Adam Majer Adam Majer Johannes Engel Michael Ströder adam.majer@suse.deMichael Ströder adam.majer@suse.demichael@stroeder.commichael@stroeder.commichael@stroeder.comadam.majer@suse.devarkoly@suse.commichael@stroeder.comadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.com- update to version 3.2.3: Feature Improvements * Add "max_retries" for connection pools. Fixes #4908. * Update dictionary.ciena, dictionary.huawei, dictionary.wifialliance and dictionary.wispr; add dictionary.eleven. * You can now list "eap" in the "pre-proxy" section. If the packet contains a malformed EAP message, then the request will be rejected The home server will either reject (or discard) this packet anyways, so this change can only help with large proxy scenarios. * Show warnings if libldap is not using OpenSSL. * Support RADIUS/1.1. See https://datatracker.ietf.org/doc/draft-dekok-radext-radiusv11/ Disabled by default, can be enabled by passing `--with-radiusv11` to the configure script. For now, this is for testing interoperability. * Add extra sanity checks for malformed EAP attributes. * More TLS debugging output. * Clear old module instance data before HUP reload. Avoids burst memory use when e.g. using large data files with rlm_files. * `rlm_cache_redis` is now included in the freeradius-redis packages. Bug Fixes * Don't leak MD contexts with OpenSSL 3.0. * Increase internal buffer size for TLS connections, which can help with high-load proxies. * Send Status-Server checks for TLS connections. * Give descriptive error if "update CoA" is used with "fake" packets, as it won't work. i.e. inner-tunnel and virtual home servers. * Many small ASAN / LSAN fixes from Jorge Pereira. * Close inbound RADIUS/TLS socket on TLS errors. When a home server sees a TLS error, it will now close the socket, so proxies do not have an open (but dead) TLS connection. * Fix mutex locking issues on inbound RADIUS/TLS connections This change avoids random issues with "bad record mac". * Improve REST encoding loop. Patch from Herwin Weststrate. Closes #4950. * Correctly report the LDAP group a user was found in. Fixes #3084. * Force correct packet type when running Post-Auth-Type. Helps with #4980. * Fix small leak in Client-Lost code. Patch from Terry Burton. PR #4996. * Fix TCP socket statistics. Closes #4990. * Use NAS-Port-Id instead of NAS-Port during SQL simultaneous-use checks. Helps with #5010. Changes in version 3.2.2: Feature Improvements * The "configure" process now gives a much clearer report when it's finished * Fallback to "uname -n" on missing "hostname". Fixes #4771. * Export thread details in radmin "stats threads". Fixes #4770. * Improve queries for processing radacct into periodic usage data * Update dictionary.juniper. * Add dictionary.calix. * Fix dictionary.rfc6519 DS-Lite-Tunnel-Name to be "octets". * Update documentation for robust-proxy-accounting, and be more aggressive about sending packets. * Add per-module README.md files in the source. * Add default Visual Studio configuration for developers. * Postgres can now automatically use alternate queries for errors other than duplicate keys. * %{listen:TLS-PSK-Identity} is now set when using PSK and psk_query This helps the server track the identity of the client which is connecting. * Include thread stats in Status-Server attributes. Fixes #4870. * Mark rlm_unbound stable and add to packages. * Remove broken/unsupported Dockerfiles for centos8 and debian9. Bug Fixes * Preliminary support for non-blocking TLS sockets. Helps with #3501. * Fix support for partial certificate chains after adding reload support. Fixes #4753. * Fix handling of debug_condition. * Clean up home server states, and re-sync with the dictionaries. * Correct certificate order when creating TLS-* attributes Fixes #4785. * Update use of isalpha() etc. so broken configurations have less impact on the server. * Outgoing TLS sockets now set SNI correctly from the "hostname" configuration item. * Support Apple Homebrew on the M1. Fixes #4754. * Better error messages when %{listen:TLS-...} is used. * Getting statistics via Status-Server can now be done within a virtual server. Fixes #4868. * Make TTLS+MS-CHAP work with TLS 1.3. Fixes #4878. * Fix md5 xlat memory leak when using OpenSSL 3.0 - freeradius-server-rlm_sql_unixodbc-configure.patch: refreshed - spec file cleanup: remove duplicate BR: from subpackages- update to version 3.2.1: Feature Improvements * Add dictionary.ciena, dictionary.nile, and DHCPv4 dictionaries * Add simultaneous-use queries for MS SQL * Add radmin command for "stats pool " which prints out statistics about the connection pools. * Client statistics now shows "conflicts", to count conflicting packets. * New optional "lightweight accounting-on/off" strategy. When refreshing queries.conf you should also add the new nasreload table and corresponding GRANTs to your DB schema. * Add TLS-Client-Cert-X509v3-Certificate-Policies, which helps with Eduroam. * Allow auth+acct for TCP sockets, too. * Add rlm_cache_redis. See raddb/mods-available/cache for details. * Allow radmin to look up home servers by name, too. * Ensure that dynamic clients don't create loops on duplicates * Removed rlm_sqlhpwippool. There was no documentation, no configuration, and the module was ~15 years old with no one using it. * Marked rlm_python3 as stable. * Add sigalgs_list. See raddb/mods-available/eap * For rlm_linelog, when opening files in /dev, look at "permissions" to see whether to open them r/w. * More flexibility for dynamic home servers. See doc/configuration/dynamic_home_servers.md and raddb/home_servers/README.md. * Allow setting of application_name for PostgreSQL. See mods-available/sql. Bug Fixes * Correct test for open sessions in radacct for MS SQL. * The linelog module now opens /dev/stdout in "write-only" mode if the permissions are set to "u+w" (0002). * Various fixes to rlm_unbound from Nick Porter. * PEAP now correctly runs Post-Auth-Type Accept. * Create "TLS-Cert-*" for outbound Radsec, instead of TLS-Client-Cert-* Fixes #4698. See sites-available/tls, and fix_cert_order. * Minor updates and fixes to CI, Dockerfiles and packaging. * Fix rlm_python3 build with python >= 3.10. Fixes #4441. Changes in version 3.2.0: Feature Improvements All features from 3.0.x are included in the 3.2.x releases. In addition: * Add 'reset_day' and '%%r' parameter for rlm_sqlcounter to specify which day of the month the counter should be reset. * Partial backport of rlm_json from v4, providing the json_encode xlat See mods-available/json for documentation. * Support for haproxy "PROXY" protocol See sites-available/tls, "proxy_protocol" and doc/antora/modules/howto/pages/protocols/proxy/. * Support for sending CoA-Request and Disconnect-Request packets in "reverse" down RadSec tunnels. Experimental for now, and undocumented. * It is now possible to run a virtual server when saving / loading TLS cache attributes. See sites-available/tls-cache for more information. * Removed the "cram" module. It was undocumented, and used old and insecure authentication methods. * Remove the "otp" module. The "otpd" program it needs is no longer available, and the module has not been usable since at least 2015. * All features from 3.0.x are included in the 3.2.x releases. * 3.2.0 requires OpenSSL 1.0.2 or greater. Bug Fixes All bug fixes from 3.0.x are included in the 3.2.x releases. - freeradius-server-enable-python3.patch: refreshed- Migration of PAM settings to /usr/lib/pam.d.- use chown with colon instead dot in radiusd.service- Resolve issue with linking python3 with rlm-python- Remove libwbclient-devel BuildRequires in favor of pkgconfig(wbclient); (jsc#SLE-20577);- update to 3.0.25: * `correct_escapes` has been added back into the default configuration. * A segfault when trying to proxy to zombie home servers has been fixed. * A number of other small bugs and compiler warnings were fixed. * Added support for building with PostgreSQL 14.- Update to version 3.0.24 (jsc#SLE-21237) Feature Improvements * Add sanitizer options to configure script. * Log information needed by Wireshark to decode TLS sessions. * Allow more liberal SQL commands in rlm_sql_map. * Update dictionary.apc, dictionary.h3c. * Add new Acct-Status-Type Subsystem-On and Subsystem-Off See dictionary.iana and https://freeradius.org/rfc/acct_status_type_subsystem.html. * Add reject_unknown_intermediate_ca. See mods-available/eap. * Add dynamic loading of certificates via TLS-Session-Cert-File See raddb/certs/realms/README.md. * Add Server Name Indication (SNI) for outbound RadSec connections See raddb/sites-available/tls, and the home server tls configuration. * Support SNI for inbound RadSec connections. Certificates will be loaded from "realm_dir" in the "tls" section. SNI will be cached in the TLS-Server-Name-Indication attribute. * Preliminary support for haproxy "PROXY" protocol See sites-available/tls, "proxy_protocol" and doc/antora/modules/howto/pages/protocols/proxy/. * Generate parse errors in more circumstances when we know that the configuration is wrong. * Add "weeklycounter" to sample sqlcounter configuration. * Add certificate attributes to the request list, even if the certificates have expired. * The Simultaneous-Use code is now IPv6 aware, and can deal with NAS-IPv6-Address. * Add dictionary.cambium. * No longer logs passwords in logfiles (bsc#1184016) Bug Fixes * Fix crash in trustrouter module (#4115) * Fix crash in state handling. * Don't alter global options in redhat logrotate scripts. * EAP-FAST will print errors and continue, rather than exiting when OpenSSL fails various internal sanity checks. * Allow admin to manually change core limits, even when core limits are disabled. * Fix chunked rlm_rest HTTP body. Closes #4131 * Many fixes around the SQL ippool queries.conf and schema * Fix MySQL stored procedures. PR #4170 * Rework connection pool management for corner cases Fixes #4161, #4162, #4163. * Final fix for double free in #3188. * Fix sqlcounter wrong memory free. PR #4192 * Accept slow writes from proxies over TCP, which allows the server to make more progress when it receives partial packets. * Add 'weeklycounter' for rlm_sqlcounter. * Outbound proxying over TCP / TLS is better able to deal with partial TCP reads, and has fewer issues with slow networks. * Fix wrong data-type of Acct-Delay-Time in rlm_unix. * Fix EAP-FAST PAC lifetime calculation. * Print correct encoded packet length when debugging. - remove python2 build - drop references to SLE11 - freeradius-server-radiusd-logrotate.patch: upstreamed- Add ldap-schemas subpackage for OpenLDAP radius schemas - Add freeradius-server-fix-perl-shbang.patch to fix RPMlint warnings - Fix RPMlint warnings about macros and permissions- Update to version 3.0.23 * Feature improvements * Add "set home_server state ... down" in order to mark the home server as administratively down. Use "alive" to bring it back to life. * Add Post-Auth-Type "Client-Lost" which should make it easier to log when clients stop responding. * Cache TLS messages in &session-state, for more debugging. * Notes in eap configuration about TLS 1.0 / TLS 1.1, and setting cipher_list = "DEFAULT@SECLEVEL=1" * Added MANY warning messages about using TLS 1.3 with EAP. * Bug fixes * Fix crash in some cases when home server is down, in debug mode. * Fix (again) "read clients from SQL" functionality. * Fix sql_map to return values in more situations. * Silently ignore LEAP configuration instead of erroring out. - Update to version 3.0.22 * Feature improvements * Limited support for dynamic home servers. * Add support for prepend operator ^=. * Added rlm_totp, for use with the Google Authenticator app. * The default minimum TLS version is now TLS 1.2, as per RFC 8996. Older versions can be allowed by setting tls_min_version, and updating "cipher_list". * Significantly improve the readability