From 1ee373e3e5b1721063907b0d634c166d203a69e0 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Wed, 23 Sep 2015 22:40:16 +0200 Subject: [PATCH 001/169] use-cases: fixed CSV header for logreplay example file --- use-cases/logger-repeater.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/use-cases/logger-repeater.sh b/use-cases/logger-repeater.sh index 2f0cba2..b4135ff 100755 --- a/use-cases/logger-repeater.sh +++ b/use-cases/logger-repeater.sh @@ -50,7 +50,7 @@ fi if [ "$1" = "generate" ]; then file=`mktemp` cat > $file < Date: Wed, 23 Sep 2015 22:47:39 +0200 Subject: [PATCH 002/169] Updating submodules revisions --- detectors | 2 +- modules | 2 +- nemea-framework | 2 +- nemea-supervisor | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detectors b/detectors index fb487a7..a380d4f 160000 --- a/detectors +++ b/detectors @@ -1 +1 @@ -Subproject commit fb487a74e6d21168684d1987b20ad57ec4a1b8c9 +Subproject commit a380d4fa9fdc3034cdb00d621d2df5a43f602be3 diff --git a/modules b/modules index 99dc4c9..5f9dd57 160000 --- a/modules +++ b/modules @@ -1 +1 @@ -Subproject commit 99dc4c9890a69742bb742adc2265cd351bad2497 +Subproject commit 5f9dd573a87d50ffb70498c321c659c3ae0ddb1d diff --git a/nemea-framework b/nemea-framework index a5f2134..e73fe76 160000 --- a/nemea-framework +++ b/nemea-framework @@ -1 +1 @@ -Subproject commit a5f21343d764a1aafd25cafd344f1bf0d9f6a643 +Subproject commit e73fe76c5f821fc13382c5c406d309da3d55e5c7 diff --git a/nemea-supervisor b/nemea-supervisor index 0fb16cb..b3dfc25 160000 --- a/nemea-supervisor +++ b/nemea-supervisor @@ -1 +1 @@ -Subproject commit 0fb16cbe490c736e81b4380d7e1ccecc19548b26 +Subproject commit b3dfc2587bf4315c7e457579da2cb33cf3f475f2 From 18de1bce4862ef773837cfc012aea1ffb794c058 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Wed, 23 Sep 2015 23:21:53 +0200 Subject: [PATCH 003/169] doc: quick start --- README.md | 135 +++++++++++++++--------------------------------------- 1 file changed, 38 insertions(+), 97 deletions(-) diff --git a/README.md b/README.md index 0e7557b..fb2b0cc 100644 --- a/README.md +++ b/README.md @@ -71,117 +71,58 @@ Congratulations, the whole Nemea system should be installed right now... :-) Quick Start Guide ================= -TODO: add logreplay and logger, since nfreader requires additional -dependency. - -This section shows how to manually start Nemea modules. Module description and -specific parameters could be shown by running module with parameter "-h": -``` -nfdump_reader -h -``` - -There are two possible data inputs for Nemea modules: - a) from nfdump file (static data) - b) from [IPFIXcol](https://github.com/CESNET/ipfixcol/) with UniRec plugin - (real-time data). - -a) Data from nfdump files could be read and sent to Nemea by "nfdump_reader" -module. Following command will send records from file "nfcapd.201406001" to TCP -interface on port 9988 in UniRec format: -``` -nfdump_reader -i t:9988 /data/nfcapd.201406001 +The heart of the Nemea system is a Nemea module. Nemea modules are building blocks - independent system processes +that can be connected with each other. Information about every module can be found in its help: +```` +./module -h ``` -Another module then could capture and process this data, e.g. DNS amplification -detector: -``` -dns_amplification -i t:localhost:9988,u:DNS_amp -``` - -After executing both commands, DNS amplification detection on data from given -file will be done. Possible attacks will be reported on Unix socket "DNS_amp". +Every Nemea module can have one or more communication interfaces (IFC) implemented in +[libtrap](./nemea-framework/libtrap). There are two types of IFCs: **input** and **output**. Numbers of module's IFCs +can be found in its help. -b) Real-time data from IPFIXcol could be provided to Nemea also. First run -IPFIXcol, e.g.: +At the beginning, let's try the `logreplay` module ([./modules/logreplay](./modules/logreplay)). +The help output shows that `logreplay` has one output IFC: ``` -ipfixcol -d -c /data/configs/startup.xml +Name: LogReplay +Inputs: 0 +Outputs: 1 +Description: + This module converts CSV from logger and sends it in UniRec. The first row + of CSV file has to be data format of fields. ``` -File `startup.xml` should contains configuration