and contents of TLS debug messages. * Allow CoA and Disconnect messages over TLS sockets. * Automatically set fragment size / MTU, so that PEAP/EAP-TLS works, and no longer requires manual changes to the configuration. * Allow "configurable_client_cert=yes" for EAP-TLS. * Add TLS 1.2 support for EAP-Fast. * Add ca_path_reload_interval option for tls. * Add "tls_min_version" to ldap module configuration. * Support running policies when receiving a RadSec connection. * Update TLS "ecdh_curve" code to allow for multiple curves. * Allow delta CRLs. * add rlm_sql_map, which can handle multiple columns from an SQL query. See raddb/mods-available/sql_map. * New xlat for setting status of rlm_always instances and new resource-check example virtual server for manipulating control flow in unlang policies based on status of some external resource. Patches from Terry Burton. * Update radmin to show more information about the home servers using "show home_server list all". * The default configuration now replies with EAP-Key-Name, if it is available, and was requested. * Include extensions in generated certificates. * Ignore user-provided dhparams in FIPS mode. * Remove native support for Cisco LEAP. It is insecure, and should not be used. Proxying LEAP is still supported. * Allow use of password preparation methods with rlm_eap_pwd. * More RFC compliance for various corner cases of DHCP, * Use DHCP-specific schemas. * Add stored procedures for DHCP lease allocation * Add support for DHCP-Decline. * Added mods-available/dhcp_sql which is a DHCP-specific instance of the SQL module. * Treat DHCP Discover and Request differently for lease allocation times. * Add support for PBKDF2 keys. * Update default PostgreSQL schema to use "text" instead of a fixed-size "varchar". * Add radmin command "show client list verbose", which gives a lot more information about each client. * Add support for EAPS-AKA authentication to rlm_wimax. * Add rlm_rest support for HTTP/2. * Add REST-HTTP-Status-Code attribute holding HTTP status code. * Add option to set http_negotiation in rlm_rest. Fixes #2821. * Encode / decode NAS-Filter-Rule according to RFC 4849. * Allow attributes using old names in configuration files, SQL, or modules to match attributes in the packet which use new names. * Allow querying IPv6 stats via FreeRADIUS-Stats-Client-IPv6-Address and FreeRADIUS-Stats-Server-IPv6-Address * Add warnings if there is no "real" User-Name to identify users. * Add sample configuration to update Stripped-User-Name and/or Class for user sessions. See sites-available/default * Add configuration to suppress printing values for User-Name, etc. * Support dictionary.telrad, which is also in WiMAX format. * PEAP 'proxy_tunneled_request_as_eap' is now configurable at runtime with Proxy-Tunneled-Request-As-EAP. * Debug output now lists client/server proposed TLS ciphers. * Add support for TLS1.3 * Bug fixes * Fix long-term double free due to PCRE calling our "free" function twice. * Respect the "log_reject" configuration item in more places. * Run Post-Proxy-Type Fail... when all home servers are down. * Note that rlm_replicate can only use UDP, and not TCP or TLS. * DHCP pool lookup is now keyed by Client Identifier (Option 61) when supplied by client, otherwise the hardware address is used. Compliant with RFC 2132. This change will not affect existing systems on upgrade, but new installations will use the new behavior. * Don't print invalid tags in rlm_cache, among other places. * Do home_server failover immediately when an initial TCP / Radsec connection fails. * Clear error on SQLITE_BUSY to prevent memory leak in corner cases. * Properly add SQL clients to virtual servers. * Use better API when decoding DHCP packets, to avoid unnecessary work. * Parse locale-dependent dates. * Fix radiusd.conf ENV LD_PRELOAD function. * Make the "date" module handle UTC more consistently. * Check for, and complain about, inconsistent use of tls_min_version versus disable_tlsv1 * Fix "read client from SQL" code so that it properly ties clients to a virtual server. Also document the behavior. * Fix leak with unknown attributes in detail reader. * Fix parenting issues in rlm_yubikey. - Drop __DATE__ __TIME__ fixes, implicitly done with source_date_epoch variable supported by gcc >= 7- freeradius-server-radiusd-logrotate.patch: move logrotate options into specific parts for each log as "global" options will persist past and clobber global options in the main logrotate config (bsc#1180525)- remove redundant definitions of apache rpm macros- freeradius-server-radiusd-logrotate.patch: fix permissions in logrotate global section (bsc#1170505, bsc#1174905)- update to 3.0.21 (jsc#SLE-11896) Feature Improvements * New stored procedure for allocating IPs with PostgreSQL Rates of 1500 IPs per second are now possible See raddb/mods-config/sql/ippool/postgresql/procedure.sql * Add SQL IP pool support for Microsoft SQL Server See raddb/mods-config/sql/ippool/mssql/ * Added RCNTEC dictionary. Closes #3168. * Added Pica8 dictionary. Closes #3179. * Add TLS-Client-Cert-Valid-Since attribute holding not Before date Patch from Boris Lytochkin. Fixes #3157. * Generate attributes containing unknown OIDs See raddb/sites-available/tls * Update the WiMAX dictionary. * Added ability to rlm_python(Python2) show a stacktrace from errors. #2979. * Add WiFi Alliance Policy OIDs. See raddb/certs/xpextensions * radmin now shows coa stats, too. * Sample schema extensions for summarizing data in SQL See mods-config/sql/main/*/process-radacct.sql * Update dictionary.aerohive, dictionary.fortinet, dictionary.arista and dictionary.erx. * Added VAS Experts dictionary. * Many updates to RPM and jenkins builds from Matthew Newton. * Added %C (time now in seconds) and %c (microsecond component of now) back-ported from the "master" branch. * Add reload capability to systemd unit file in Debian and RedHat. * Increase timestamp precision in postauth to maximum supported by each database and simplify (and make more consistent between drivers) the timestamps in SQL queries by using expansions. * Option to set dictionary path in raduat script. Bug Fixes * Various fixes found by PVS-Studio. * Set permissions of certificates in bootstrap shell script Fixes #3132. * Increase the 'nasportid' SQL field for 'varchar(32)'. #3141. * Skip processing proxy reply if there are no home servers available. * Update SQLite IPPool queries. Fixes #3177 * rlm_sql_unixodbc fixes. Fixes #2822. * Fixes when building with LibreSSL. * Fix the rlm_python3 build. Note that this module is experimental. #3183. * The rlm_python should append the 'python_path' paths in 'sys.path'. It fixes the expected behavior to use the existing Python modules Fixes #3180. * Fix rlm_python to print the script errors properly. * Bound total query time for PostgreSQL. Fixes #3253. * Many fixes to Oracle sqlippool. It now does 500 IPs per second without any tuning. Fixes #3270. * Reference sqlippool by it's correct name. Fixes #3272. * Revert 3.0.20 patch which caused crashes on duplicate clients. * Update WiMAX-MSK attribute. Fixes #3280. * Fix crash when trying to access non-existant regex capture group. * Use timestamps (request or server) rather than SQL NOW() in accounting queries so that these are stable when replayed from a file buffer. - freeradius-python3_patches.patch: upstreamed- update to 3.0.20 (bsc#1146848) Feature Improvements * Added Force10 dictionary. * Update dictionary.hp with new attributes. #2690. * Update dictionary.aruba with new attributes. #2696. * Fix side-channel leak in EAP-PWD (bsc#1144524, CVE-2019-13456) * Relax OpenSSL version checks, now that their API is both public, and stable. * Note that tls_min_version/tls_max_version also support "1.3" Since there is no standard yet for EAP with TLS 1.3, it will not work. * Added tripplite dictionary from #2760. * Switch to the async interface for rlm_sql_postgresql so that we can enforce query_timeout. * Added new LDAP option 'allow_dangling_group_ref'. * Updated documentation and functionality for EAP session caching See "cache" section of mods-available/eap. * Tighten systemd unit file security. Fixes #2637. * Disable TLS 1.0 and TLS 1.1 support in the default configuration We STRONGLY recommend doing this for all installations. * Add expansions for *outgoing* Radsec connections "%{proxy_listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. Fixes #2839. * Add %{listen:tls} which returns "yes" or "no" for TLS or non-TLS connections. * Update dictionary.lancom with new attributes. #2847. * Added rlm_sql_mongo. See raddb/mods-available/sql. Note that this module is experimental. * Added more documentation in sites-available/robust-proxy-accounting. * sqlippool now re-allocates unexpired leases, to prevent IP pool exhaustion when clients perform multiple reauthentication attempts * Add support to radmin keep the history in ~/.radmin_history. * Add support for ENV and LD_PRELOAD in radiusd.conf. See the new ENV sub-section of radiusd.conf. * Update dictionary.aptilo. #3002. * Update dictionary.airespace. #3039. * Add sites-available/coa-relay, which makes CoA easier #3045. * Add example stored procedure for IP Pools in MySQL See mods-config/sql/ippool/mysql/procedure.sql * Update dictionary.dhcp dictionary with the recent hardware types. * Add experimental rlm_python3. This should largely work the same as rlm_python, which was Python2 only. * Add Dockerfiles for Debian10 and CentOS8. * Add RPM spec file compatibility for RHEL/CentOS 8. * Notes on certificate constraints. See raddb/certs/server.cnf. * Add NAIRealm example to raddb/certs/server.cnf, for RFC 7585. Bug Fixes * Allow listen.ipaddr to reference an IPv6-only host. Fixes #2627 * ERX-Acct-Request-Reason is "integer". Closes #2635. * Fix a slow memory leak in the file management code. * Try to fix file permissions if they get modified while the server is running * Fix slow memory leak with clients. * Fix request and connection timeouts in rlm_rest. * Fix systemd issues. * Fixes from clang analyzer. * Fix missing include for the dictionaries: alcatel.esam, altiga,alvarion.wimax.v2_2,aptis,asn, audiocodes,avaya,bristol, columbia_university,freedhcp,garderos, infoblox,motorola.illegal, starent.vsa1, telkom, wimax.wichorus. * Fix internal sanity check when running with "-Xx". * Allow "inner-tunnel" virtual servers to work better with "accept" and "reject" policies. * Fix dictionary.huawei data types for Huawei-DNS-Server-IPv6-address and Huawei-Framed-IPv6-Address. * Framed-Interface-ID in postgresql/queries.conf is string, not inet Fixes #2817. * Fix rlm_cache to complain on unknown attributes in the "update" section of its configuration. * Add configure checks for -latomic. This helps on armel, mips and mipsel. Fixes #2828. * Add support to Oracle 19 and 18. Via #2857. * Add support for decoding tags in rlm_rest. Fixes #2848. * Use correct passwords when updating CRLs in raddb/certs/. * Properly separate "originate-coa" packets when accounting packets are read from the detail file reader. * Use the correct virtual server for pre/post-proxy. * radsqlrelay fixes backported from "master" branch * Fix DoS issues due to multithreaded BN_CTX access (bsc#1166847, CVE-2019-17185) - disable python2 for SLE15 and Factory - freeradius-server-enable-python3.patch: enable Python3 module - freeradius-python3_patches.patch: backport python3 fixes from upstream - freeradius-server-opensslversion.patch: updated- Enable memcached driver on SLE15- Add missing BuildRequire on samba-core-devel required for windbind support in rlm_mschap.- update to 3.0.19 (jira#SLE-5890) Feature improvements * Update dictionary.cisco * Update sqlippool to allow for stored procedures with PostgreSQL. This increases performance substantially. Patch from Nathan Ward. Fixes #2540. * Re-added "show client config" command to radmin. * Cleaned up mods-available/sql example so that it is easier to understand. * Added pfSense dictionary. Closes #2581 * Update dictionary.h3c Closes #2592 * Update elasticsearch/logstash config for v6.7.0. * EAP-PWD security fixes from Mathy Vanhoef. See http://freeradius.org/security/ (CVE-2019-11234, CVE-2019-11235, bsc#1132549, bsc#1132664) Bug fixes * Update dynamic_client module and server core so that the functionality works. This has been broken since at least v2. * Fix crash in sqlippool due to escaping changes. Patch from Nathan Ward. Fixes #2532, #2533. * Fix systemd notify, watchdog and unit files. Fixes #2541, #2499. * Fix erroneous length check in EAP-FAST. * Update documentation to remove old "ignore_null" configuration. Fixes #2578. * Fix default POD port. Should be 3799. Fixes #2591 * Correctly encode vendor-specific "encrypted" attributes. Fixes #2600- reformat changelog mostly by wrapping lines - add missing bug numbers for security fixes- update to 3.0.18 * cleanup_delay can now be 30 seconds. This helps with proxies that have packet loss. * Do-Not-Respond policies can now be set in the "post-auth" section. * Encode / Decode ADSL Forum DHCP options. * Fix module ordering issues. e.g. when "sqlippool" needs "sql". See the "instantiate" section of radiusd.conf. * Add Big Switch dictionary. Fixes #2252. * Add sql_session_start policy (raddb/policy.d/accounting) This minimizes race conditions when using Simultaneous-Use (#2257). * For rlm_perl, all variables are now tainted by default. See raddb/mods-available/perl, and the "perl_flags" configuration item. This change should only affect people who are using variables in insecure ways. * Allow "sqlcounter" module to be listed in "post-auth". * Add support for IPv6 attributes in SQL. Fixes #2280 * The server is better at handling fail-over for outbound RadSec and TCP connections. Fixes #2284. * The server is now more aggressive about retrying failed outbound RadSec and TCP connections. Fixes #2284. * Add TLS-Session-Version and TLS-Session-Cipher-Suite to the "session_state" list. * Add expansion for Radsec connections. "%{listen:TLS-...}" for TLS-Client-Cert-* and TLS-Cert-* attributes. * Add notes on running "ldapsearch" using the parameters from the LDAP module. * "ipaddr" attributes can now be cast to "integer" type attributes in an "update" section. * Move main thread queue to using atomic queues. This should help with contention in high load scenarios. * Add "recv_buff" setting to listeners. For more details, see sites-available/default. * The sqlippool module can now use attributes other than "Pool-Name" to assign IP pools. The "Pool-Name" attribute is still the default. * The "unpack" expansion can now unpack substrings. See mods-available/unpack for documentation and examples. * The preprocess module now does "ciscvo_vsa_hack" for Eltex-AVPair Fixes #2301. Vendors SHOULD NOT USE THAT KIND OF ATTRIBUTE. * Allow for -LDAP-UserDN. See mods-available/ldap for more information. * Add sanitizing of control list for moonshot. Fixes #2318. * Update rlm_sql_mysql to be compatible with MySQL 8 Fixes https://bugs.launchpad.net/bugs/1795310. * Allow logging of only Access-Accept or Access-Reject messages See radiusd.conf, "auth_accept" and "auth_reject". * Removed Connect-Rate comparison. It was unused and broken. * Add dictionary.infinera. * Use OpenSSL HMAC functions instead of local ones. * Some SQL modules can now use "auto_escape" to escape unsafe strings See mods-config/sql/main/mysql/queries.conf. * Add wispr2date conversion in mods-available/date. * Implement dictionary-based handling in rlm_python. Fixes #2334 See mods-available/python for details. * Add support for SKIP LOCKED in sqlippool. This can improve performance by an order of magnitude or more. See raddb/mods-config/sql/ippool/*/queries.conf Fixes #2383 * Allow PSK and certificates at the same time Except for TLS 1.3 which does not support that. * Update docker scripts. Fixes #2306 Patch from Matthew Newton. * Add crypt xlat. * MySQL connections can now skip verifying the server certificate. Fixes #2481. See mods-available/sql. * Add better mechanism to detect MariaDB (Old MySQL). * Add RFC 7532 "bang path" support for realms Fixes #2492. * Update dictionary.ukerna documentation. Fixes #2493. * Add support for systemd service and watchdogs Fixes #2499. * Check for openss/rand.h, and allow building without OpenSSL engine. Patch from Eneas U de Queiroz Fixes #2517. * The default PosgtreSQL queries now use "ON CONFLICT" to better deal with issues. This requires PostgreSQL 9.5 or later. Please use a recent version of PostgreSQL, or edit the default queries to remove "ON CONFLICT". BUG FIXES * The session-state list is no longer cleaned in the inner-tunnel. This lets the outer Access-Reject section access session-state. * Fix typo in lock initialization for TLS sockets Found by Sergio NNX. * Add check for crash when home server down Fixes #2233. * Add username key for postauth table. * Better libpcap checks, when the header files or libraries are missing. Fixes #2245. * Allow building with old versions of OpenSSL Fixes #2247. * Allow non-FreeRADIUS State attributes to be used with the "session-state" list. i.e. State length != 16. * Be more aggressive about cleaning up zombie children when running in debug mode. * Use LTDL_DEEPBIND, which fixes issues with Oracle libraries exporting LDAP API functions. * unlock files when asked to unlock them. * return error instead of asserting in map code. * Don't write 0 bytes to SSL. Fixes #2270. * Remove "expiry_time IS NULL" from allocate_update query. Fixes #2262. * Various dictionary cleanups and consistency checks Fixes #2281. * rlm_python has stronger thread locking to prevent reported issues. Performance may be affected. * Don't allow Message-Authenticator to overflow past the end of a large packet. * Fix crash in sqlippool when SQL server goes away Fixes #2300. * Typos in man pages. Patch from Nikolai Kondrashov Fixes #2303. * Fix crash with CoA packets/ Fixes #2304. * Fix crash in rlm_exec with CoA. Fixes #2328. * Print errors while parsing the log config, and don't quit when deprecated log settings are found. * Fix DHCP encoder xlat so that it can be used with a list of attributes. It previously only encoded the first member of the list, and now encodes all members. * The "expr" module now skips more whitespace. * Remove internal FreeRADIUS-Response-Delay attributes from attr_filter Access-Reject. * Don't send junk to redis when maximum args reached. * Small updates to IPv6 for accounting schema Fixes #2364. * Fix OpenDirectory integration in rlm_mschap. * Fix slow memory leak with dynamic clients. * Don't artificially truncate debug output for long strings. * Fix memory leak in EAP-PWD. * Fix crash in "hints" file with Fall-Through = yes. * Fix crash / timer issues with many CoA packets. * Fix attr_filter so that it does not treat vendor attributes of number 26 as Vendor-Specific. * Fix reconnect correctly in rlm_sql_mysql. * Fix rlm_cache to properly use Cache-TTL < 0 Fixes #2485. * Fix rare occurance of bad xlat expansion. * Check for rare race condition when a proxy reply arrives too late.- install license as %license instead of documentation- also fix ownership of /var/log/radius in systemd unit- update to 3.0.17 Feature Improvements * Add CURLOPT_CAINFO. Patch from Nicolas C #2167. * "stats home server" now supports "src IPADDR", to specify home server also by source IP. Fixes #2169. * Add Dockerfiles for a selection of common systems. * Increase number of permitted file descriptors, for systems with many home servers. * Add TLS-Client-Cert-X509v3-Extended-Key-Usage-OIDs Patch from Isaac Boukris. Fixes #2205. * Update main READMEs. Patches from Matthew Newton. * Added dictionary.mimosa. Bug Fixes * Don't call post-proxy twice when proxying to a virtual server. Matthew Newton, #2161. * Use "raw" string value for shared secrets and dynamic clients It now parses strings with backslashes and "special characters" correctly. Fixes #2168. * Fix RuntimeDirectory for RedHat, from Alan Buxey. * Relax checks in 'if' parser from Isaac Bourkis. * Minor cleanups for %{debug_attr:&request} from Isaac Boukris. * Be more aggressive about cleaning up cached certificate attributes, due to deficiencies in OpenSSL. Reported by Nicolas Reich. * Be more accepting when parsing IPv6 addresses. Bug noted by Klara Mall. * Fix double free in rlm_sql. Fixes #2180. * rlm_detail now writes empty Access-Accept packets. * rlm_python can now create tagged attributes. * Don't crash on duplicate realm + authhost / accthost * Allow partial certificate chain to trusted CA. Fixes #2162. * Treat SSL_read() returning zero as error. Fixes #2164. * detail writer now checks if the file was renamed or deleted. * Add User-Name to Access-Accept if EAP-Message exists, not Stripped-User-Name. * RedHat Systemd updates. Fixes #2184. * Use correct API for State variable in rlm_securid. * Remove broken radclient option "-i". * Fix "users" file (and hints, etc). So that it does not get confused about entry ordering with multiple $INCLUDEs. * Fix rlm_sql to expand the un-escaped string, not the raw string. * Link default and inner-tunnel only if they exist. Fixes #2206. * Don't use both IP_PKTINFO and IP_SENDSRCADDR. * Always install signal handler for SIGINT (needed by Docker). * Fix intermediate CA flow for OCSP. Fixes #2160 Intermediate certs which are not self-signed will now be checked. * sqlippool now returns "fail" if it fails IP allocation. * Fix rlm_yubikey to look for correct attribute in replay attack check.- update to 3.0.16 Feature improvements * rlm_python now supports multiple lists. From #2031. * Add trust router re-keying. From #2007. * Add support for Samba / AD LDAP schema. See doc/schemas/ldap/samba/README.txt and doc/schemas/ldap/samba/ * Add "tls_min_version" and "tls_max_version" to EAP module for Debian OpenSSL issues. * Better documentation for client certificates in PEAP and TTLS: it usually doesn't work. Fixes #2068. * Distinguish login failure from AD unavailable. Fixes #2069. * Update RH spec files. Fixes #2070. * Run Post-Proxy-Type if all home servers are dead. Fixes #2072. * Print offending IP addresses when EAP sessions come from two upstream home servers, and rate-limit the messages. * Minor packaging updates. * Better documentation for rlm_rest. * EAP-FAST now has it's own "cipher_list", so that it is easier to configure. * EAP-FAST now forcibly disables TLS1.2, until such time as we implement the new keying mechanism from TLS1.2. * Add documentation for allow_expired_crl. * Update Debian logrotation. #2093 and #2101. * DHCP relay can now drop responses. #2095. * rlm_sqlippool can now assign Delegated-IPv6-Prefix. It also now can assign any IPv4 or IPv6 address. Based on patches from maximumG. #2094. See raddb/mods-available/sqlippool for changes. * radeapclient can now use EAP-SIM-Ki to dynamically create the necessary triplets. * Explain why many LDAP connections are closed. Fixes #1969. * Debian build / package issues fixed by Matthew Newton. * dictionary.patton updates from Brice Schaffner. Fixes #2137. * Added scripts to build "inner-server.pem", and updated mods-config/inner-eap and certs/README to match. * Added provisions for using an external CA. See raddb/certs/ * Include dhcpclient binary in freeradius-dhcp debian packge. Bug fixes * Bind the lifetime of program name and python path to the module FR-AD-002 (redone) * Pass correct statement length into sqlite3_prepare[_v2] FR-AD-003 (redone) * Allow 100-Continue responses with additional headers in rlm_rest. * fix corner case where detail files were not being locked correctly. * Fix (SQL-Group == "%{...}") checks, and same for LDAP-Group. Fixes #1947 * Clean up exfile code. Which should help to avoid issues with reading / writing 100's of detail files. * Fix build for winbind. Patch from Alex Clouter. * Fix checkrad for Mikrotik. Patch from Muchael Ducharme. * Fix home server stats lookup. Patch from Phil Mayers. * Add libjson-c3 as an optional dependency. * Require LTB OpenLDAP on CentOS / Redhat, to avoid linking against NSS, which breaks the server. Fixes #2040. * rlm_python fixes. Fixes #2041 * Typos in "man" pages. Fixes #2045 * Expand "next" in %{%{...}:-%{...}}. Fixes #2048 * Don't add TLS attributes twice. Fixes #2050. * Fix memory allocation in rlm_rest. Fixes #2051. * Update trustrouter for new API. Fixes #2059. * Fix SQLite issues on FreeBSD. Fixes #2060 * Don't do debug logging of bad passwords. Fixes #2064. (bsc#1099802) * More graceful handling of "die" in rlm_perl. Fixes #2073. * Fix occasional crash when using cisco_accounting_username_bug = yes * EAP-FAST fixes from Isaac Boukris. [#2078], #2076, and #2082, #2126. * DHCP fixes, relay, #2092, add run-time check, #2028 * Decode multiple RADIUS packets at a time in highly loaded RadSec connections. Patch from Jan Tomasek. #2106. * TunnelPassword is not "single value" in LDAP schema. Fixes #2061. * sql log now opens the expanded filename, not the input one. This was a regression introduced in 3.0.15. * Remove unnecessary UNIQUE constrain in Oracle schemas. * Fix SSL thread and locking issues when modules also use SSL. Fixes #2125 and #2129. * Re-add dhcpclient "raw packet" changes. Patches from Nicolas Chaigne and Matthew Newton. Fixes #2155.- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 with security fixes for issues found via fuzzing by Guido Vranken (bsc#1049086) https://freeradius.org/security/fuzzer-2017.html * CVE-2017-10978: FR-GV-201 (v2,v3) Read / write overflow in make_secret() * CVE-2017-10983: FR-GV-206 (v2,v3) DHCP - Read overflow when decoding option 63 * CVE-2017-10984: FR-GV-301 (v3) Write overflow in data2vp_wimax() * CVE-2017-10985: FR-GV-302 (v3) Infinite loop and memory exhaustion with 'concat' attributes * CVE-2017-10986: FR-GV-303 (v3) DHCP - Infinite read in dhcp_attr2vp() * CVE-2017-10987: FR-GV-304 (v3) DHCP - Buffer over-read in fr_dhcp_decode_suboptions() * CVE-2017-10988: FR-GV-305 (v3) Decode 'signed' attributes correctly * FR-AD-002 (v3) String lifetime issues in rlm_python * FR-AD-003 (v3) Incorrect statement length passed into sqlite3_prepare- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682/bin/sh/bin/sh/bin/sh/bin/shfreeradiusi03-ch2d 1770900091  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./01234563.2.3-150400.1.163.2.33.2.3-150400.1.163.2.3-150400.1.163.2.3     !!"###############################################################################################################################################################################################################################################$%%&&&&&&&&&&&&&&&&&&&&&&&'''''''''()***radiusdradiusdraddbREADME.rstcertsMakefileREADME.mdbootstrapca.cnfclient.cnfinner-server.cnfpasswords.mkserver.cnfxpextensionsclients.confdictionaryexperimental.confhintshuntgroupsmods-availableREADME.rstabfab_psk_sqlalwaysattr_filtercachecache_authchapcouchbasecountercuidatedetaildetail.example.comdetail.logdhcpdhcp_filesdhcp_passwddhcp_sqldhcp_sqlippooldigestdynamic_clientseapechoetc_groupexecexpirationexprfilesidninner-eapippooljsonldap_googlelineloglogintimemac2ipmac2vlanmoonshot-targeted-idsmschapntlm_authopendirectorypampappasswdpreprocesspython3radutmprealmredisrediswhoreplicaterestsmbpasswdsmsotpsohsometimessqlsql_mapsqlcountersqlippoolsradutmptotpunboundunixunpackutf8wimaxyubikeymods-configREADME.rstattr_filteraccess_challengeaccess_rejectaccounting_responsecoapost-proxypre-proxyfilesaccountingauthorizedhcppre-proxypreprocesshintshuntgroupsrealmfreeradius-naptr-to-home-server.shsqlcountercuidhcpippoolippool-dhcpmysqlschema.sqlschema.sqlpostgresqlprocedure.sqlmainmoonshot-targeted-idsmysqlqueries.confschema.sqlpostgresqlqueries.confschema.sqlsqlitequeries.confschema.sqlunbounddefault.confmods-enabledalwaysattr_filterchapdatedetaildetail.logdigestdynamic_clientseapechoexecexpirationexprfileslineloglogintimemschapntlm_authpappasswdpreprocessradutmprealmreplicatesohsradutmptotpunixunpackutf8panic.gdbpolicy.dabfab-traccountingcanonicalizationcontrolcuidebugdhcpeapfiltermoonshot-targeted-idsoperator-namerfc7542proxy.confradiusd.confsites-availableREADMEabfab-tlsabfab-tr-idpaws-nlbbuffered-sqlchallengechannel_bindingscheck-eap-tlscoacontrol-socketcopy-acct-to-home-serverdecoupled-accountingdefaultdhcpdhcp.relaydynamic-clientsexamplegoogle-ldap-authinner-tunneloriginate-coaproxy-inner-tunnelresource-checkrobust-proxy-accountingsohstatustlstls-cachetotpvirtual.example.comvmpssites-enableddefaultinner-tunneltemplates.conftrigger.confusersradiusdradiusd.serviceradiusd.conffreeradiusproto_dhcp.soproto_vmps.sorlm_always.sorlm_attr_filter.sorlm_cache.sorlm_cache_memcached.sorlm_cache_rbtree.sorlm_chap.sorlm_counter.sorlm_date.sorlm_detail.sorlm_dhcp.sorlm_digest.sorlm_dynamic_clients.sorlm_eap.sorlm_eap_fast.sorlm_eap_gtc.sorlm_eap_md5.sorlm_eap_mschapv2.sorlm_eap_peap.sorlm_eap_pwd.sorlm_eap_sim.sorlm_eap_tls.sorlm_eap_ttls.sorlm_exec.sorlm_expiration.sorlm_expr.sorlm_files.sorlm_ippool.sorlm_json.sorlm_linelog.sorlm_logintime.sorlm_mschap.sorlm_pam.sorlm_pap.sorlm_passwd.sorlm_preprocess.sorlm_radutmp.sorlm_realm.sorlm_replicate.sorlm_rest.sorlm_soh.sorlm_sometimes.sorlm_sql.sorlm_sql_freetds.sorlm_sql_map.sorlm_sql_null.sorlm_sql_unixodbc.sorlm_sqlcounter.sorlm_sqlippool.sorlm_test.sorlm_totp.sorlm_unbound.sorlm_unix.sorlm_unpack.sorlm_utf8.sorlm_wimax.sorlm_yubikey.socheckradraddebugradiusdradminradrelayrcradiusdfreeradius-serverCREDITSChangeLogfreeradiusdictionarydictionary.3comdictionary.3gppdictionary.3gpp2dictionary.accdictionary.acmedictionary.actelisdictionary.adtrandictionary.advadictionary.aerohivedictionary.airespacedictionary.alcateldictionary.alcatel-lucent.aaadictionary.alcatel.esamdictionary.alcatel.srdictionary.alteondictionary.altigadictionary.alvariondictionary.alvarion.wimax.v2_2dictionary.apcdictionary.aptilodictionary.aptisdictionary.arbordictionary.aristadictionary.arubadictionary.ascenddictionary.ascend.illegaldictionary.asndictionary.audiocodesdictionary.avayadictionary.azairedictionary.baydictionary.bigswitchdictionary.bintecdictionary.bluecoatdictionary.boingodictionary.bristoldictionary.broadsoftdictionary.brocadedictionary.bskybdictionary.btdictionary.cablelabsdictionary.cabletrondictionary.calixdictionary.cambiumdictionary.camiantdictionary.centecdictionary.checkpointdictionary.chillispotdictionary.cienadictionary.ciscodictionary.cisco.asadictionary.cisco.bbsmdictionary.cisco.vpn3000dictionary.cisco.vpn5000dictionary.citrixdictionary.clavisterdictionary.cnergeedictionary.colubrisdictionary.columbia_universitydictionary.compatdictionary.compatibledictionary.cosinedictionary.covarodictionary.dantedictionary.dellemcdictionary.dhcpdictionary.digiumdictionary.dlinkdictionary.dragonwavedictionary.efficientipdictionary.elevendictionary.eltexdictionary.epygidictionary.equallogicdictionary.ericssondictionary.ericsson.abdictionary.ericsson.packet.core.networksdictionary.erxdictionary.extremedictionary.f5dictionary.fdxtendeddictionary.force10dictionary.fortinetdictionary.foundrydictionary.freedhcpdictionary.freeradiusdictionary.freeradius.evs5dictionary.freeradius.internaldictionary.freeswitchdictionary.gandalfdictionary.garderosdictionary.gemtekdictionary.h3cdictionary.hillstonedictionary.hpdictionary.huaweidictionary.ianadictionary.ieadictionary.infineradictionary.infobloxdictionary.infonetdictionary.ipunpluggeddictionary.issannidictionary.itkdictionary.juniperdictionary.karlnetdictionary.kinetodictionary.lancomdictionary.lantronixdictionary.livingstondictionary.localwebdictionary.lucentdictionary.manzaradictionary.meinbergdictionary.mellanoxdictionary.merakidictionary.meritdictionary.merudictionary.microsemidictionary.microsoftdictionary.mikrotikdictionary.mimosadictionary.motoroladictionary.motorola.illegaldictionary.motorola.wimaxdictionary.navinidictionary.netdictionary.netelasticdictionary.netscreendictionary.networkphysicsdictionary.nexansdictionary.niledictionary.nokiadictionary.nokia.conflictdictionary.nomadixdictionary.norteldictionary.ntuadictionary.openserdictionary.packeteerdictionary.paloaltodictionary.pattondictionary.perledictionary.pfsensedictionary.pica8dictionary.propeldictionary.prosoftdictionary.proximdictionary.purewavedictionary.quiconnectdictionary.quintumdictionary.rcntecdictionary.redcreekdictionary.rfc2865dictionary.rfc2866dictionary.rfc2867dictionary.rfc2868dictionary.rfc2869dictionary.rfc3162dictionary.rfc3576dictionary.rfc3580dictionary.rfc4072dictionary.rfc4372dictionary.rfc4603dictionary.rfc4675dictionary.rfc4679dictionary.rfc4818dictionary.rfc4849dictionary.rfc5090dictionary.rfc5176dictionary.rfc5447dictionary.rfc5580dictionary.rfc5607dictionary.rfc5904dictionary.rfc6519dictionary.rfc6572dictionary.rfc6677dictionary.rfc6911dictionary.rfc6929dictionary.rfc6930dictionary.rfc7055dictionary.rfc7155dictionary.rfc7268dictionary.rfc7499dictionary.rfc7930dictionary.rfc8045dictionary.rfc8559dictionary.riverbeddictionary.riverstonedictionary.roaringpenguindictionary.ruckusdictionary.ruggedcomdictionary.sangomadictionary.sgdictionary.shastadictionary.shivadictionary.siemensdictionary.slipstreamdictionary.sofawaredictionary.softbankdictionary.sonicwalldictionary.springtidedictionary.starentdictionary.starent.vsa1dictionary.surfnetdictionary.symboldictionary.t_systems_novadictionary.telebitdictionary.telkomdictionary.telraddictionary.terenadictionary.trapezedictionary.travelpingdictionary.tripplitedictionary.troposdictionary.ukernadictionary.unixdictionary.usrdictionary.usr.illegaldictionary.utstarcomdictionary.valemountdictionary.vasexpertsdictionary.verizondictionary.versanetdictionary.vqpdictionary.walabidictionary.waveriderdictionary.wichorusdictionary.wifialliancedictionary.wimaxdictionary.wimax.alvariondictionary.wimax.wichorusdictionary.wisprdictionary.xediadictionary.xylandictionary.yubicodictionary.zeusdictionary.ztedictionary.zyxelfreeradius-serverCOPYRIGHTLICENSEcheckrad.5.gzclients.conf.5.gzdictionary.5.gzradiusd.conf.5.gzradrelay.conf.5.gzrlm_always.5.gzrlm_attr_filter.5.gzrlm_chap.5.gzrlm_counter.5.gzrlm_detail.5.gzrlm_digest.5.gzrlm_expr.5.gzrlm_files.5.gzrlm_idn.5.gzrlm_mschap.5.gzrlm_pap.5.gzrlm_passwd.5.gzrlm_realm.5.gzrlm_sql.5.gzrlm_unbound.5.gzrlm_unix.5.gzunlang.5.gzusers.5.gzradcrypt.8.gzraddebug.8.gzradiusd.8.gzradmin.8.gzradrelay.8.gzradsniff.8.gzradsqlrelay.8.gzrlm_ippool_tool.8.gzrlm_sqlippool_tool.8.gzradiusdradiusradacctradius.logradutmp/etc/logrotate.d//etc/pam.d//etc//etc/raddb//etc/raddb/certs//etc/raddb/mods-available//etc/raddb/mods-config//etc/raddb/mods-config/attr_filter//etc/raddb/mods-config/files//etc/raddb/mods-config/preprocess//etc/raddb/mods-config/realm//etc/raddb/mods-config/sql//etc/raddb/mods-config/sql/ippool-dhcp//etc/raddb/mods-config/sql/ippool-dhcp/mysql//etc/raddb/mods-config/sql/ippool-dhcp/sqlite//etc/raddb/mods-config/sql/ippool//etc/raddb/mods-config/sql/ippool/postgresql//etc/raddb/mods-config/sql/moonshot-targeted-ids//etc/raddb/mods-config/sql/moonshot-targeted-ids/mysql//etc/raddb/mods-config/sql/moonshot-targeted-ids/postgresql//etc/raddb/mods-config/sql/moonshot-targeted-ids/sqlite//etc/raddb/mods-config/unbound//etc/raddb/mods-enabled//etc/raddb/policy.d//etc/raddb/sites-available//etc/raddb/sites-enabled//run//usr/lib/systemd/system//usr/lib/tmpfiles.d//usr/lib64//usr/lib64/freeradius//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/freeradius-server//usr/share//usr/share/freeradius//usr/share/licenses//usr/share/licenses/freeradius-server//usr/share/man/man5//usr/share/man/man8//var/lib//var/log//var/log/radius/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protectionobs://build.opensuse.org/home:pvarkoly:CRANIX:leap15.4/standard/2748db5fb5dcb2ed6c8762de539d5cbf-freeradius-serverdrpmxz5x86_64-suse-linux  !"#$%&'()*+,-./0123456789:;<=>?@ABACCDDDDDDDDDDDDDEDDDDDDDDDDDDDDDDDDFFASCII textdirectorymakefile script, ASCII textPOSIX shell script, ASCII text executableUTF-8 Unicode textELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=2e792be5cbd4877e74d2b3fa04e51a0ca69c7a24, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a560885968396c6c78ca909374ace66fcdce864b, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0f5b714785165de060b28fa3fb3940dbde145768, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=de139b26e8bbcbb95af675671865df9438e9f571, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=19b81a8065174eb0459a2d4a299c0eefae732a33, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3949677082ce1114a57e8811d1752373a43a1502, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=365e77baa8b96adace6cccdcf23f7e517b95c536, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c8d85fb12564f20673ca3ef42e7799df1ed71a55, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3c73bb8f7aad447a8dede3399eaa4aeedf5e35b6, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=dd106a6a99a3c82c41c9ddef47e052e6935df1ea, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=fee023f22eba3eb45f2fe2c90324a3abb839988c, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=fd39bb534b73d8e00a0ef5cf205abec97eb4aa46, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e8e5a8e4f9cc5aa9bea305bdee3b98f0b9df2862, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a28f3bbb48aa00057014732f8e8e6b1dd479d73f, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=6355189824b4b87cf9eee79f53d1e8b85a5cf3cc, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=cc0e486b4d06a59cdc72bee0ff5f92421aa4292f, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=fa7363900ce4cc8b0667c5c4a0d0d5950a8a65f2, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=96248d0e33cbe4f6f79462a4617aebf3c5d70fb0, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9b6055094a3c495c68f2d58a5f4695075f8b92f5, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=070504f63de80310925bfa29bef9d7f17013b29d, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=935a19f816a6afa3d717556f837501543f390890, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=0b96aa7607c708c4053c5c0c7356038decaea057, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=908a5b8dcce065587e199ad6c8b170b80d2d2ca6, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b0958140dcb12250af421d2e40e8bfa49aa36763, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7deb1700992b867eb69ffbeef6dd76f7e169e0e2, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=19ee5d2ea6ff55efcf520a53f3c3556d5482198a, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=719d8cff3bdb0e15687450885314f59f383fb1e3, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3fec26f9334a3ee353e2c23bf8245eb20beefc62, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e343a5c3ff6697de19ccc4a16fcf8ffc2f32aee3, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b354194469c18654dbc1a58b778add22bcd6df66, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=82b3258d7189a3f69689adfd3ce3117f5a9224a0, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5ea4858f42b6f12aa61536f494c428bee67786d3, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b852117fdd1615dab00059861011f60805800446, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e07390e6d27697122ed143d6148b25b6b689c09f, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=00057631a3589a8049340d24058d74b155c17471, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f112873f049f1562114d68261934165680727910, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e4d7b0b6aa21a0a00e71ccf7ad9855ebeb0875e8, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9b4bf6dc425bcf424da963303006fa0e25ce4733, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=bb35c0036cd26662f44ee63312d85ce3ae4eda46, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=7114e82ed63ff41a9ccf817e74600a09e40daf7e, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=07a2d0ec9150977a78fa73721a54660813126d66, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=818d0492b7f627defd9237fc8f54133aa5f0ab96, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b78eda8feed8467d2df74b5ca1ae21a05ad5273e, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=539daed6ef5d0c0af5fea31b713ca59f05e6d413, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=4ee75721e55fbdd98b7e74e6d999020fa84361a7, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b881b6d9521101cfd04805b91deb16a8835b5398, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=de28ecf6cceef30785075d34cb9b78daafaf703f, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f04f262afd0774c01634a0ad24c50c11e398a2a9, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=283a102925c1860ee1ad5c5a31434cdc180241ff, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c2b07cbec12f17448b1036676cfb8cf0656969f5, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=737ffb8a52fe0ac49d6d48cc8a40b6cd6a41bdac, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=04b46f6bab8728f305edcb9d93a7f6056ca10b25, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=8f9183b7b91e071c0060199b1925d76e5901ed79, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=6e1fd83b260455583d41429e7593dd0cb6c3b8ff, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=db8e1532cd4073bdc86716cb0dca96e08fda70d3, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=db1744b08e08eaaf31562db61583d6b770dbfe43, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=190cfc473cab1b819f911977c35fa3116168751b, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=aa544061661a9454ba0a6814a789a997bdaa4b25, not strippedPerl script text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=5c807d2a9e66a7e42516bc6b2e7947719303e09d, for GNU/Linux 3.2.0, not strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=5519ab49e4e44ddf599365f08057792c31cdd0fe, for GNU/Linux 3.2.0, not strippedAlgol 68 source, ASCII texttroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)empty  #),06;?EKOTY_ekntwz#  RR RR R RR R R R R RR RR)R RR(RR#R RR RRR R)R R$R(R#R R RR RR RR RR R RR RRR R R RR RRR R RRR R RRR R R R RR RR R RR RRR R R RR R R RRR RR RR R R RR RRR R RRR RR RR RR RR R RR R RRR RR RR R R RR R RR RR R R RR RRR RR R RR RRR RR RR R RRR R R-R,R RR RR R+R R"R R!R RR RR R RR R RR R RR R RR R R R R R RR RRRR R RR R R R RR RR R RRRR R R R R R RR R R R RRR RR RR RR R R R R RRR R R*R RR RR R R RR R R R R RR RRRR R R R RRRRR'R&RR)R$R R RR RR RRRRR%R(RR#RR R)R$RR RRRR(R#R RRR'R&RR)R$R R RR RR RRRRR%R(RR#RR B&6 !"mlogrotatesystemd-sysvcompatutf-89f86a650a8aaf7c241b7af7b3fcfc462a397fb8601dffdca75adba3deb5c3a5b?7zXZ !t/T]"k%(fm?1 1N8[xOu( v1gw]z_w0FhrPɛ(Y۔ER(d8pbeƙS9-!#2;eOr{]݁ We>{}P-NVJZ֫jkE\W23w=0YD5FM+]eMS!>7*we L G-AhR!x 7%BM/rvJԫ,; &v̞`y KK>= $&i/XȢؑ}ۘWG!4q֛n4 mK3V; 5K|=ԶH!D:s%oIلX0jwѩ /cn3XuGn)B]jq"T[0EVl .YU5j,x?QGv11Gҟ|o.mC¸HX='()(hxd_gb_Hid ١J ?&u$-X JFC* L_0ױ+ |@,TF"9ˡaOv qθIe:nR ³ `}/Uލ@4ҩx[ l`j|hD9B4:#|?\ " iYwH702hW :+xFC@suƗ6yg(\zM|FqeuYe"XDy/‘.ȼsNY:1Bhjy2cz##y්xpز=-pTffht*RC{7yB7d#ϠѦ29yX|lS%ZiՖ)"hHÍXfͩr|9XLϊlS]3vh|}WL˴ Q'n0ZVJj,@Wފ!("X僚F9~ &"YZ̹Y$P9S#BiGkFwAD` 64tCm;>!*+\%Ao]01Lsym1)8w*ШNPp9  0|)*m}aOFHaXLd2,~gח1tr{F{f`+]IbgI|ՖWxETi Eu+d\q z_C75PuU'IgqQz&K/Wf) %9iJ͑%v(09;&5MS;x(jOUAZPX kB]Q#@<:.¤_pi&͞c~>-'CX5UY%ӨrV#_8 N=n4njV׏Mg]Dj~1V5WG}_--92 ]xA2&5ٙeamTgV`8=&_@doi6)My;!\%<CIS}vPxʑ tG$hٳ+ǵK8't|,2/V?jhđAfhCV d}c3˨xUI।_n,A]$7i^ۉ4^{kd}l}@?:3 iHglNkBIԌ|'g_*K ) o;.;` .9+۹u[jc9/ N}YeQ`ol& v}y6ZH2b%rX{̧ƴ|cSIQ*#Ox3 V.l|vAؤC3ߩ|9sHϷͲ*Mx?y\OWE#ih-؁L)V:h)`vV3Lxe >? (-[^cxxQL>o7>^&u6#;OʧʏPVHIzM11<;FH{ =JO7p(/~D 3N{rֱUvfSs9a:ˮO swd%Y)\<2 z=b*4d,[UW9laP=nx| K4CCLqU64HAxsM.s-8HI`!EȳZ {"wu@@pmi:6(8>k⁢I `$+YA(q2qJ "5yp臠6;0*8B bĕ Ape!Bn<&McX@߀)SÂpmS%km(q92JNIJgD(ZSָ]cvMKaAƙ!XG4مŲn~FYi|T ~V7H H H#ÀvBTW /3"ؒb.V7Ik C{L=j,aӻ~!XET3-~b(GK^!К<~#6u0nh}T  zT<\JLw~86'jT?2sm5}mC*[:!ow)2޾yBeªXXL }1o-HmR#Z^U׋I]*G:N x 2h%Ѷhc~Gʲc 5A]jt&i!Oո-d4cr5S4nR&Rg~(;YLM mxuNZOq ڥ 5 I3MX /f)On10yby?UQ֪h|֣92qohnO$ gY3m]¥$PUysda>C~$vxzW̧vjiM*%S] JH$ANIIj{H/ zB7f~Y43%Wga6ARF+fEL8OSTwh}+A!>x@w $̜(e)gGasB"s+Ӯ(5A+Z~is*#!%$3*x|_aPzJWp~"cw:#lڴvG)]%C0/Ek(]UJbptݐ!W2OpHof'>$ez]$ަ }{$"(%Ӊ[HԲLoiTg ՞ (p Ǘ 6$+s&-Kq5;Gߓ.qSJg%FLnTK|80NRWS"p72ۺMEg~cԐ^Rzy:I$i.I9򏷨"iɱ={m=&}}e?v0(z~1qZ~\SiY7eY0!38ܟ{GuvL&ݪ~C1dW/s!vFA[Zc5JrcՅ΃PdFK&恌<[j lWM#7P|AEA(k^~a>T\bNL *+ggh)G<&gV6$5 6;-ʡ?_NIEQZ=o+ܱ &GzJ#Q!Y&aj^^&ַ5LH@,MHmU?& (zЦnK G$8,/grd}q:^@Ȏ8MUkU*Gy E_0#^\1 4:Nxl!/>%J4qNEư烎xPY.V˾27 OSO6R YnʼnczJ|dtdlyv d1q<1Sr)jaB*0B*CHx#q#z' }a!/tE4잮KhC#&F}ý`zip0 YRű$dsz}i}?Za8ǻqu#2Te ):9]f*Ig%AkAɧHYcM4D+26dG|f6fATo =l!x< W.ԼR<(BeV|k|;df?!ULs٢})dRQFLgޟ=$6UȉH+tή(I]͉eY\ ޥv8,qr@&V硁";L]׶j9A? !Q1٪#'}eRYn;#(Ϝ>1h Y꼋pl fK$O+|$R1}<6Q?_ lyٔ79nCp u8ђuBQƭ j 5|a ż5-LЄPiMi#WwgGYxYƼϢ| R#\ Js(/TK 禣Hs K$IJiM4'S&Or8^s;;eN#!#p X,t%*XuJj --o{+,2ňDUbd5u%A|KZ݊̊f3fAٙnJOX^oIza6=:F` >%eYaQz k+R&xDp=7C=LۈHyGd%-X?\‘77юώߋD"hsϕvjV[MD2i0 wC aRSH^凛,t-]*[{Z s5A3K;"rpەώbZkz/CF-ؗ2:N{N_Pr+|<#$n$SHsaTkԟQG^,8]Evb-[1c z 8`\y]R8\/K)33;9Пו'kn`_}.5Y[]@@vڕWaWJwa")hUw!zdz %^p'U0]N]31fed0[㹱Hҕ =Wش,l7GhކXrvJhAZ8t1T?YB u]T˙Xj?I|;tM=l _J3IZVX\"3Hnv!]b >[HMj_PPb;Iҕ຃);K67/ZTswXqLԼhScV G\T Сy-fqFժpv4C ~LfqoFX9Ϝ&{/%fqmXf|TsdiSptEriMϩ0wCAhoNWM[^c͠/Ab&\/wW@swoW$k*b~@}{?"68:?NajƊ y2i¶wcr7#pr0 XLbP5K>1kPcp ;3kAoOU{"oɬ ~gZ5DPt2˾zྈf}R>|,y@7sB'P&wnS-I%Dmgo NjƎx%=l?~6pyמ8oU8ېD'Wp3ULx:ߤ HQԿNGF|?YK dfC'"&' eᮞ/[SB`nւHe+g&B,s8Yɣ*CkHsnߚxutE+̺3`U4U9Vȋ PwtXnp`Khc,6DtbeT/ kym܌ fi +|Yc c3"r&#i{_μ*>EK' pQ3Rk0,Qsf(FU$EhSDt򬁯^S~#2ωI}3f3{ Bgi5jK_{U-wMHνI4OBD7p6.VD~H5хҳ>W`+4 ,mĕhرrC@2Ѵ̺YPŒ /D7^~m'ss1`eJn_p<[-K 4g8H^MvrY}>F0xH0] e{$RNz3}*\fm/χ 'nyoiے˩hC ,~J^Dǥ'7壏׭6gbqLJ1qԍx"QP[sMDguiD6Q(p7?}yNS<*? ͺyDM5%RSȽi^a8\K{]2 Ԣ>C% Ex,&zb3ջ.82s^5M,cf%C0P~J-#|0SL)`^#t!g>Вm`n(~NNMDZZ!uB;}VO߭}z@@<žZ| m%hOJˇ,>˅n:jvem/}Ad_峏=kE(,ԟcє.BWxD*T|F K$Dm|(b*T֙,g+͡A@grJp~ @R +ǃ3cz˵w%tj ܜBUnT(t4V3l 59q%t6 8g{l^̰_k\e!(!DʿkܺWL$X  ]Y{Z~7Mc;bO o S\Cn :_<c=^+E32F54O޳dŠ"Y03״,:+9&1/d_<9dBy7e5LDЄR Ǯ'irkX%(-Tk!Rj $|ԌVhFE4͡H,X҇]s%U:ђ ZSqkI?5h|(j=V@X)lcN<bQ5e󑻶 L,e.YYM\ Q v/+0e/e?EdۏM7XUy^c%V?wG"*g,wjacߦm@F}|6ٞSHGLJi?ۘ ]W{M8&*wI*X.L_e.& k}1Mjo!|NN2 7j-w!iߚo>1(T~OB i؊̱Nը^/T,ƜH ]7ݰgk ͅTwKoCbnGߛ.|ď,?h|huA)Cĝ^sld8wɔ-梌^]`ѮEq1Pbx`z+ 򱧞FVfp3(''XZ~4RՆ+3XH{G_-.O)"(p/ۄ֘ƽh-.JAʱrȧ0SbL.M.NPR}{pԒ(3wA9{7`[lQpA@;rj.:t]F4fxi:!2Ɓ٩pzijԆT#O;Z x)t=ͤ.NN 3ۊ{0T > ՟RO F "-p‘RǠo\Xg`qX4\t# CM:+ 8E=:"轠1/{Aɪ8+쇽P$Wq$eÜ,2<)sbA/73Sb `U>c"v-#\v픷s.0"z#@d. RRC=WY>=~F^@)H/ gܥ/G*bkp)ˉ,rWz+37Z\t0} BrDx%1m9 4MHǗ 9Q ѿrkTڼZߘ-gUJ m.8 >^9qBAa' & YUѷɊ֔*QQ;@L)(艺41EN>Lupwv&|fݫg^WAS*&t\s䌻4Apq? {AIG ^-j)|׭j|i(2醽oV-M3mp|hL3)X=1+; a`zXMjZ_tqKeȮ4 ]4vᎸHBUeYP{a2l^,ߤ7*(<0kسow0\BgGhFjEJ "kD4/d8ZC׭҂Lj^f tkd[%0I%-=O0w"(xQT]˕3 P=>$1BlT((@aOri| *(`Ђ ,}׫iy!k0ffgo7ہ#^aFPSydccN;f=ŋl!x2 stG͸IQ) Ŗ JF$&Zե:bpC>h!Lxh|IO= He9oJ%Ƙmg"3"{ִLZ3H4^7xw2qG3??oN%, 2lQ$ |Pj0iR[=}ʹy|L'/ Z2,Hylf:?qDvxfqS`>#/̪,y@ `Hm/>YywybPX U#k%srPu#i!f]l߶s >\L-!a.bz~V!lDܹ#<ӕ$Hs|.Pu&H%RKj͊c(a2ڱ%M8@6՜P {{)?Z+}$lRr”%iKXrOPxGqρD7AIxFYxY#/h(j(X=&#7 S!ڒa9],|D3» M4%hحE>]9ϦsEP")Xh"Q?ȦBvOdd`qz~Zus04w8`I)3=uT/]!B|<Ɣΰ{}ޱ~S;BNK~]a#.cŠsW)`NS%mkh #jA1Tm|M4v(`Dw[iS(xeXSA!k[LRg2SL"XoȾ{*-w(鄈%*H DwgƯe@9PB:s,6Vy.k]#av> 'x*b&*VkW%bqKJѣ6ד{UQKW0c0,~WIWD$`mOwp]μ`)>kRS^ǚj\^=Z2M5{v>LGJr?FCP AM >W6-纱@[:[4/-IF[vlp:_5IYk cL`!D%c|.szM8Ɩ]jVMz稕Oec$-8=;x ,MSWydj>Ø! SfNfY<l^lx9FXϔuO/"B߻DjޜL W8ȩ;!b8`e2'77$ tRԯH%aWF/KB!AR+C^A02\"A'^ef3D@ =I~7jAfov?fT |tq\GRYhَ^-vml!*p0?Z^qnRW2Q|(vW ɨ1ljq~Pcp14Ujf^ФT^nj!RZZ WwGL:߈\I^78;qpC5O6E,<dpOv[ Rd #\qaġZq/;\dB%H/0*OCLfom=?3׹:7ުZ+|ؤɍP)q{{tX5Hf`⴦jDK4E糢_q^-~' ol|$i`!ܒkG%\O@xU31ō˷ zƀoYuISKv;%a\7Lq^;f+-,a,Ӵύ{l,Ϡf`O.vpL<-󇷘tEiΧO#}ŋ %3۩ RaY -{qNϳZ홴D^52nDƵ:O ScC.+2 u!aXCY\T,p5g1EV4D{¼ED<=Y=}R~JļIRsNڏh/}RQy{'H:}8E: cIaʵ6kr,DJ=hk%(l%usA8i븄@QZ>k.ޛ3G\E>2ԉC+s@Ņ fȪz  JNZ+~^燕fwY75ڳ_g6qK,e(yBRT`RcA҇w/($15~0}\sD(w*@!S~&_43 0Űnn!͋شkiusMoPx|pf51? AHWnA%iʨڼ8 gP#DvnZ҅P`\GF{_~f9_;!=y&a3iUpjqɚY-(ip*- Oqb|Vg Tqͯ2B6ހ)s(UM8"lafr/oȸICQ5oF>xmMJ.`#Wn°SxP)`NE4[¦:4uρJ@+?8IFtJʥ;:uP>Ma>,) zʾD|kʞѳڅO=pL͒JB %{BFke+Rӏhr_}!;Um)MTxoĨ+|`2h֤ ?f};^`6.(U H!z13p911c4gpƮ">i<"OqGi qTw]KM:b1U9שFXf^T]]v";x'XS_0ʲ ^AEl~a4GYr \I}/,,4/i91Q;jY_` 6VRȾnF_:w*1iݛ<]vQ7vLFܛ 7Rʇ3iR.m+5$Tk*.ђc t~fLRo(KO2+ֻO!q.2AWCHz8:d5PaF6,.5WHSoHv ;g̼@" ~!7ccK  n6[(AJ^_NJ(MqA&ޔ {gxof_?bE[! ꃵ.o#&覘q]APyH fbA9 8y]pgSr%D%pȨ]6dz)z>{$)|+]]㐪Ph& ۅSvMg|%tD/Xt4g'!z):K*Sȳ% >i&,d7JG <aZLc&kuK-f"#Y3Sv_ZcC`9D3Aس/ԉJn׽ܒ혖:מ찀+scr׭^oEK*vT» IG&Q)fT RL39cu␀[ǎ$Opp|Bo)Wx\ܿ. c}NPc31 JWFe()+5=0յ]2ϴS1[ ^m"/wxiKh '=UV }~LU lH̡/8X7n(s+n%Bɧ%ntH%c*`9D$ʊ\ |g(4}lB/ D'^F˕E\dg=@Ӂ׮%4vDbV'-'ceٶ^#RxkEIG%gB">|Oz*$;EdD-^(MEIՕ%\&#caDZBK(::=u]kms*N!pctWBݕ BKNx۞Z&Zl!QץGw0{$ :j4^LzԞ_ΉJQ\eZ4zY]^AWh9@pwÒ=5پluvkF3'PS@oETRL&AoRKPB߷>AG0Z89on5WUZJ-ߊ{lHG\cʴ2 Ab A\:1{ ;&v}9J[iw s~0t Vb*pa֚堞8H_˯G?Eh؊l%fHj`~yPP͆ 1vk{7-yaї"𞧂[Ԭb}O2dI8 ~[Kƻ{b֘h|a1#*opU\mN I;|90sZ#LĐMqgXvJ|"dnu/ӏiBIp ._y,kJgn !;lmƥb}0fs|LLQJn[cq GC$rE C?fM ?I=0PrĹզ-/nG)V5=׿:j^/}mEL_;F]FȃsyIbeiQלr#wDclla$ y{_|Y-olݝG> ;bH_]9_[V22PH`ۋEC>Z3!kpM9^Um| O{.B 5FU}!x 3|uڰvC>nFkpo@3pwh X-l^K%PC2&'$Cy)D_2n3'X/Q.5 %l9'vXɄ\EZ;3#Gza&u\VXʦm~3ARSOQw 4s[Į<s& IRu%!' YYbK<u2Bﰿ*E4!j$8@e#ۙAkK=UB*ד0~#Ɂ'Wi-!yɉz}SmuC8l .Sj>h&c6Lr<]=9 fΨUʗ|irD@fFoJ6-2O ߒ*6?v7ƣt# pD4ؠΘ&5}8)G(ӦmATXov2t( >hˎd WJG$z¡peŵyVn*djmv:[f)B/~e2I\3z?F猪QQ\2~y'؁!!6rȇH|MC56QFP2$ ؄djCFLn]W.ŀSpkxk.߻T^"5;'$b?Dǜ<4$p&}l$*HZ[pK'X=zĕ⍼'Z'0z̖ 5F bj,< QkrLl|DpxXw9J |__LQk[-2\l+wOlq̵*sY Wӥis2%0d(kQD F 4pd-3fm:j_rw^դ'11L߭/qGfDXQn/,8WZܟ{=YvQRc93Qr 5/Vq!m5q\etNB?ltL/PPWFٓ,904ٳ2,,ɑ,:!_I>ɯ;ZRݦ23ʟe6!L3YN`RvU/,v. ߤy!i;Cs-톼93Z[0Urg, 7Wj#Q j8.CLDXkySvXD)V + (mpuZ KFFęHiҀUkZ'>ہ7J0V#=~٨='~xѮ3Q=۹W"mg0=?М6|Vɋ /2ٻsX79x>m' wiy06E'`[7`wvOG3ӆnsRer` hhƐN5 ƞm3vj'!,XIe|Yo)\DTv`^H58sԓfRA(Vz7]H\G';f\撖?xK$ gԄ$Z #^"Q(XXead&BGk,PM%Z=DLg]jP7uk8C!MiP)E٥ZS>!/,J MH24sixڽSi4{6r_Sf[W*S?k5l,)S8;~Qv8~pJhm#d//O{|/+ah Hx^V a6j'X>U-|2N[sSL2sidB)|RDGC:)lw'4؟m8Ðf:= 9٥e@$^7gN")Kxi?)ޮ=LH3h- L-ȸe*?Y]ڈnr3MH}7Q 1/?*s'T#fx!$U= 9kq%r$bZgYva2[ կhC- yM_f'F]9ݴ DcM%@5d[r{$XPH-qq9c6}e`/֕>^՝皥zm wp#@a |-[dK4WE-)vrn)?Ҁc0)a#oMPnݹ׽\s͞{u>ɠC3C@:A[:pSqY 4L1\FU LľZ_Fo3~r] x]Hx Dwt b6%<\ZrD60#穚-@C[*% xkYnɝsB2ܥSY֓lV(e^I2!\cX4Qb *d?ԸX\x˳ȟ."xY4L5A&xI=V߹QEMM@5Ļ'Ȯibr8]qb PX#H#?$Җ%ǰڤ][s)@JU8<uAu9I+i$ylbԜQ٦?H8/)AZ?bR8^$c- j`l.rmXHۍ1 "5J+́r@63bvM؂%#‰ ҸnnI|W44Du$V CRY [!IHjk%*VN<vE12oD}I^11u~?#nCA~i,x}hr (I^r0%xyYaQnu0nnd{ ч?!DrQTuєWWFzZ,C;+ڒyZRۊdzҔ`/~B2Fb:ض^dMzIZ"5莀m'PK )i/[?=2rU&mYLfsz:}6Re{࿥? SiMM8azNH&h܊};X:`6(St c.1u7\}n6Հ8a#XI 6 ֕6x{ģ^GoK\1O!̣YLâ}liP@%5/ ˩.fu(&eN<0:oJt40 f0"^&$Ģa()QX۔3@D)WB-dviiϊp8֖m=3 ato_kŽ:OgMmbCLp͸uƦ]?QmɈ%P1= G²ʱ{W4-NJ4~n/i9zh 7ҺoWugF 1anȾiS-@w8h3~[EԚaacєZD*!@v%RHg`ԻPkY6]3 gU(n]X3ԙSLMbD-B)0ZSQ1t' ܵNTZId G97,{_ |TS|,˼ z=ůӛM4q Gu7e=2L\sqOd*NZ%/bD>ctUCrR eaq$aqc3{k+K`^pI`hh1C #2Y 9=~ۺ k ~2h7TａUVAw4×[8N )} R*TP~]F7N@N> i;eLjPa{-sެNjl;lOKd쵷1>Œ( d(!rU*/Qd a'Ļ[ ^r((ImzU2 }T}$WdӳƐ^c?^x r&O4ԧpGf=J{ zz5 ? hSjޔVV@XjiMo=6_kGv H4P(ۍ!Nc\}I=H `+5^%u`3 ;G>7bn /V_ΝAϯ&s{[EL_ŗpPƀmq@ٯXز!kd;HaS1A%:z#m$TvӔG\гzyf Ts;Me+roՌ6;#y V7.عg.\W?Ȏ˧3pi__6R^~c(^Dىv H,G(5;MKQ5~8L/bhpҼpDIoH%@Y%1"͓Px)OOas 6Y{ٍK8G{yh9[>j;4^D0'h㰷6jlER ENP6eIF0H+r;f&ݩܿdq3exU#ėrֵxz{r׎\ >z}&r콯,4w͊Zρ'':Œp8q=paj@dIu] z16cjX Ƕ#Pid#oS&HrQ>_/2<%ʅSDoZ];PeT_ѣTr,IA-5 ,DTi՗Trr01p#VZyte"'0ZpSIfBi܊CH5^K]cB'gtfW;^}JBW&|opqуeAk:G;-CDy3GOkX@vlR :Qr/]OHR6:NMzaY ǍC4bmn\[v+2dx&U8kfB?%}>9Nq-l Xdr-"h˛TvB";qӂl(ݘ/1h\2IB)&KJs~}ܗxay$ej ۡ'(490%ăƖUw]I]/\q;oxmYVՐd,UU?(8ofW,C>Ay?1|ZEr\gn,^T.T"hX7&ZH'`KvqIk+=~~Pp(Zyh&{ Mxf11VA'5n|VrKq|$ 8JuzY|% 7fZbnQR #>Aro%*V G`!5CAF|_ZxѬ J[+ {-OvZTAr3݈|^&|pʁC G8:i>3P\_M&zrQͭ luMnD;IW=1|z|WzM4(\Wx@ ~r|܎dtEw]Kɶ &οh#OSeZ4,z <)\?I-9"scܙry2bJ\Eսۆw谖 lLgug9k`q`-&bĄT#BMmizș3Jծ!P)*JŜ&1~}JPg0,0ɓY'T _a6 tP`$s\ix#A˳+E!RveREf_zʅe|^x)uOK ;h4˥$v][>YR⻿ۈ `|2Nk!|Iڲ:+ ~n {cPUUI2']')fݘ0("-.Iڗ'&QFi@i573>yQ2To$lRqr4-| d.٬=i߱ c喼0=bTIb 8.p>8;;fĢG$_Iuz3t$sD[$p<U@è캈qoJHRl}Uh"!ɷ B內&h Vęj LS_22S` S_Oګ-<<)73~ފ֤nGT+墑rZYRV5|]8ɨ"l#C-MOg+1h唗 u캻Ped( =}=y8XϛjeL?$UcWȇPIW xyyb/3esY^Q{n&m"Ya|~oIȩ;{g 3m`03̀}cI A*΂ݪ2-=2Pw5enti:bǀO"z~ڙ}N?j%T \; -"'=xaXXLp>r#Z}9fn2+:>DY=Y7k57`>˻J<饽7+^PhŐޚ.f w#w{b 9oS 1I*(wҷ1xBHo_~"rmmypd%EX-9:.aw%<-b6אnF*bj!ة. ]+hf Q1 /?dxO ߾4ac!;=n3(~jYz.M37V.طS/Lޒ`?݊`:m*XgIvnݹ*grl`I Nq  uWH:i87D#4?KQ|@`ˌZU!$=OZjVrרrPE]W1ct%UAJI!}w[)Ϸc<☧oa%|ic"7JLE_= $|T9c^O~O#p2uHU a je*MgσekK3(bPbiW-_N2Nl6$yfL5}iB}_ =4ŘP|ub:Ux.@2kL0NO%ȻH̊brEV 0x؜\BjdqY"_y] (WH6h'DL[aHM+_r'z-luPZ--gm}bdRL=B%hF&v@l`Λ\#qOYVn6-7ԑ aw5k,O O 7gSxvҬ Gŏ !~bh/Gوi7b+9 V.@j W[ o/TML[zޯ32ΤJ4_TJrua˷)cl~4y:-$DU9>FsPBP@ET\TPGx98M1n1dv[pӍj(UF]-j*8*I+!t#UehV}j{*mȓi~eOP3 @+, R/a5ENUV*HT$'GZM hhTW&Іr^eН"B>a'Ŵ6ٴxk3x ò />z "޳4gA}{:l".zjat4㙿E7m{S|7_+W,\Ъ.U%5H~A!>t nAGS" !swIN4Y0v6wSB=mv2e 3RN/W {e1lFJ`0vC R^xJ%b"T`&#s mm6W_=EFO>ޮ*=Z wlf(&BmSUcKdbC%ЙAmRwH 71wŻ8ds]PS  ""m؍ǽ gfFw|09xf}ǢC^Fg{ܝgQd+QP* 챿\)qp oV>1828*t(hq១ )x𤿡]DߊSid7#LvxG!OQzصom: VE sk|/h:G,Mu#J%P'.Q𘫃87S2B@r|D[F;stu'[&m+]f*žW\DD*#u){O4: 31%^#t++'=Y,4zPDUf-s{(GCV5{므b^3{jCAqZxEn)Jɍǚvk)x0(7KF>3~7;#=Py7bk-dT\tjqs3]t +wk,m[*ҡˮM >poRUڝXc/\-)Z,p嶠 #z[pUݓEkP%6Q~¹6(uOiD-o}Wl7?S3Ї؂Dv#y_z;F3nFDu/ܗwR;&XS&́|ވ廥6BT-tB#SQcYJ ~ k_\Ό7F)E`h|ޔI2DO&=+-Hz:tA|ki]cȃ%z"*.5\tit @a]Pf`RdCX{+; Пbw}IQt=ÝaTrzNb*z@<5Qiu#aRXOJH_tQWd'/J트j@2l+olZuk:I$p%/På7+[5#T1պg=$v4: A}Az\Iڛ(~9ۄ߲6h#@Pr\Bل5x@/ctӑ}P1+&{x:8S'^ 74fTǰ3/Ki܍\PD\B?nd4"4jE_d<{IC{z)^]>F '_d(`iE2e^K+Y JgSad-cCy<I*!tD9 Htf4$=c)h*EVYg%mԵ4t?ҡ udb' X=Ui"u wN$Z-K% ‡e\T\Al[j 0~eu$%1PqBA`Ν_ި:]߳8396_<$+b~E^2pφ>)+Ƭ >u!hQ@ڰiS* .`&矛Nr颵sFZkzu'O@<&I ś!" ̺ '`/չ&;ڿxw[oF=]rٳ`RTtӑ=瀳PDkLK{bߩ;UHdW*hĂÈrDu.4o7]tK1{Q$7 gVK鏁f }MM1;ғS7QTp[;k-`Qb8gͯ$ E)()X+8r[=˜33fQ:#~ëA&*NJf.;n6fr) ifOƂMkj+z[it}^W?4wT*0l߄D7^^0^m-;%Jeg-:=(Wu7BgH {XzxIu0_VpRZǥVPp([ EE5p&p`Zjd(rZz8F-!Lq΢6ү+^ {G}+ymv@\|BO)bکC*(7#}y4н0׺HJhTOm;`GZXkp AZa5T`NZ6m0$ vMh!Gcˌ5j5?+@$ù#-4!Pz+ sEtcN ߮AVf(>ZG9׾2=Ř}ro?ﭰYhHv䠾woBVN gIBHsW^N%P8]o'QU=Wb#lR"fvE$,~%2D/>(P#\O/Uo]:PYV/ءGj$:(TQ%&6y8@"V@'vm %I6 ~;KNe̺{&!5T=õ`I켛-NGY$?}⥄%9hZ]o忔Z>Hp-}0KE!V fj*mѓd5Gbzs80 pz̴.jHJYSsdJOF LVl4;Gᮭ D/RRJ$:)*g[\+sLkl fmPd hȾ)hqre0>EPMx{?TU̱"˼]9|DTSXD;cOkK&fYmr¡9Je; *r[\{l}ddy =$敆h:"*cj _m$u> ֆ}_uǫ) = <7좕,w:s1E2U-H{CZ.–:1qtqE\5%n^ёU%)Y[d{IMmnKy1y3Kt%-~N:NY#b- pjakgа3<o[Rq#ˊ6 sCs" , F5V=#IU^2;P[g ~F9uɰǵ%e>x 7'@26bL%": >ݳ|`ӐkC]+<I*mU(Ak#ȜmOhĔElJ}3I ,{L3 D@ѾNXjfHś^PD ȤHGhChinaR~/;TYjM*+0yƞ ')AO&j o\5l 䪆QdxGA#ojQxFY{٪"QB?+kOd5lgNM)ӉGIZ[rusqv< IHEsXv"Oh&H1 īqmJSȳ- 7Nc,D&wclAH](+hꐕanROJg=`- >#Q`8ʜlV\նnn Ҕâ~MGnܲh۳|pE#C~OAajڝ\+!lXcMoM1(,s_j uPbr#Gi'2O RM1uCR WFcZ Yc Mzݥj3uNdx>_޽m,[l gtPPh ~fH[̄"(`& 5MbshSvE+L7c*UW1wSE*qEMΊZp Ǝ-;AidR_jǠv=1NZiX膭}{/ QK"K7s a ƛ}NJYwẁu.y8-s4WTg6ۧnRkא9;VLJl@̥$WtJ?mLO?:rÒ̪ ֭dL}K` a[lU1&w0KTu K>eBMmv`{dZFٽ@\TPXgeBLMⱪM$9 n5|>=hd녶#uYC_Q`Y-1EB.Br=ˎ33}2yCrz|t-eG"HfѬ,.:ګ%+qt! K(~VR\JBvW!wVweAdx7~T뷥CģfOwq8[2"k~䍐3\)ȉԶM=_ͲO}\f!z$s%!!vrL!׮h} B#kX>eP駗 Qvqvա~XدI߈8gH#_7Dn $(W B!l fʁrέW›= @'܆QT}G,o;y?GF\.2}k^`9 =wg:R#a8lic~DL]"j]h6/&8774PeA::΂U}T`8+}96,`NTxeTr-DEIJtK.!c'G& K"Qlnۇexy묶w7uz]q&kpbʱhx-l]RP-0v1chY |zFm:Dń^,18ZE*tg˲¬:>iLׂ>qʼnTז?8S+ZiMY N׋$y|[Ңk*BL۠_x}:U>q><~ʞ ځ둓H0(Va 9,jIdC3nU񶯁47B {գSW[OM83 2,Vž*KuP9xTV3ס8f9!"g0|K-7qޤɋYޑ S--w*}+yx&.&[O]3:ݩD |mkyCxgS0Bk9B\Lϡ}VikRoq`R{Wtv@~߬"98@lj iaϙc"sEa!wm+xdo,gJ"Z`\e1ifô87!6XCE %d/'+x,)1q=O TO2Ҫ̏hĭ@#}P*532vvR("c3ם:4C[}tvTMb=c[*WZVS b_KM yQ8-D^A,$нOE{:{:#C7&y{ڻ:P]|UtP 8x1ZILզ:SlN-z/$>(l,R=~KOaHjz9&g=ƣ;~ x.r^BSaпCslч4o.Q%q? V1N6¶\(<޵}Zv_V"Obws {%tyd4>:뫤ŵ{yŞ܈hp}Ӛ $*e Dzc:e~?LtGڥUWd#Z3\ݾA}?"9a U')` .U, -9S^aibi{UF}DȚ'BbdW.L=$ܪ"o"87?IV0\68t ;B[T <;QͮH|O1`5 aC_U;2D&o y Z(ąt-W oU w~8mc8QJLE@^'#$46ܓv{."(W8ԀgS!J a)7p8sLx3Lk+؊x_b㑅*`w Sn[\`樚[wVnѢBIvB[%1gXdTǾ]0Ε-l|N [K&4*]U<>Ur|c!/ȷb b=ٜH: E=(|ɘD( MHl5`B^J[5'ճwK9iL4i, ʢؘ#F賓Jw~tH#uicWڐwY@]a{S~ec}n&J.\!1L,Bw L#`_ac[Tԇ+^)hHԠMI{]?H8c(Ha::n%gń9uWsJهT5DC0R~o7BzJuֱع$PAL峞7|uú)i~_%lƴ^ׇZҔ%5B[ X]PWhbQsk6-k֞ݽtjV<ul+^D"D{d_3cu%f&5pjoD}EeljloZ) ju#ĸx<>bhȽ'mXʘ֝-L/ՃDK7pFPNXg(`z*9Ǒ57fN>ΧA%MgZӔDǮV+Y@YiH L5SnUp) zy(M`+ vJO$6iH*~~f AnӘyg@""BaӔ9Aa9Q] eݢU᣷KLGCR [EK%Jgen I!tfi=;}_^Y Y ٽpH}G??Q.)*2,'G~J"Ӆ~n']V ڲ*{5q=MUzIȆSw5&kuQWA_$00Z==1sNDŘȒśPF)JbqXmj{;4C#Hߐ>HLH-ŎK*C| I: }p~ PW2!>ԅ v*7g$~\ib^*<㞏ja]*?,|Cr}:7B?pYku%X;jw=cXd"fMSt=7#j`?1ñ,l7T- :N(ٽ 1^n\\x [dKϢ)11R춆 T2b7{/}۵eŬ |b~GT?z2`-+ddjlk-#Z *eq͍ 44mgx$P!K(d_+|* 8 2LʜlP jcʑT\^6+d/60;L },7?ߙ J:(n!2)FUC/3RfOi4~7`=/Ԙ4oCjd8 {QX W&3O蒦`irPYP2c@A-8[U-E]%]5X}Tf?p,`7TuڦP:Sh3_.uJq߼5ak)]QAGJ#8Gy ,Qb.̤D^чѩx!I2, qÇJ\J2qIi/gA-~p B;  TZ @ ~) l,܎`~, P.'8Y8a.}ٔ>-;k5X!cwQ֯F*JQbE"#`X@O%MwqY1iN96/8}U9O"ƙE^FoW\wJ(>Unbek3IN)6gڙG89}=jA҆%>@N^iz:\|w Z! .q8Z ]dh=L~^6^< KG䋧)%h࡙]'Za{]&YNiT~G!Ta:̕O^MO:eE[ 2rxRO^ҬÌo8e8|<+ْ?AUnd(a0" `E\$!*cM mM_l[Fc(ܸtPaM1XfL'^Ӓ ; ɟLZXngG̼=l4Ҽ&<ͬXB<43jdz%%M{:-EMК:6 1 _<(pO/H,bQo-<)4'ۑLc݈7V65Hkt>VWd5*Y$n0`4& VxڭFSqjaTfZ&<Ȍ 짚70#Բ phgzw7;yٴZ}V9r^c.[j1 YDp7vzk!նn`jvx Ͼ=~Tڤtiv"%| 6EGo){JwGp^6(աᰌ;4ql HT""F-0WƽdN$譭 wtJpdD-'6PN#7y5w3`xxWZS;im @>v}pR(ĚoRZ qZf|כ}hz[-Im<*g!{9I>v3v<́m`zC _3{]lp@/uZJ_Mb .YLn}X;2A@.MD/,R `V3p@G&jD@og[@+m&c>[Zq'yti<ޛ;?msXukVJNQ;j',iSD5C}捓|ُxKYt`24v#[aIv"'>W-?qf5g c+͓Of>`};ӓ}a >6^r37‹ԯK.0-ivr!k)^U ^p)~!}zKnVKzwi(Gk;$Ѣ[{Xrv~q:姰P{M<][XVP&>v./# e'A j)c 1ԚFc=8h'yj2l Hǎ[ %hHXo*"'.e@<1l%%jrAmyՓX5$;%C3, "ËAbnD(zPg NoDfóS u밁߷Sbw27QR+mgHC{|mD]@s8%=yi q d)x0oqB ^Lg0ڍ(H7JHϭ]!i 3V !, FLֱ&30)-&[kR$$g7ƥ:Nj\/xˎ1A j1J 21^B63 xEeA~ eO^k] jQ}zi8p0ΈPMPc8H_R2`qKޥWpAJaN1>5cgNݟ4Fʗs0tC’-Ó@ '218-ζy-<! nH}(l70w' =2>+:ph ήɡIt  7s:W1PV-7HLGUR?~%gHi3 ͹EC*vXkh6Zskms_MDo o3\ٓ!46pKN#?b|?º˰i1Cq=Klx)~#k:e{1Iw s%EP%[3RcWul#OC/owg]uP5rD/A= >N}>w c(0Ly.*~yfwjQC׶lڳM_yi" j-{KH\l.Ѹh~C}aA*tg.OÚOիҾ&eԏ\\FXemO+S|ͮ#%w@bDztI|P%EaeWh{ޓI ]cڲ1DY.Pl,0m"9XP\ YΌ_4:|ҿaD ;`p9 %&lkxO+l^­@"+(ښ@#VH~ **o Г^c (!jCL$.N}tM1/2%fO/pLͭPۅԯOPGzƭPI: <,oMjHqXEm] REMWX0_>օF@pۮ c~!ºRqZp  59<6nI'1=rq:# |kiu%=3e='oj=~f~P:T98Bj^J7'NYhl"d%I6C)ͼ1Ԇ8 $TYO^EF<#1 LDr82vmA & b#Y)S"-F1]3w#Cx\ ![2#oARP*qcU? lcV$!8gUi՘JN ڀ x PMHIayűϾM_AK>1SC0jyů0S .ݠo j {x[O}ɰ{@"}3%`ȑ|<+iǞ, 9 #E9W2, XwJ8k،Cn;5#(8}S3%4\4[`:x1Ylu3ӯf:M gT&}Iٜ-rhWuCaK5EC(<_n\^i*ٽT:;/no:_X͉O}oberH1;xb2}OTPJf<,aRՃ&JZ#D7nCmFD[>crrc544B@Eիn{?XB@ZU@$^~t*i?i!M戰u /2gdpnMp="9ud-< @uYK].h0U2'HkǩCYiFϘIq8+ci@gF8{Й2'Tjk Zjekl4lTd2kt &+LqзMxcag/EMhobkE[鸋? Glzw$gҤiY(C[Sպf%R:4߅R< Qeb1И$cY&|(SŐ#c_VB;ZMr ھUTwVrɉ#e2ȡ#-3h֝fni;dDQMGF$=OUɬ:xJ Ho_-)~FQmx_C*1]+`\%xa#BYs lc x io"+kl:̑) nкKEt)A4Ӏ9]XGj#CoHε]6^0Xn ky71lPEL ^휱BfC;HXmn#;mߒ/q-#!=k̻q@mU9tv ܼ3`eY=OqTDͥÀ,cYniy|JA+:rGFeo{)Kal] v+HiKn=ՠጮh'|ɛBS` HC$O{(2T8C +#; RiT`6cDGZ"!ű&7:_|vl bGS\|ZZ qVuجXTi6@ iGK#eE|vJZ#,LbkiH4WėuGf[q& T(e(N9t8~8؉7 oݫ8o5& P¦IodrhSVJݼy;;nkTl}Kݾp]փE:J?O 219&:` qW4q~8c QQLW<>)w]2T'ֲa(/]E7]7acPw켶VmrY y Jv@XdiŬ 3i6 tԻojd;&bpevK<%7l5&o(DcBȔ+W}|8_sÝlI0Nbs|/w45Iq:!\ t `]H,5@쳦difDָ4 9y;ZX _.JNƮԥ'l~́`C˛'Je*^SgT$$Ptu(G$-I9|RI2*t\f$5@ 9oEIM?QQPJaGB5i'@<Z|D8AtUdYĭkokKhE1H:FoPGW-J_(fQ]vj*QB}6#]ʅܭM$9.=$U g~𑾄)/9 6} , i^ ǯ:e'e{=1K);ȣnݪgUn )_ D)Ttuu9;sP >4fjgV8Ͻ~oO[Z&|/2, ?3[g} P-'(oXʠ8cc; `$rZv~ہV,wa:. b:z r1. lc*L$Y$Te+c͊i)}% hU)֝ ì2u7>෰\6P(rx(Z2ڭux&]ŕyRhy~BIkW`ݢ{jGO%t,C$+iT=}Ycδa EoӟxE_tz )ͧgTpZX@umL7>(-ϡֳHgޫ acqg$脥)֜Q#o?W=TzDc])/#ֿ4'7ԯm>>۝AHoxI1\j?э?4>A⨨:@IlG\ 47 %罽ɺExٶˢY1zH!YБ#{ێ.z&LD Etco%uYʨdR{aC^yL1/!xǺ*;,tSF][ E6_[3vѮP7gdbL%?1cn%VWl[.3l+"NƳCk2bYr&tPF QyIA]ؓ aJU+!ms-ndhO&*(I10(m&Y{@igAD6,wX.}i[ kFɚsr.:x6ǐSD l= _ |dTYYjɚhp|޺j ?M`,eh,l¦mftPnir<d{ CfOx ΨwŴ nn^@B5Q3=Gj \]W@(MgvE5V?{~eV6+48|}GNxv igrODQ3Ahy1_ho;FyLģU5 _E2&2p6SnHk vUŪtZO:Fv(GT2PPZ-I+j9QFM~J:;W{hi=k=0 ޅ{=յUSA`bѾ+ vkaY\p,W=OlOL{[!/{׎b檂\ʝ#Ŋ(2% hnBD a4aOc<@:R]slSww,/ĕVD4Zۋ1VY13lwѮ6rʻӗqD |Z$`)/|2[S9~&Mrzن2UV=D1.?hrُe%Js#Óv碬ׄFM`*a`haP/6`eNx"9ԃk{q@V7C\klR% 46 9& sF Gb"D ~n@RŘl-x& _UB Q0g鵿!ϙ1·mAXH5ɟ饁P%di@U|3B~vܮh68N?-VO % \pzJ:ҸóS!*@܌%ޙye#ӚzlWHs-$u, +UGHYExh;`e-1Q0̳;n;>5GӐD=^wed]aL~$>);~m]GU<߽+"6{Z6k'8%`/DI4FƷ$g0ay03ibR+; I!){ܧ;$NrviNJHۅ1FDGwdvTLC_{7MdBDlOP_O 쵑6 x[c(>GD$s?`{:Oze1*kPūΔvTHPK,jNaJyQqCc!;Cڦ0XnC?agrro7%+*Ʒ ? Zfv8碉%q:9 ȥ4)wO@ {6b DnO3H^^Ǖ"N~]m!֔03+C DmW'[ Т@bh>%hh'bд_Bw=ǬH琄'vI61«Jy.ڃևwDS5m \շM2o*v 3{U,M "kI1oD ~d6~xc5mCn?}-;,Q xm5%!+(7`J@CAĎD;}+X950ȺydQWب&ovKבkۤ'. lBVB@gնq0ǡ;n=BK^+nU""Ÿ%ON+V4 HPCMs Yӛf^k nZIa=6Zgd?ٟ Yn4\:kNϖ:`:~ȷ*2 }W(Cغb8@t QZj3)K2b  '9& (He?e.ȥ7{Gj|..h U(?l6tp̭VȡY%x0b /ї W:1wVݎ!$&Y<1a,K†bdtG'axD6D[e%3)tcd*#$"LnȑR/il,rEhh\ņnqSׇpIv]x:cY+b:Tm#=Gɶ` ~(1Th +IHXЁ={*# ނL`4?ÑÔ:+oh -e( dY-{G \K~NaoQ_*/9/jP.To`Ɣ!E'٫0bG G^#wF.)E}BXcYNJ N=Ɏ PxJJNuSq]Wy:IzY;>mXc)&kGXY@!cء˾r7w_jkŲvĐW@.m +nX-龺>U&FS~pLC PKlzƊ{?u18 LlXaeq\Tn1+:bX |k!:CU6VOÇalrxF5r*vu /D/#w1t2!!"3~yUZ|>~#FR~[H&p]Ue``aB<b:==leſKڕ;irAXi.̶rΒG<,8:oBPY~[ו?u 3.' .y]ݱt4ވCD|Ue'ƉHEdOg~2:5T)ےYX ,yg`Hit8]RK1aJ9Uz Mf"G%VJXv܎CDh>,q _Eq \eආC.;"c17>#ZR͔x;J(K5~VmO];O:ۙcc=x)XUH:Hu^.})Qyrz:VsOGJ6 `]|Ć&OX\AW 21x&$3F8`񒧢zpyԅ:ŇÛyDsQ2#^}`nc)kROLt=tavb/*+^ j9v}>dc[8 ٫&uD1.}fA@\Aœjc|b֍rD)PJ k2{*YٰOO\ i>k&0}1>RGC&4H> nP.~( x#=*U~l4>t, 鉙X͉tø lLS.@ЉNG%L ?lN˦*ya /4bR_-IpJV[$|?$6Ͳ0Z&A=Ŭd_ >Y+ev2U] JU7"Ӧ7c+x]ݢ솺&>ʖߢ>mGDƄ;Xݩ >d<8,D:yi;A+ s@8{`xkIP*vzqo'?L*m Lқ9I=nzf n9`UM{ q(<*8r,pNIP=!Qr?u+$`;JӁouCйa<~ =&f5.ߊqL-:_B/7]BnKEg"n Yd*>Ov$Ha:U??hc΄E_iuQbAI ywgeV,ROk=?W΂u`# l3'dȈhi}1tEpLmgFds w xfh I$]4b$Xdq ?Q57&& *]vUɗ)xo幂ZX'Ao tiP]luiU!ZnO៊M /gιNQܷ8mCBv(376lI^$K9"ƛkH25w ujU $D JC?F 8ņIeí z:\2?5uP|kS|v$ᓹ[IPt&9 c !r #B OW&t.;,{4>$Ug 7K1c"R{uqy υXJk3iAk}?v,6ukJ`s1}g3pGzPE9e VOSZfLYr7omJ'#tvCw߁:B(.µ  N;0g|9iڂho~Iw}XafkYNpzđrVP9!T:J5ʷD^$* w$w*}y oȝ?2K ~U- ܤ(22K K).4H P]#"'_.`>`=)#Tʼ_-W'GEI(Փ caΗ?`&$şVD 2 cж?T2{O[X=iu*\5B&QY%XBDw\LUJ-Ο O',B/%S /~}v I˱{K6ա =?#AjZw0 Y|ҬE La:-]Oo-ہKR8J> kRB<U(KO\[2d6/ ͽK(>W*h} ǸDOk5,4H;(J9>.Qꄗ@V;W'bNWac<'P~ gW|j HGB_s`EҦɁ"gSORZ}Ӫ1x }#d },TY>hF4)G_zKeq|8 ŚFVNl9T.f奎 [M|>(K@J34?̝ߡ%󗽚iy>*(/p };I6W*z/Xgk51)߀ Q$߭'0H2 AVyv3q\VR,9qP.YtHg_Wcm.S.݊maq!fnT-;U=yhfa,6Y" ju=x*4M@cUQ.ss^"D¨kaq&;JY~z7 a-ѣ'#-xJo烀 .9a/YA .p7DUvGFIX~g]#XaсsOQ1$\4lTWLJ_CApyBȻkTVCvssøs/ֈA?W-x7gs=,ӋL75Z2ftk~pU  Xn=Y(plˎE~y "2^yW_s28|A4d|^&3Jz&}{2IBQk[[ 90Cyk&ϣ6-.~ܨN-_`5"m!dq G* 3uiG=Pqr_D [ ѯXTgS7QcӯX\b"]:zG$kDJ+d@)> g{NYq'NaeS4}{ FN^AArfa5vQCZ>#'lQC$4PM{ F Eg\.kPaw앳X1T'O[IyL8v3Q;tg> -L`P]h?E\¦}mn2NKFg.'(p,A _YT]ĵ]Qbw.%+~6k'{=[. IR$ 5&R%c|4oz%}" զR)X[lz\\[‚u=꣚+T+=R 4ބl"S 5H\gy^A #xOb/!f!ЌOn/,7:P3M-7.0#gY0C7_[$,|p ! ;#޿&cQ0+ 5yg?DD݄{a7X}CO臏MKpj[Aڡn!)Y:xlw'~Ԁd$kJYA>.:mK-Amc(6]م "/'[[PqZcd#A+ŒTb/;VLhPRA΋ni',#pKCYll:Jy4;LWy+_G9^8oIAxv۹>M~#M3\г8?]d@R xRbM_i>L(Ě~>dcQ!M[-mJNUT'RyTYƢ c|BVUջ>76qb fuf"sy?802x?AUl=W> U!cBwWx*:UGchׯYi}13LhbP|! Ó IsE-ga/pA}q zJþy6#=?lJ*$ՒZBofDŽ2:]>%ؓ=n}B!(׶UOCW3n`}5w vWn(%DVmLvsE 0mDK$Hre jAG-#?~ Z[WmE)[_Ozȳe<]}@y5~S΁ ۨdc~O >|lCYTeA?{f*T TM/X/ ݁1*o\UMȫ`b4Vt|4<Č 67%*kNbA hhU?vfrs w3FjHQ<0fp :ˣ]|Zd@tEe\ *N J)"pcJp$>ʸCk =K=L|`5\J ܶxzήkGeD"mtpOQ4t/8PR+ںܽjUqn/vw.!//D>@p~u2AX۫kљQX|K{^3#aF:ڤEXzu}HtK6AZn3A,͊3Y//-,[')37;qUնֻ3{_XEVxX~c+A?6ۅO4GLݗ0aԃzF[+: GY' eTc ,*|LkM$Bښ %& +*5Pδ\9APbBΜI4Pz(2nZXJ_x/Im -qam'-nX,4 1]F_RN͂5k+0ϳ_ (l+5Z]UvlPT4?;k r|M[i>q5GSnfx nӯ",UO^ ǁZ{U^KX8|?+6z]j">H`&aeL޶G6׀,(F_&Rjɰ$aLj3 '%NkbZ~X+dtO滄7Ho*E3\*kxRCxC~Yue\Ea~Tgr,nåY.@ bRCԇc4,?)@GWږ `uiA3Ipp0^Y8 rŊاdX9=ibj?Yz0F3uLKyWӻU!>j ](ېܬkxUPӽq:gj?EO3k{`$G^jMmɣ_GmE_M +"XL٨ /1ыsg*7<2fb2 L$\Isp""JG99ޝjb>Caqa1zL,F0fR^Rsq#[v~ A.lqId a$8 P긜L.-Gϧ"<5~u0xg6Y>ԙcM˜(OXCah̯x#|N{2Y&4zBnZJ $kOJ#; D\B' ad ^O ZBF1LWGhCB` br6ګ=?;#tuPKJуCV&$zZܑ"ŝ3u}7"@p f +{ⷴ$g|? ].ꊔg:W~0ƶ6QrhnƁoш̳bZ `$,r<]WxOlX8.4!U ] u@ &#Q8ѕq,EI$C5҄w(8§اR=jO8Am?4_:Nm3FTxb)=;3PDG&hJlCl 9mϵ\E Yj: US܉Y`GAX ^.NuґvL$'s>opN#.kN/qJ"03:^.fVPxQ F-@C 'M,hBλ( '_J=M<&J rq.Vb\6S?(*~͉Mj" )[J7y7(y;uR?i4 WB~0jVЀ[:2UnL6G|:ov70|jyY3)g +{!{QR"h!,W%z`k<ڳ&|ĞX+_xkL9(cĒcU@#H0Gu^ВUmEWlcp1׍* zےy^ qörv.OqZ`e.D<А炮" ;6F$ %2K/&_r/f2Q(Ti4E!WĹ@tTH05+ ٤)qHxU_|{Wq(4sۏ -7gnP;6n3ܖʆ/` J3}7ビ󨙠Sq˕utw xBl *A@p[A1˶NۇiI?El)i*DϜ.AJk L zꓨ`t( %4t}P_zt+TӍp v߻QP6[*%?@{as`y{3gεe袊*}:{|iKcy tW_%Od͞ي؉!C|0$OЈ$8Sܑ`Ahgpt5Y7|յH|iɢ7S50o~{YU*Q4>"8*ة`l>߃r!J,gJdM hs 1{)yM-Jf ǽ%&v#57vDXEK25}YoJ+ ([UG&Ik6„xl܆Q\_/4$^vWD]D? #=0$|1d)Լ˼묎ƺnU1Fq\oKp| .MYaz"wF3S,J \iqz7IzҌ&ݨdz#|{c)ʏ—eR W^O qp ]۸}*]8R'6*x8{,2zNGgJ誫yHLY,in;riAacO=)od)Z9/9"`j?./hOG@_;GE4#;&hCtvT8 ŁR @|44|oWԎڝ VJ=Ӈ/IZXCl >2~dspׂ?'(؋NkoOCvr_ZzYAi_ߴmв?[x༰,Bذeٕv499Hr@P u6H +ÓEڱoЩroyLŀƑ"ܤm+ź,>$q;/!Nav qwb6Y 0=@v( 1"?NnGT]Ϲ-W@>/#|;V8عpcmn{!.Ӎ-}cUcF?e.vG@~,p=t#;DW!3A41bxOLyEš>.| 皍H_> BTC _,Jl,CC*0]x-w2#ёzps{p⺥Oa5bEQ= շ ~]lβ75i~Lw@V6LlzU gzeP*s-R&ID f}a @8A}#Kctwpu L1e(ȑ 0Sec7U\!ǐ|^v:֣3DЂ ~cigO'czb]XT՟f47 9eQXw 2†dA6mJ~ٞϷBվy{<^ ΫW$Z3-tyh=rEL,D>Q뗉qQ\!TxOAߩ[]v0S'})p:v&&"20z 8L蝚:i3V`/;4Ѐ_wHPŅ:N`NIV>%l8ʅg9tC#BZ&dٮTGm݋}fHdQ܃;D l%_+j Gk 9e.N2:q VDVrp1e%guc:OI̷M*?>곳F,츝eLxd0"lP/262H7ƒQ袤bÃ^.ָRe. !\iL>:~ZywڑfA&_ޒAiquNdbpXґVƳ*=zѕ_0D:#mvd[ _X<2vuinu#uSIQZSXzuuQzSʂ"%j#dĮ]H|)ueFX-7a-`UJMlP8P[cB(Ek;y%,Q0{SH ku__>W' U>4jjQL p9 jr] R+`7~quz/Ɠ־qS`BUєpU2o$i٣`:~g,J6LEBI3fc, 9QEBd;C bn :I蓮 飤M4> oX 6ǧGbhJc풯̋Wh3VRpky&>&DynU_V|/nSY'mZʩ2c2WҋbT"~+(F5`WV>Y*tDT1(v!1klL(>1 "R9PKE=eGJ%6|^fy\`JD7 :l=cSV(kxBx]W,3 K:IKQ3j7tk?}k8:SY İBQגqon)ֆW3Y4)ݬ*TIRs]^Kb 6zdQڢ\9!_hp+&"1Xw鰲 4Y$; I(;'Ek7[A;QyP=t0Ў?&J9Ι}=a^:LɐU}T=Gw ^ ^}>P5!8u>E-3YҗwH]mϪ:ϏLy4q)sb f V@`GcH'ĂLY[$d?DرfިSls[Ħ_g;= "+X3;mףһ-9ur' .X׵m/F~Utf4jֽ4r:M GWZddjd>. d x@o" Xw20L sKOoB;@&L5|CU)1]S"Hi $S#[!3jղz).N3ٰƚ.{cߠ.h K|; d=À0ky;R͊UV)j/#Εu;^t*賑"z;C-!t*~Dba$|p"ݜּͣo.5h. mPR_^γ}hhA3w21a';ܒOdV ^4kb4 Kl#$k;_9tYHpa3a*PVZq?  C9:CU(60-uʒ]@5X$%tsUHD>JXl[\%(f0S4wqkM =`ZTf`@xspk^W6V&$/Ra]>=TO(W4ۖIbd\Febzj$?|w6QӦ y힥rvˬkD`'J+X W|Q)v" nKsGv6Dowq=d;/O/eFI[6Ի +#vRyt#x>',-L9Y6ؗ PTB.t둓Xckt":Hw5cIڳ#JzA1f5beiw61C9Fir/.c<%jH@l3HDl"̉v>az*|BP3'ͨDC-0UJ=Z|nVŸYUЅNﲴ'ҼDax ѝ{e_! !O[a3GHL Bd}_>!qG%JXiyB̆+#GnDZt9P[xj0.7,GSO<~& ߫km!*3zArYm[0h껨,p[k^'/rUaGl7Rٽ7:+\jq`k?i[5ٴۈ|[|Ug-5Dإ_*7ےI 70 @C.6 üp>;tyx`nT_|MKnD(~D=4 /1Y>7,Q!p icBzeTNG6@(ЄGΉ$Цv>H<)175_gof&nӄjxɡ {''R r!F>2\ imqcU M⪓>9i{#&=0QIh:6crIXqF#J8(a1N0 C'v3h? de d9d2Nvy4QL zAZ"=QLŏOߓlC_nxzB~ߩwH$x{BiouTq2^Lߟ?7vj֚ӀKY/ې6+ZyP2:/d:VQX4Ʌ™Mn7 Eok zW1F0_A_$@( V2UӍzDst ?1Q9pf-O]TFy= -%s( O߻,0PubÌg | π## Ⱇ%Awa j}‰!f<-V kkL~ Jh/8"F5jp)XFB;e5!N,X)su`[N^1ԃwCǨ(I쏎"/pSJ'/%>ΞsrnO[=s{7/׾دg3i/$u:ʅ0Hy[a^^ I!K +_T*<* /W[N%[GFFԨc 9li]1OiFvJ&8۔l{WMm %pD|S)@koRߚqdY<$W$a80d!jk(9>pbl*Y`b{в6qj)^+$5֝M^ux x 5puﭢI[VEĦsԌD۹S-ԥYݦ{2; F5ԗaXoXjT5Һ,&,K؆|ٚJ2t|R]0[_]| /w)F#)oNBHTd~kMʎU/Tb_~LTCugRNq(3HQП{A4yZG}9^9u}1 _)ސd[0;'рѱ-T8txӤcF!)0kJ՚ϼP $frWt^ᒩd,6Goꈹb^ܙ?oOݛZ⎄zZd^ i5e*m ̸KuC"SfS=E㘌1#SBc{[A[#R>\h6;A5$VM'Z-NʌvDVԥH8"ѼiJ~(Fh^⭩:FATR^#GBZA&k~ pȳ|搢. febSy??G }̆D4-v9#ܟCW(R\l\d`@r@+cfE.؄cd㋺JLaxr.$SjImEz>.H< m3If?1iGWx,@k(cyl C2t A*Q;=P"U;EQ=}#ӛ0 !>Z+Ĺ}$b~Yѿp*'ŎŨ9%Jfz!X.F\업5ց3DUI'.EUh'eo Xd`zhCEV~H&5ϐ<c CV{R;oǧ..juQo38GT"$Ư"hx|<Qyk"&C>3hn[p E\lf|ӄ'hWr5pt!`i9&Ƴe7eD̕46'Z*;d8;kUǒ(DY R cQkeD1xpV͂ƠW.*X<,p?/oKBS}ҏl)P$ ' SFrNX n1 6~#1 ʈuф~`U{Ny wNno+h!Yi&/$!xuN^"yaYcK 3_Sf=?z#_;@VMV>[mQ#Am)˹ET[rc ={;gY  X糠XC bv(9Zxc5v]o֮ 1vpoܴA#JnC>:%>X ]62mOGT(ڃ:?L+fꉈ 6[|8g#64/T'tNLN]u/a ^v}/yҭͳDf+)X!(AH[bvS*1gML]@ѧH'Z%C[b޺5k=| ~tP0QScvPGB6b R6)&t" /$>ٛ>kW}|I%J^vy7X*d`1\G𱐄rUIJ1ǖM {ϱԘ@V\2٣m\π"c){WnZahB,@&VLSpčՎM8KgE>/`P I"$MJ׆ `YtSJz'%DIs!![ `(\t/W !OFo Oz< ᳺ&i)^n -yuΡ`GټUѭuP!M)dg_,4kAG}N2JΡ'kRN$׌il<Rw JN\RE`BHCPJo)>Jؿ|MOWSz{լ?#CBKy_0"5_vh6mڰ_|NOELɁFj~͠x &S?7-)Lte*첮K3Ԃj ":ņ!-IXwpM'vOGDSn{INS6,(jn\/dވ>.wBJu,vUl[l/.)ʗ$tDmMCjpgnN-ǗdDP6kvl7#ntَy˘z+p~[bNŊ./o@9A-7Qql5sL\WR;q hW6Ob)8YGEƊJ;U'(0S:]>L8V#V7? |HgS%JTt?~Q"/!,V3st5 M2Gn#{GuCoW夌+\H m)΂7IH=9.iy\Ǐ{)Z!ec橅c@еTM<.sNk)o s~N8,B+ږu˯٭54M|Z0-^6sʹ]PQ0 ;Ƿq(QʊQQnRjT Y@WI>ݚ*iurA,l̶1\+2SB &9ެZ-YiDh|{knx;cWWC}&ON y%wsQ(n"+X$LK.C۪VBt)A^~G3Y!9z?(!>qKnǥ+VEc+z=ñpBaNҨ[i<5Z=tet7ك?}}mGnBzi5؛r@'C~ڠa*NFO2GOr7פ"Q ǟRUxל}[vRBǘsT[J@yM fUv%<6eŋV5W_{H:sAdZ#la?Z|y$wC)mug'EiǻENxI9шs yd(ۚӛ97vatWI`V3N)g;0A-B9oxWbX/ʂdKWB'uiC4!A9yؐ0fU*WҺ"76?:-=LEd J5T .eY%d,q@;B)^3vrۆ;8X+`?4L+lnѽ6@=5{Jk%[^πvrU=x" G)5uS8SQߌTaćzyN?pU]Ndi[)xE@x:?8fHPCM%/~)dpOY#?,5쩝c\#ZOCH<@?WxՉËʛ9/ƝLJNEjߧj0ޮQY?FgCOoRR?W>L_'ĀBi_ci. +u?9*$ {;tuE[ŠTı4'KE5Wþ~^<祗\-RPTQDI)4K@e}aO?>M #^aSVi.G~$v>>obE~vXmqQ;|XƍfxdhݩpWȘ|>}n)qF^L)#Re?Zs2ۊE~i&=qvh›M̺Xi`+d}S4IAolPkK'[XV܍ 5Χ^[FIكPGMC(._u|ǹ9 0l<%ÉIp.F +TavOaD>Zh -RL]udh%?GO9& NOvۊywΤ^idE ++Q+3xzA7l10/e6c5ZW Dh*dOLm}05A2_PT| Dùt.b\L#|rN =)Tmœ=Rfc\>hW|yV|Zp 8,}M@*yt/vw~rv5 ]B$Ýh{9b A Wd5`{{\)}dLeݒ_ $$]!.6[ٞQ(tsV' OOJ*1-eeg\6O㯽ĄG"sSЯHq}nD;^ mWD~Y84BIjΛiՁrlaP۪JxPYp+/;%v 6^$9$Ji^Ewp~f1mmN3 ?M}NtcnJ$s@~.=i6p[lg$TxUvi%Kd PA*1okl7ViF#n˘lQK9;lҭr0v ˋ n1KT=Q/}}?N0=!s\x/3 g=aQ &;.D+_l/+h$q9$ԝ -XC);` W>iDuFR೚9HB‚=LSu %Gl˳VsvxF zђhz/vi| B)б ~++=;`$&9dy/<]8\8w9=Y,dEboh{)( :&yѢC3J8oٳܹ2Ob}%ݹWbY2=d9VsTp(bJm905V6* i$@ QWzi %0 p><{E&iVɘ21Ɣ鹲F!oPx .=b ,oKCJ|;ʞA;ۓ,MNE=}̾\Ӈ5< 9_7AT %MYǛ~*u;>{Ik=(q 8Jk+D Ҿӳ"=Ofe#@=~֭ Eg v ޕ1er4U@cLN]O,?j/d,|I"L$Ls"#E\/L2UIp$m"{T3æ/j($IPifwxx|i :lHoEӐ\9U[PBN 8,5Tԃح Ji䖰*;8Of@Vgx'9V=wx=&%ӣxMHh6N5}w}Qyu|ޣy:ܭ5f$3("lpd-<)JUi 2K܃so9σ+ |eq<֛S9kp[fJdo!`t ] ڱ3giwo\gP9/r,{Ղr# y#I/JdZ'U(7]a-=O7낋T3b%RW~W&JemI{+PWo-!hz[n ړ~ip9H̎=q331SJ]7euAJ[[f1"C`V8l(Okl%ɐl0&&` Ҟ.kKʳPqնR&)jxT=(3Ay)Z LLǓ~>tB.IX?^`q}Zú`X20'5'5y.Hl=f?H73zWh&5T-d;W­W87;byEvil*N8x|ʳhSwe(T`FeAʋSoجe .dzẂxP.sU-{ɷxxpe %l)i~RJ/\Ç~yQl.Ǜȗw{cyb>ܾ4jM9'CN#.ߍ+&%${l>Aº'6*n\Շ:";hne"zouZ =HDo1|&I{4@C*||-v% x%JM }{d"6 \|e^Y/R=ax hgznkjRƄKfKPãrA*̢,FeVv1W~6MiM{}.w.͞ł_4ie>羼qs>zb2H#P:#0İyi?D[a?|71%wA!Sf:ض @[y`=cfY1FQ ? N)z&~ lcC'73Ӑ> w N.[ne&yܶỹ*V d`fuZ*YW3oK\Ǜy&iw[ V KwG3Y@I7Iv)yo~k- DӴ!Ě,SI~Wά`㽖+ª"ڶa,, S73VFCNPï&e_g!k :G<4tƠYɻaO:7ā/+JKfy)}aVF!yRJ8T t]maa '.ua7{(,3ֻYE3ծ@MYZ֜k׋&DfAS1PPa `~^.95cZp4,DZ֏LsnODh<vk&u⦣^R<w;N1) @> ( P»0a*{:A j{aGkl2'.&zv5,}*I #vU\P7P̰9(lRr%bږESh ] ps+Ƕ9zh cW+|oҳBhI=Njd_{'ZGJnBSt9:nj*If왁e@KH$Ϣy#n 8C`<_|ޫS䪻~/u~xxn/vF Yz!LvRoκQjz%L#>Uy)!Jĥf +* ŴGd>-(|/vZ |?(;- iC3uce1| 'ͭAѠ\H9IXH$¼*lYPQ|tE{l}78`eX: A1OLX]Y3NIe^h(V_~O,$ B+;>La-L5kK/ejbہ)J)k;.П98Ip!3lg.$Rs[N/nij6 KҺQ9V](mէw18 Ğ!GF/cۢ4Iu^:~%,`"ޮ&@WmQ$fިA_Y :'@?*c ͊A L\ {"6jut,CVU=JgfG"huU69_ê}CKt/\L*5+ rumFK},0vu?Lָ獁0^XݪѩJs U}ts#^O? 9#d1aiPS3Lʍc8T>!s`ndYxbKH>*]PY3R dQ-6C &躅Zy"\W_{G~ vs6(dtg$=G̩4mL)ESIU/A.-|?Y '`mܜb)V:_H[jt|[`ۘ"gš0i{adZ>'XC)V2{F@f¥I&l(o`EL. .AXƯkʭݻZy^FػOgQgDm_63Ӎ6gT^⟝x>qc8Y lzG8c$vaey%ruqzb+(&o,Q`∵-;q(;刜٧NU~Zq{=(E~7=eŒJ<&+%'VY:߆hr5Ib]uGElB^i )%hRKܖ[D%`%h3kVB<~}pT(R㼂l~\8{4%0hX᧴\v\c2e\W +d_,K 0[P~|xW0}pϡ*x )!l"5 DfG4s,k~M0Şv B>@+"yoӭBþ9%9=s{Xqݧ.'RA6S0+T;O(I`GU"8s]ZfH*8+QHvJriA3kTktdQ ^߱"\i 1iMI#qèBuHfS$eG?A^ rHT|RU] d}Dc{=R$A,)lOL9x !X/W(JytdDjgHV Nu,Rxm݋\qs -KrqrYިM݉m%3i :{wÏɵP\1ş:'˺;ַT(۷4)0ekEeVANM}4Li3nG('ؾF5|2{dz,C=<ȁz&wm܁vbxX%浺> Ho@i;CI@I1OZ?]ڛd`إ~ɽwIǎ9"d60hiS>D:U +0hpg]UFɰәx0c͡6 ڎvQ:Td ݅%-y}`X]pzeL~ip#"{7鸺,ԶGiH={<稃D=#+& 1ªr4x朂6B5lG! vk JRdTzͨT:Q,uL^Z8bHi,VUre/:@fdBM!AAfZ^}0IH &22J=dI78Tu {Ym~gtN /CZBLՇθ"Ms}Gy#h;P#{-y#$nop8$6T Q۱~ܭUxXn=Xkq0 .O !rNv.о$chEWkEu_ߘS@J%|sv WH 33yQ.a1xlGN᳣e:ueQa(863fiJ.ZyT]7͕gT,%8Ձsw vc{HbpI]5a䂟{%@m<vޓ3(&&z.Ĝ="/2rjgOpn%&R|e"բ۷FHO\=/?BHMI, O8;P0Q#hAuiwom#ks5E-=^7Ptr=ou!nwRsh(Ti )=v.T/-eMYm*q(`\fuP6On\nvp#Y(U-|sPU -&w3BFדY?=!iR-Fc E |2Ɍ?"Hp{{3<+̔UocO\ekM P fhYSl R 1fV|C@P%X{p;[}X'(M/TݴzDM84kJkۢga.sY'u5~Mc1Z;ZK V2S>?<28Ec7 LH8$; KoL+B=Dֱy{eٝ3,(iqt UuEɥ\p;gb5ES#wpbrxe017w@L(Pt~4ud(MElɀ蕸OoY8p4pUK0gMh59:~H#fԗ؇tQ^y>!  *PFC'庪* 8kwe>揶IVDe;Nw"j L&L>,\zk&;`8I_^Y$&G >z*,dk}kVHoyiu;̦6uZpڭyL3ݑl *{2汣ݶ G5`֙LQkx.gs/X4hiDL'%ü.NuPi q*lXFOcObdya@{?!VlS/dև)ȆFQ\Nw:Ɂl%@"Y)fn+j?ʼn̅EFn>o>C+#5w-@jC{/.)ț*jTf{&i`jE j9c5:[X!i:GjJ`q>>'`3V>kΫU[1A[/tGGK;^j|{&N/l3:5{!td%9Um%dyD8R15T_&!BW2X<k{&.$ahȷؽTgZUb`"19w0hwR\cy3P< ~j +me6W/5 ORf]pkf;|yBZ['DɹO@~; [j`8q!ՋEqeխ % "&| iʏx7L*(RΑT>zi% %R > tw~o9"J@?kݽ덆%y|UweU9"XGZvxB _QAe_jPWT=W`F#uL: a!歰d&8D$Bԟrwi <1S)N3~JkR*| >0Ais%[ՑVhGΐ`2LT !Jm-$q o_"# H, X&׋Ip2{Upd x?H74ᷡ3(ܚX5dw c`h?ӠMq&W^{=Gps[V;IA:X=5o4T{@t+z8@XRIXУKwkzxdi UD2?|JJW XS?exRrxau%x 8_"-S?CډT=:6^qa<8Zdճ 6:XY3K)r)0ddx !%Go,p"}:'tqU]ۭǵ쟌grRՁl i 2 T!sୃ.G ($iE,ҙX1?1C|Kt ЖG[Œ5|PDoOT@X8Q̡7i GW<7 -TmSimWgvcM),Rl!1 忹t|[.ڲ8q5zI.#Sʅ d˲"{}nFBnǫ,?Տm~mn`JXǜ@[~A lo#`kS^a5NTjTM0cK+' 7*6g4k-TȌw~v OQ UiAҶR< AßN+|_>' Uwm[g1aCc}r]U$iL%,`󑷾5FUM7D vPF r,+a+w]=H$<ȉ_T5Tc_>]kst]2e3C <ВL e'νGC7ꝺM!ьW7 PR_#wS*Z - ^ '-!O(躂hdo^cY.uk e%Oe:__@hx& m8<)ꉑp-㋁n|NE'é4/{RlWQ )Wp)ohF K+U5l<F f垖Nd{4V{™_Ep%ofJ~ALfBTR#M-FCfg/ձWi~M-%9ʵM_SWOR!m"Q/ZԨ3Gn\ ZWڶB7 tD[L6/gwl~͆XZq;rG_5κjbX =tR:Z>Лb= _Ǥy$oCj_D໮zj:⩌FR Yۣss(tp9nvlrT\o Qª}SʭOl`A+$WbAUȩ~7 ZIXWfU gfbSJIY _Ҕpc'0#ql[7Q~'}KAC@Y2_Sy%ƃ8MCgrUHCTʙio<}ϣX2U+iҝHЀgdUe3Ł [Ll?n<иh~5g OtjQVM i7ZX5wUCn[gQD֪0/\L16$S!9L 01ӂv-ߞ<\* F:>%8`!)C)Ur;GkJWb NtG Kз71K+nd0IA7ٯ!lMԸQIi)u戄*K.xj_k]"fNw=IE Os]aRzOѧɋ,nY <0L`4RþvtCv*!LK_tL"/zMc-iY=Ӝ ϑʡrN$I;WیH5˷B;H0LK?q?mPǮ|S&;sj3DR U{T 2,L$lWB"9揪\_N8ߠ~oU}nF[0}=*;e`$?0,؍ʼnWnL) aP2ՏRڶHAÞ1O>6EDXUJ}~ yV໱# x *C1H;v SavoBUaM+ҶcMKj  o4)x Z:G1&ŐšCbGg5i%aƸ}r\8W 1=ѽ[&CR 3jK{ pݳ;me~ZO _lVEFWqy5aEwa@m4 _G.d3YHaҙ$Ig0}1骨ECBka(a'I""{Px yfRӛw3ۭ-\\:պvCƣ۹ rB}(QӌfCCx弔6/Ԣ'y#ٕ/dl CQ_h"&!Go$4(˥#WA5#+K#" zJb&띌oK'w"{:uz[Q d9T$sG%&3xKvVγEmP0#P&_ ܕ:s<+ R 'S8ĭZ6h$NkGJ"F+C|>.&` \,#`yFMzwГyw"p@ ';LÈIha<Ua $+χxb+RjJƁ :u.R´do %az۟x n%]QBۆ DwVu)S2&71 &+2V#'-JXKHͰiњ^ eU.ङxZW|]S6_dS^c24bFSs?Y-#𖮺SA' :?u2H Ai@h$oi^ݔ}ltܭ~X#%P ikQ2}dH@>hSt|..D&.]m\͚ N#mdgl q尖9,V 9Atw fmq~Ҧ 05 DIK',ݞ2bleh6*auV3\AnY)TqSe S8usa88fa 5ZWqגUڳ%jZ_}VBJѕkT$mxhBP(L7t6u$ѣ:~hJ &^(5<*m ̖c Vtynf9jhGqi1 Uʑ@;!U?9a,W(N^5; \ ;rΕ]jLy/Dg%eJyddTb@irD)/'yrnϛ7 hP800qړK]Hr}{5 E%FAtp:鄦8IaqYIWY̪{ MN|:C-4 GNT$R(Y߈[<{QXg{Md+f@]CM3WQD>aPպ>7:TN& *sd!د~h΃ٲZXnf/7fF*:^im X#*|'V}vʔ'W챖\cI c_UL5 87YsMj 1Y*q v֍@< \dm"rp[r;̸ #h[ۧ2"{z3BK`-];e5uc n W;`ɠ N85792,| Ryp!R>BD@Ý_0\Eժ5$v܄'P ;Pn]#tZb/֖[ ސ:OF8ix&a<@:-%gxZ iTrRXi0O5T>*rv+ 29+!^H>ͮvz@:лyzo/F. qTLY4@)OiQv&tGIF!UY:|,ZWFJXzq6U^J^ư' zj[wjFӐܗ)S\Zȑ>0^<*_zLSV%(oLPʮBZ^ 90J8w;nOfY^z;c|6C_K+wRc3ĜkH> R,ddښ!KKY1 3UH8<9@kùéLĊ EMslʈ뫎g2qKgX$rF8$s0i&{A!Mo*c Q̟Sв&גÎ\Pn!ؚVn̲14ƩP<.P+RuVq//ܳq{]"r3`SO=_!M (gLAԙqTRkef"\5Kmȗ4OA"&^˔xWp8E{g+)I.ybSµI3@:=as3ta꬟4_9b 8ƞ1 obc Fcm+ _9E| uC6f_ FRc/OzRV> 2&<Tȡ<3dP ,qZkր!N+qش2>G)b;LjJMqе0u.PR3Gde'g4]5PWӣ(-̤!&jPmA㔙pۉ曢CBgE$mSa|tCG0A1-WܬJ=SuBWhyO}aA ӷNj9*ܽ$^YK/Pf(R=e0ـEtl ƎpIRۇWFDUA*$ P%0\>2p%XRpӁHNOR;f˕ VL_x^2X[H'?l~fN{@m:CA~^2;? XN]nSlM,JͳnO0 Dx)$vOxҭ'mZI7+ȳl "Kr|Hr %vxfkqv{:۵ t ȷ/'1å&*dacb5+Ǟ%/5$_vHq]_sć4.-hl|p.lbNyW.ct}mWq4!-bzLLRfc}fk#9\\D־zMDvd\إpQkpJuMldDs{Q :K H듋Phrw f@f_o(rJb/%LFzwu`v%;YɗM?!P~G͒<|?ȾfTDu·鸽GBR%kt4=]053@tzUi15bOߌc,Qt/d,s &o3hY"<9WJ|~.MU9Xp/-:?6sF[y$l3y#vY\ܢ*NR[{4ۓXzlA,Xg*`WZjuz%:Hq`r؛ [Zǣje\Qx $# %(Z nslI&yRtzYy$Z00Aad` i 0QgA'!&R.`(1q/ !_$wᇲ=qBcZ Y:hG7eX ]f-h1D Z:Z Sek#T"QBCj{N7+Ɇ-rGdD;ǭ45ω)"Qu\➲1r}(v-m(In a[Ιq#)BP_Zd~fU|cskMU&B=Ft_ke$g]fKX۔\g o WʚMqCYX3NMI(2 Ƭ{hOqXi 1Tb.)UV,Z=T#X{7,36%{K uF\/ttwz)XFVvQTJGF5H*$A%grߜV3>lω%2H*Sv~NGPN*7^hq\)GlK(X>Rn|@x*`5,T3 pd&7Qr`jjMBQ 嚪KY$TIB%z\?4`5ۄA5 Lrɣr! XC/b?%Eǹ[W,,nFK!5"鑕b͌V$h`IpG$ 󢥋5m(:>xU޸W?):=ǟ-RUHۊmkNvޑOW@Wy ͸Л] &ﻼ)Z`{Oq.>Ҧ#- .@YäBvR*|ܻEiTT AɴJOG^ޞᇿ vSLp}/7oBxl"S4{׼J\-oQvo9lf\Tzש1bOMP a?cհ_Y֤!ˏ3y8XEM 6IT,#LI!<0{+%('-BTF,jbKO~;=7l;qs;=kZ o5z\/9e\[et!PGI$XKz"p#a6@ Jy&c^{Uqu^T:݈Gn;UUk](ΐPVs.c Z5k Eh1~:M&@z{GQ/*p&[i /- ~axr$ht&Y2#mQQ yD#}Ri|g%hTK(EK (t2Ieǰ-^S;7 l$  >b.j4=?+2Y@5ÒLCLS vU%H~ "4.18_+1[Nh.9Qè\ GBv -jޑCJ騯n Y$yqs2}@$΋! 7 u=İcI 굷Ifpi}\ac:}au yP}Nj.SM6s8G"5ѣhX`l6JL@q2}=n(1h̒ۧ%Saz)Mj }$ oCCKk38o6T];Y`fNC#<ߡPؿ;c O zt̹$>4Xne,ǀ0 5f~UMj{}V>Qs_ ਫ਼ԉ݌PܕK$e:=ZH:5A5^rM;\J"=zhxq>wR\jjgp "rIlm)A%'_Ro{\d?xJ'/jՙl[Ok'YS_[ACn] o8W<"ΊmiO4_8v8|J-]j% c`a~7uzOYro_kAf[vS ܯqibЯQ+w/9o'+Z("ӣ]8?u1?-UЈΝcִ,x~>/+C:X|C{$t;}^XX/hbDL֬6b0n21am I 7ۡ hz `g gi:;/VV;~$~wkmK:k)ܸ^%Gs o>k[ PJc} 1ijoM,5k;YjԎ.b^7nR.$ᱮp $G֢dkDŇO-n%Lpq KJ kMoG09Z cZ&4*i =8:PF|T2{f]jϘ\TY[4'qoT}وw "VɺZs=g&_Gᦏ;>OkXW!ǼEPqb Ք[=(g_wy(ibF%x՟zbزZ;~Fm2.rx0'R~$/ Kی0J2 :O!U0vzJ$߀33*LO, #12p觜t]<`MdH`šR,b Q|eݳmSۧ l[aUe+Rhi w L+nbStP +'ƞpfc-h|Bf2'\Cn,"?7'>zY)22 Xi Þa0 _Yl?XTC&tS{Vg@hEWWd?Ŗ[ /ۋ YC'jŦɤ0J6JN}OI%U9- mcK&K,]QtyڅOy˖A?!ipsk R>s-fYH >»F\ ia^dl^kSUnOk9~De;*g3 |#q![>l@⸖n uPJDIto")-snu5!~Ӿ$X˚#ub{dFdQ&*`(QR=bɲ*e)M;n)9 D4ɝ9* l!-oMOP"~^8Wh!jif΅{szR#mu3IO񩠌ޮC>x[}1Gae4GV€]^p\MELl]'ܨ G;=ˣs3tluP: yfӷT/=peP[D)l8 Q@LVSj4cs@:f)6JipNrIb:*i5_(nUp\l&AE!q%*m5QjUN= mLR%H sVň QpEdJ/֙.j1J/"n Jj;\J?葔(c67Cn&ÅHZAИ<Ň(.`D5 @O}YG_$E3\NQ8 0ՙREveN*Ik84We`>!TQ H?:/wS #G}h++wR;XǾCx`ѦAF ,Ƥ RQg 2(F)(-(υN*))dW3q?ҊFrI/ʹc8o#}2xrϰj!ӓvV"3[ȉb_UN0nVJ*?1`mDS6FUÌ*iel9OX9]~ƒUkd,I-0݊dj z߽ɡs gDIbūXFU׮w d#A}2 Πd]G(㊍,b *Dr[ bW?Mi"K˩B{U>~Z{z06~oّϧzz+ͱ,/kWS~ }<Cs;5"chx_ylupᲵO ؇lwY7*{\:OAKm{@ku՜Ja Ur/.-{u ѽ.5_ k'.ZޖFZVG -/ H5å0;dQP_2>6KZeYIA%ϲHwɜ跻er[Uˌ{Wb((kw/lA2NwwCYqGMxR@~ꚪvUYŽ6<e Qu/zH/NX*(4tcʴۻ;mT -eQ]x`F)^0&Bl>,܄1ArGdt4[ڢX"(ڄF 8Ou>*5x$ssy\ o^- xA8ybv9E"o<2'^i-,ZWUi_KkGGT Gzxevxv\-+'#ݒ.(FrT&{wA ]OkeȎA%w 䍷. J7~4 fl5j̀ 5Nk\bW`QT|AtC:T#)&ƛξSNĂT-k5t Pɰaf`LaKƈ+<9O$>F]_\ kڛaw6miEc[M&w&nI=NG3aܡݎCBAF]j-Anhaϒ_!{&0āKFT{'8w@ӹuhU?Fl$r@+>`--zuy>{<(H3&U H=#+f$x9ƠQfr竍;:as*l{M;VEՎ 1s _S:9TSHgA;ik,f^}V'j5̵w.lS\u#Z6`{e'sﱲ Ld3ˍ%cOc2| *ӻa9=XxsȶA'Je3!F̡;DOUe=vb-*i5~2 Pw%+x!R(ݫ{9}zozI7 3~ /Б= UQ^VEw)4S-#L=6P&YdTUQWs*$Qdy %~Ch qB/#OAĔ"(P1+(\(*E;Z?馘iݸ'w qn >9Gs֮=N`qy-Q6*7YbK/&@ꉀl !HRA{#Ma(b ZQ: -?&шU%=GI 00ˎ71UR:vR:1lz4+Uz,Eq 94^ Le@~Y*DyDZq~;| bJݟzs@/6%h*$2} Z]1| v@o΋tb*DA=|w642xPxHspJ<6lx$F}mMD#DbAɡ<:Fyg?쨣X7ghjCՅ-@fz7nf_uڈZ׃U\U6^籕xͻ&6uNahߵcfxNZN^9Mqc++0"psIa[-%B췯7O.(9t܉Dfq$* ڧa) ʂnE(.?TՄ-?-8Aжl@UNzq,:#9cm&Wls:!$7Cȶ$:yZzsӓ?Bofs 5ũ1ţꠄ 42oV:UA"Y櫟/dP64]sK8t2Vx+ džSkXyաvj$)HMSy8TDCiQ&ȩ~5Ytd͢Dvz(m+ , (g_z'*/L91 6Ќ_d2axWJC0j2/F,elbFK=U i%m1+2[ǶJ(wA& շMI51Qh2Kf𭺰WASR[\Blm MV!+cEK?oywf9l.`vu,qb!I`ăT;f@<}umF2sͪR.yMfM~'0MৡR|Z$OMKOo€;jGψ:~u+=º^Ǟ_g֫$3ߗ/vb(Y: .|7^QihPY&3é h%I2{= EXMX,@yV@;<)Vi@inT S e!FvoZ7NON]D0 F;*_ >_:U,[o^E2_Fxƹ6suK<-uT4uIl19Pz*GL^WwwLyG1Fet>nVt[ V峰cK@(;o#iNϙVq^!"Lp'Qq"uZ K4졎T;խ[u -宎 YCմU8Ht)~u<˨D._&5qQJ4^aD)\EO~$S7@zo:'zB̓uQ<**pBl3E`}AvWPZ}nM4--\, ;7VT  ^+Q{E݊Q}D2-]lo.iÞ<_eJvV|gf<.3\a BhF qTVjL~\2^ߍ[x!##Lv.K/M%moGkGy~|o D-I'Y~KAbD9I,Qm2@j8Ɣڄ9'ӮM$ޙbFg$wmEsfFzOЋz-^Ӂ|F%eKH~9vqd7]Lgo;8w ޼%<4)>QI3FQcCObBEAې}~Vt̲%v\D ; /4x,FGnH̹x;\0l|^C Lt u"H%S]:)BeAD4ᢂzuIJ8gf jμח~TDEmqJ20S\\|rG=ke327Iwph.b0 l#]bz`z vRcAqʶ~D2*ٛ:#rK؃ޛ +-Cr4d9MѠH)%ЧN ZcTTDR;(j`rT,} 2- D*iâ \ԟU`Jh>^Cun\Ana@W*ܑ&\ z'UM5闩fu+[VhGu/i  +Հw@0\G|f2 bb[Oh0BYwџTc)B0>1=pg{ eqT@Bv޶d`SK`*}_BR6F&ۃ,{f RyGTGV,4p0xtPƯI"Qǫ ޶  etI A,5QIWCyeݬL $ȟ? |*}Y\hw"dD `_39ބoYăՍaJM$(FP[=t02s3;=KPfԴp]371Xo#Df"킿>S1k:/C|’KJNeQB4)2ʈ1<2f߿n%YC#u_l]I;@NzWqk&P ͐C0K:oSŽ_Mm6?DlJmcyNʁB&d7XOg2:xӫ ~C_"tiW%lV6pJ R5L&4L9;1f z*:Iux;,qG촪ZHPB߂(4w  y'M =J*Dv,7%)Xkuwз#-d_6 Rp Vkмq{psSѶzͱKXؚ[ ,J\D4$;4=&D~k%0[-22t}sHz>/:եXe]E3n]j1"ai*3YGxў.HjGHSc}A T\I^hA_MtЃJ#"C]~vd{lLT}2}۪G}+"5#(|Z4VFsiǶ< CfWiOoll_CJAk\Hv zTA424dmNCk#ى$CGeZIqqpKQ]Ae5癿iE1YpᘾvŀaB1!Ui)`~ 0Øϛβ&ʡL>*uw2z!)ZbD# nlȸE":<FdV/7w@8V}(B.h# *%I`BZEH,Κ~+i݅6/wLf*H΄0ڞ %,) -O%w\\Z;t}=h%M_yR8 TuP2b1du 5bfs!߄䑔+$`Iu=e9퀲+6-;og.QxG:%4{q-b|K/b`a}f6P{:W~[x&&}@z:a.0Ãb$> g$ƈ0XIM6ոiAoqfbA ꐧV-V3I_ȩج W~3r),jQ!,% ͅjO--j+dgqU!mU@$lle<Y:Yʕ{2_a2"G]#'/tb~%ZXN*WL|]S$-oZk0W~/S"S+7V-Kg!)F 1zO6ɜ)_>Mo0LmGK}mbD?@ >~b;KꋉA=-A˶o#ۅҜUM|{IHHq?Dn5\gW(2yy[: 'h}̼3p,@5(\u9{B%G뚷KJLptD9|mݓ 7 㑸Q*W%K;E;HFTbwUU؞.u;kh^uu91/hʞ֞o'$_XB@d=D"Y;ML!z4<rc{9L*aIRb I޽/7 0J^X^ǣr[78ռIm6y ɛ`kgqjN d~m\X|T~ ^wzaˇY,ˀf ty(ryi=_1z!:9IKOsBz^}]f[6Ca' ,T;uy:7G:fXxK5si@PjIG'YFF_+'~g}A g.`F-R1zJhVQ{\S;Ĭٔ˫>Zˡ ϽӟxeZ|85^\Ș\[G 5UF@my!s\R$Qح/v%AP!RT7OyO)Q7[MN]1- ytD؆as4PyP B񫁿.}iqXk OtN/sg>ږ.ʑbR.Kdg2Id}n?D'|pG#&oFUwnkF"%G[Fnj|lW@UX$uho/YyHnfsx6_Molʬk8l "iuM[{0r|Mӗo66Fng\ BAgڔGf]U+ѻ8l&!,|獫c:ڋke;JxڽR\fe@' o7hTO)7zKRP"Uj˩=\%hQss{oi;=DEWWzרּ̚˜90}ޮH|1xzNU3ޜlW/"!~ TOo,F΂*+͋wէEF;(ʌ.7^mM/. '(5Fs4L# 3 +JQýo`O Q;_g X>zg]^;>nVT Q+H\M,͸E0Oe8N\3ԨepYdQ,F ~p N܍/ܳP%yP|~j_`݅@PEbYgUv{(#_(%r#=‡hRvrx{WIAQř˦(spٕ>u-vUAQ}O*MB#= r!z=YaS2| C{y4ĨF81L[ "F8͋ ?}}5FVwT|l!̲Yur\pdL56 tnd'ZZ?яb8.ϟg;{W["\/ƐcZմWkhFH?X5O)}7:Vg ѳ'BVB4MTJס^ Ң /x>He&j>]곿~}9t #>C%$PH]Rt' ;R%G/jGi }f&{,&b)e$C`Қ=o3,V"-k&5hm3PaF*!yxԀKW# f͢^z $Չt hmzt%Q8`[A Tl9!RUlӊbv520{nE&Q\z =y /LCWup 7u[/{'#ktj">H)}v{u\Qn,MÛR!}3N^G3"NͰyݶaLI1 ]!fYpE?+}֜MA8 aH4o%\>Xwa,g*tjgaEiB[C i!ǎ+ 1'tP0|¹0%vǑ7֔'~DTNJ]4e<]OAЌ*fo][%xo%^ڃ5Oa#@^Pl3QV?Sf67jrjBd݊zcjjIp[T|<iC.MXN?z%uW Z}ǟc0WK׭3aseB%59 ;GIDFwFG="V0R`"6Q}9:2!-j9dhppBu3p;C%˜HVE'~J&^|Du@L}aڡ|G?&W*vO+KFwٕ? ꋂ':Dp[Pf¦"]sx.!&,9 #1U;d4ߝοB ꥶYE }d6.nCcrNӧ4XoBjM6_(S!csݶi˷Isssd\q Ay^IhPod$t(CBܛɾVDr;iMM٣ei|-{n9%)83X/e_S}U=.2#hn4q#.uj}mH \ݺ! =tˬ Ŝ^@4c6vk%re+{CR| W@>.n7FP-*rcOҠCēX˔H0t2 C%>R4a.g.QczS~dS"!]. H'IQ̳DL5rdHve!h.TjJ<\~-PKk꽊h4E?ֺ!_r嬓uU^tm~>mSTh+K.a `YW#vHЖxX\tv. ԦGգER,poW#,e) kk.8JZp2Pi4Su9M$뼯]U޻ ThCļBL& ks1Aw#f|lݴ+ }cg^ϳ Ӱk`i{gCo^+0*˛eq'vcbHFj֮ك1ʳpwpv9u1A15Lxފ}j tZ$nӾzC %eNaTjZ^鍣# u"a9,zd0B z5>(8~lI?̀0ki LIQhQVyAAG:y9"^ xF?@/PK|} ]mȇ54:r*=By!Q4aU8Id41su,DqF^㋀ѹWnM L)..fN)6cGzUeLJ"{#FF>=;-gI#\hȌh6>q4d{Vj*dUO^!F)] RJT>[3g *; \019;jNSv$0Qi1{T0Xʉ8M~~U_F6UG{oh Ry971jNovNFkBlL89?*Oi*E/xYfQҩfM T(BP2_BV+nMW,Kɤ>gYw7ݻM?9;t)' @h;⹹I?Ǿ& *rP$w֋P4#~t@!o`3Okڠ-jC鵵,1C'qݐ4u2gwP$ *VQ&&Op;7N^CoS;gpOYȆ$q'̈NC8ஊh T~dJ@n[BOG@sfHơ,uhWMpQ""0/90>fNbk]݀X uЫA*Qaz;xI{;iEm*vvb#w!-1ȿv/ VzNB@{}&9߮"A>x!E:/Z/2)c&:K^$>6ŪA|,-;F^ȷ2{Hj;(cHpShkYlsZkl2[^, pGLأ!~T[mUJ̰ ĺ:GuMB "VV1ve^| `T(,'G%)b3P7| a~^ Ϋs״>S1ZH@2#~83)EŕyTd&AY޽灒RWgRբCe@ᑽ'OZh3ѝGcjee[0f5כ}!$b:c.߹+LYk prWJoh`fKEQpq&oM Ht=5g wQ[J7((zp{A+t-Xb)lPsr)Wt(9l%J'`R'TGSwnOW>_I_U@bM)@؄4PYyS À<YoߞYwz.#D%NŕF 7Q:*@DM΀ڽiUBEc"U?&Pcky#9*Mת0 tfiAcͅaì2I"z U7Vt);Ǖ\/ϻ`3e_~{\+KGV5k^0Z-lqq7kCf."BS%]0H.5CMj3V a|ϝtq[@`@62:q9X6M+n" tei.¶~~?~m[0 }bfk)M$-/-FZ 鎒rJ!C#90]DN{UT\F;[܊"IF*! [˶ukW-qM@i[]# CaG퇇JAMwĮ]IIh ըA q6:<F7pʐX3~uc͠] OKZW뫈a!t/mL$ G!Zjk53SYsRkOsÞ@ۀeH#\APJ闍:l?dSu[faeSVPEC̾RiK43qC^1V))}e)e& (ܣ?ny7K<@~S~ 34+ZD84Fyᆲզ$] MнTO"J'@to2k7YQn-맞4OYm^q߅3Qk7PaWt7K7#UERGRELV (Afv ?v0$ G^✙bV&@rԩ%ʹr@u(+"Y5G2ƺ~C(Ŧ˱*oFGq[a*hzQL :D%uIeς`P:(}]V%Iv~-Z' 눮a$!i}KDeo͂m6r.:ãGt\ǚZ8D[ǻӢi&|# %tP$fy6;fӴ1ɔ{Ȕ~U`Սm:/\&ʂcDq 4^XImI|(?R0M´`|cM$jMHرh.ZZ׶|F:?:?BBq0 "!H(?_~=h:sWjO!oIO<↮'*t9:6 z6SM{aqbm)wi "VO`;菆( ǁG,*|NbhZx3OIǻPֿ0*1P.4ʴضRlBlue*-E?_4@kwZ"F,jtZJD݋%;ZLa>ϙWˉ6t[bV6﷭[VVn8Ӑ0J}`j+Ł & e'A@pfhK'{tZďyT,^`\^Hjٵ^Ѵ݄ul4d[1Z;Sj$ QxJ$jB*_D(7㹈FthU).Z=v,i98fcd?Hob[ )}zvZ8t".~20&fk|踥 ؜[['Q4`ff9.yNBI04ORկU?X6nX/bӲͿxh`777e)x`eUm;r-RX\%GHRn;@ ˄0|!i ؁R{f/iB{#7R֬7aLAا678묌FEC͹ *qZ=jq!~c( ذ(wA3& \yՓrێJ"- _h>DibL@)cG@].NCqfǰ( ,*X)=ʯ~w@!LճN} b7yy6h,@ѠH&_*NPg½grMS9%:Ir<yQO.u5)E['`z6حsE`LkտlOzb̃0w 0J-y̒iB *J5ҭ@7'U"uUv+ ƛ?fE3M<; eh|^( #x1'{7F?e˃ퟁ'%d-HeѵoG/Ѱ k<+do|f!\A~,h9ImN ]HOT!*?\j[mq<]Ec!f/UoU뉣~h?նJ/uuVͪnic֍3Ǎ6#}ǒS[rs;Q!;kֲkړO"c;hw/|s ~C#8\T?駑)y-"+(=O5#lN<a3wy@9_gW3_ ;:3wClI\N*ƈ@/;NO_iw3?9@w*_ )ʿ`V1TBw (<:UUm=.$@)鮀%) '7%j%>ƻY: |<=Uγ^QO$7εF4 t{ # 6֠jR }Rꯤ=nL1?IФ%ɣ;m%D]d)[8x?CZgj&n].FL^4~v%JA^*7 .J)kۗz s{ w|/I̶@Hsnp!pX xԚeD`ji15}F5ƔI>0ToyBHA=]/:='?`ZϭR u{׃mqgQ 饛P;-%l.y**LY ][ Uұ{uu{+6X6}/ab>?|}7?@~kd m_)'ᙣ [6j,'?= Y.Ԯ)*!eRf35*!L33,E3 YIj8[^X(z ,`r-c[%h,AC.KYᣅy{[h\ q{@ŕ) ɹ;\ C~S8 &z 0*!AUOGn*SQHD*ō2oɮ 2رI VXtn>~9k.cJ>BlX@Ry( T tQRvgz[׀AdJ;RJɪ""{*Ͱ]Ah ʳ8Ak=bOIJqB7OH}%=j3hK,O%ݎ﨨Sn Lz }]}~dÍH")|TجgV)†x@õZS"λ@),Csժ qd~X܂C3rF@ ҵI^P]:ek5'I ;.]j`Jr!ڐ3T(: l wٓan"-T?^*;<1[j {8ԧ5ʛjVL˚s'bzWcAURy{2CG9g{W,+8F!>NZg֣BۭdD~eH]h)],a|L4chb+Q,~gtZv<XıY9G\TeF*Ѿa>(Ie>)!C m89-$O^G_du.V %e+QW+h@2=ILl/>Լqlͳ%ݙsc+TͅheN\ 홡Ob3oyr?>+4e\Eܘ<)w4uG 5R̆3r]WMM]-'uWH]Je̐&S*ɺr}^vt"azx K'pFXnXӂhKcV].#o?k1㑐{x֣? .Ky7kRjrA1U?'*H0<`*dF=5hbP䵚0)lD`39Jgx tPOWH) yY oD>̑EF9eq 7e49KRCύЙ^SijbxaCk98|Q grZ|N_ '<L?X {5Q㔯_t.̌DԼ2ViLeIW_u104S%y<$gu$mEpZo3 WOBmH wuz 5R&AiEA?鸹օ2/[hL^FZv!>cM@ֿpW*(vH @3ڢ+JR;PAJB~|5YsdLf9\stBЎZeʊQi&f Hh"a9A>?i:Zk;K9=y^'4 I}路:[ m^EWm0mMlϴuJ[ R1_lB'DGѭ('fn+sAإ'VGVAS!-wew"*I3M7셒k7/-O0 (4Ψ\ʥRC5Rb@7vnMoܧqF"b=5h-/jmyNw6)Os;/bm9㎓M:Qj%~Od*t*;k+Mµ~DRΊŌ4b8O&-QD ؓAݬ 3no[85L k# YX!@xk JR6KB,LtAþ Vӊd+34WSA F *!]ƞraSV`$aj ^'RҏХ:d:\tt[-Kh3LdQ…@a˻\:=>̳/a0A"` jg ']n;\u|xðU ?M"e44…kB%"3|m_oQt~P܋YA `CP;< MWؐ<֙E3`c^ 9KDLE? kۂjE4T/r bFkAϼJϵ>ːO|E CdԱr`ј Ayn|DX}N(+xјʸH"+)! _!QΪJ ak !N׽7hrHgt6L;[1 Mu^iRE*י#^nLO*a)}~A@-u9oԡ\R\պ)`_S)G {7?::aFhOFL_e.(v"St7aY? 7b͏OѵNxLr=/~Oz^g; *ۄKmT궂:^L HRٳې/j;| . *Xr623XHCʹKB*9EI'{JNyZG i`)LVv[ׁte'A^X ;F+ݲz'> b{ ۈet=.I8&{{_vkGM5\^#}Eap\ W@)| 5ˆ(,c#n ~2kZI9NlV _݈'['8Źp)g\$5|u-p7mK)iWenxBu> ޻U &jMr.f"b@;,ge,>yiHQ@G-(V>`p3qwj6|+&&$k9+ نIU]XFAj9bhdO tvzhQ;A`g1 p{sFZ z[raCxج9 )L%1"~&cؖ* xA .%39i̸ OMҤXȦusJbc3=WV+s+ c=ZLfW\5~p]l8oZpl$c5Z׺W[ZLه{n @x':bȔ[k }g=K  7HIV{ q a?eSɡju]ooIDX cD:w~^-8_!4Mbz8Q h|u@_@[2P<{SF!u`Ρ[Ҧ0z<Q C2|d:V PGN!?-`sQ7 Նl8%A (ζ1q7O4Z?44|3= v +4#Th y2Zt:JNz["+Q :9*oAaJAvljg DrT#M֕s;ײR' U I!@>ȉ|Ʉ j*'qȁ%u)e>jdY~ [Fk| x/27}չ{+c97s[D|o}ӽ 2ͪ%ca =h|TMաg͛(r+V 6J!ymP}aCK(uSA E#svhkk0D=#(?D(xO@c/+!Ѓsi=O3Cީ.YZhل` -C wKњY2IAƘtxFߋ$n"HH&rQʗJ_}n2Vq fUegXA2K@>u}GwM<[G&N#{Vf*VT̐ʞ*0L"iH(+ dUkmNѱkaz*&I=%K-Uڻ[O5czC/m}73"%xXAX)7b{N훂]ěE~Yd7,x/2b,J$&:^һ4uԎdȳZ ȏAD$:`}Bڙ.vO:WHʴt|VHk0MV\nKH@ V~JZMDwjʺ(;uqd%d@?qӣ]rDk &d> tfd Ӵr*$̧+3G`K{q2 jYT-oSG>$u34>):2>IH4JY /?9Az`.#9@㳆 cjn@RUsݽ<561.Fq޽#5YO %ptQN #+xDۉV *ZˑQj9fi@wcL=+Jpw< ] 3J{$ "g'0\)N&Iԗ-VǦ?**TBd߷`{"8b&5?7{0sA㕂q͐U%4ufCT zAHa+Ƙ7BX^= H8)t0ѥ|6% P{_nEd7%uٯFuV׻.$ԸKˮDԏN 7~ԳrS@|AmKEB;[dXG),O! (K|&+[5Cj|S4ŝ5nI#tmcE $i97Z VY*pZhWa-e^; z -gҘ3"r^(-襴 hFU#l['v #M˷RE/ocYa&5 X%^_"ч y1[Ojvp?). wnHR^iA5gLؒ(ȀP7w 9Ey?4kV1q'.vP_eyL X>Ǹ3Bq/r:Ү٫1(NB!.+ߦ:0ghK~PK;!眸UB9a@HPk$:K)}8YY9Qtw :V 1Wa}8x Չk>iq$뗠s_Q\vmCy< 8+lXJXvdu#OY /93j*j2-yDCxC{~?WYe2H?(Z)╍w(m8iKvPYjnQF rh2]F߶2 ڴiK\=3ϗn? mc3Ct<՘(MK!dO6t~ԃ& j[-3 X[5Ǿ7DйOGYɳ ⬺bcQ7zLLZT?h&V]^h'feaa>0ʌsￆCjGW&V6LZk>42-R_{0Dx+. lQC%ilh&TߎŔA`MװTF]((8`88D^FA&~ uub1rwN^[@鄀HVR7%XrH*!<\sUXJnѷ5AIĎOi-jp,R<;da_HH fWk8%6\9_ :4ϣf R49w[3j4!1sK'%mp;C ZT.pg /5|'a2>jqG646kʩ^GI6!a.7b$"*!fHK} {_f~޸I@sPjk?aEqY_h3@CX|)srRϵGD_n?Սh- ,7+8Q 5fB=οůpP~MdSk]032 n1ڳ?()(u߁?6?üNgqpN^~RsjQU0; cU"QoÂI9D"9EJ?&mƛ4NcHbM3KcR!HANF/3/ P8+h [#i 2 E{0Ϗ –\  Q@t_T274w5 /~ 3OYZ2łJ^y{/XTsm[w0[lj۲[i# ϊx$wV€=wް^KM.γZuKOO@1iՌ C,;۳6'`FYhҶ . Yn,= 7L-r:3Ia}2o@_=\0e*UGmaHiu~Z36Ev@UԒKpcGbGx (o/`N1dGmYh8>Q:t]泟BdM<QBfk٘ 2c#!ZtKD T$nYR}X^fOփ M[ $[JمM462vlٝtrS3M鑡yj='QǾ":ayG3\ӫJV\eb/RI/K ʥfHa^#:tM @~(> s1by':.ZTQYcPʊ$?a նJ<@_՜G*o?XF@ D(.Ϛϲ3iw_k嫃6:2;c& N`s3 qf+NW \+hm)# )!w N#Q+T'c +X!X"X͂ ]Of@{!3PFPoM5WsB썼1ƋV9#X/[ o<~w^!Sxm*%e|Kkk<āA6t;YjHu1K"XZ`K|MxaW@ˑX I"۞F<,x_@KC+B}c?P2Vk_C}XYLۭO D&;(늝#c{ m٦7o8-UߡO~%/o `+(|]k6v)\~ P1ԩ zH& AɿsqbQ-wO{>>q#@JDyĠ(!Lb a<&5G48pMI[e¥!BM¶ YZ