for IPFIXcol plugin, among -others there will be settings for output UniRec format and output interface. -Example of such configuration file for UniRec plugin is at the end of this -section. Command for running Nemea module with input from IPFIXcol (e.g. on TCP -port 9966) remains same as with input from `nfdump_reader`: +The complement module is `logger` ([./modules/logger](./modules/logger)), help output: ``` -dns_amplification -i t:localhost:9966,u:RT_DNS_amp +Name: Logger +Inputs: variable +Outputs: 0 +Description: + This module logs all incoming UniRec records to standard output or into a + specified file. Each record is written as one line containing values of its + fields in human-readable format separated by chosen delimiters (CSV format). + If you use more than one input interface you have to specify output format + by parameter "-o". ``` - -Another examples of starting Nemea modules follows: -ex1) This example starts two `nfdump_readers` on two different files. Records -from both files are then merged into one stream and sent on TCP interface, -port 9920: -``` -nfdump_reader -i "t:9911" /data/link1/nfcapd.201406001 -nfdump_reader -i "t:9912" /data/link2/nfcapd.201406001 -merger -i t:localhost:9911,t:localhost:9912,t:9920 -n 2 -``` +Two modules can be interconnected using one input IFC and one output IFC. -ex2) This more complex example start one "nfdump_reader" on multiple files. All -files are read sequentially and sent on output interface. Data from -"nfdump_reader" are then anonymized and sent to "hoststatsnemea" detector and -to "flowcounter". Reports from detector are then stored to CSV file via -"logger": +The [./use-cases](./use-cases) directory contains example scripts that demonstrate usage and functionality of +Nemea modules. `logreplay` and `logger` can be found in [logger-repeater.sh](./use-cases/logger-repeater.sh). +Start the script to see how flow records are replayed from CSV file by `logreplay` and received by `logger`: ``` -nfdump_reader -i "u:HS_src" /data/0601/nfcapd.0000 /data/0601/nfcapd.0005 - /data/0601/nfcapd.0010 /data/0601/nfcapd.0015 - anonymizer -i u:localhost:HS_src,u:HS_an -k 0AnonymizationKeyWithLengthof32B - flowcounter -i u:localhost:HS_an -p 100000 - hoststatsnemea -i u:HS_an,u:HS_report -F - logger -i "u:HS_report" -``` - -note: In hoststatsnemea configuration file should be "port-flowdir = 1". - -Example of configuration file for UniRec plugin for IPFIXcol: - -TODO: update if needed - +cd use-cases +./logger-repeater.sh generate ``` - - - - UDP collector - - Listening port 4740 - 4740 - - - UniRec output - +To get usage of scripts from `use-cases`, execute a script without parameter. The `generate` parameter of +`logger-repeater.sh` can be used to generate CSV file automatically. For more information, see source codes of +scripts. - - UniRec output - - Make unirec from the flow data - - unirec - - - t - 9966,16 - 0 - 10000000 - 1 - DST_IP,SRC_IP,BYTES,LINK_BIT_FIELD,TIME_FIRST,TIME_LAST, - PACKETS,?DST_PORT,?SRC_PORT,DIR_BIT_FIELD,PROTOCOL,?TCP_FLAGS - - - - - -``` +`logreplay` is one of possible ways of getting data into the Nemea system. +There is a [nfreader](./modules/nfreader) module that is able to read and replay `nfdump` files. +Last but not least, there is an [ipfixcol(]https://github.com/CESNET/ipfixcol/) with [ipfixcol2unirec](https://github.com/CESNET/ipfixcol/tree/master/plugins/storage/unirec) +that is capable of exporting flow data in UniRec format and send it via libtrap IFC. Manage Nemea modules efficiently ================================ From d5a630fbd1d88d48ddb164e15619e2e3d777f1a0 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Thu, 24 Sep 2015 08:28:03 +0200 Subject: [PATCH 004/169] Updating Nemea-Modules submodule revision --- modules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules b/modules index 5f9dd57..a00788e 160000 --- a/modules +++ b/modules @@ -1 +1 @@ -Subproject commit 5f9dd573a87d50ffb70498c321c659c3ae0ddb1d +Subproject commit a00788e61ced83aedc0d69317b697d81f790b563 From a673054ca830850a49cff3c63d79378d97c62507 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Thu, 24 Sep 2015 10:28:23 +0200 Subject: [PATCH 005/169] readme revision: add configure params example --- README.md | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index fb2b0cc..64ccfd6 100644 --- a/README.md +++ b/README.md @@ -3,12 +3,16 @@ NEMEA System Travis CI build: [![Build Status](https://travis-ci.org/CESNET/Nemea.svg?branch=master)](https://travis-ci.org/CESNET/Nemea) -This file describes the Nemea system in detail. To see more general information, -please have a look at https://www.liberouter.org/nemea. +This file describes the installation and basic usage of the Nemea system. +To see more general information, please have a look at +https://www.liberouter.org/nemea. Installation ============ +There are three different ways of installation of the Nemea system covered +in this document: vagrant, binary packages and spurce codes. + Vagrant ------- @@ -18,7 +22,7 @@ For more information see [./vagrant/](./vagrant/). Binary packages --------------- -The Nemea system can be also installed using binary packages. Information will +The Nemea system can be installed from binary packages. Information will be supplied soon. Source Codes installation @@ -41,13 +45,18 @@ After successful clone, use: that will create `configure` scripts and other needed files. The `configure` script supplies various possibilities of -configuration and uses some environmental variables that influence the build +configuration and it uses some environmental variables that influence the build and compilation process. For more information see: ``` ./configure --help ``` -Build process can be started by: +We recommend to set paths according to the used operating system e.g.: +``` +./configure --prefix=/usr --bindir=/usr/bin/nemea --sysconfdir=/etc/nemea --libdir=/usr/lib64 +``` + +After finishing `./configure`, build process can be started by: ``` make @@ -59,7 +68,7 @@ that should be run in parallel. When the compilation process ends without any error, the package can be installed into paths that were set by `configure`. It is recommended NOT to change -target paths by passing variables to make(1). +target paths by passing variables directly to make(1). The installation can be done by (usually it requires root / sudo): ``` @@ -121,8 +130,8 @@ scripts. `logreplay` is one of possible ways of getting data into the Nemea system. There is a [nfreader](./modules/nfreader) module that is able to read and replay `nfdump` files. -Last but not least, there is an [ipfixcol(]https://github.com/CESNET/ipfixcol/) with [ipfixcol2unirec](https://github.com/CESNET/ipfixcol/tree/master/plugins/storage/unirec) -that is capable of exporting flow data in UniRec format and send it via libtrap IFC. +Last but not least, there is an [ipfixcol](https://github.com/CESNET/ipfixcol/) with [ipfixcol2unirec](https://github.com/CESNET/ipfixcol/tree/master/plugins/storage/unirec) +that is capable of exporting flow data in UniRec format and sending it via libtrap IFC. Manage Nemea modules efficiently ================================ From 9454da5e6d9632496b792e32d666545e5d420902 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Fri, 25 Sep 2015 19:09:28 +0200 Subject: [PATCH 006/169] distcheck: disable systemd because of supervisor --- Makefile.am | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Makefile.am b/Makefile.am index 4181bc8..5380cb4 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1 +1,6 @@ SUBDIRS=nemea-framework nemea-supervisor modules detectors + +# because of supervisor, disable systemd checking and installation during +# distcheck +DISTCHECK_CONFIGURE_FLAGS="--without-systemd" + From bdd0599ec71bbde2ca47c674ca05d9019a258380 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Fri, 25 Sep 2015 19:10:34 +0200 Subject: [PATCH 007/169] Updating revision of all submodules --- detectors | 2 +- modules | 2 +- nemea-framework | 2 +- nemea-supervisor | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detectors b/detectors index a380d4f..3dd5b6e 160000 --- a/detectors +++ b/detectors @@ -1 +1 @@ -Subproject commit a380d4fa9fdc3034cdb00d621d2df5a43f602be3 +Subproject commit 3dd5b6ed902dfe96ffe39c4eb185ebaff9c06703 diff --git a/modules b/modules index a00788e..0b96b57 160000 --- a/modules +++ b/modules @@ -1 +1 @@ -Subproject commit a00788e61ced83aedc0d69317b697d81f790b563 +Subproject commit 0b96b57c3132ffa6b7db9ca57d816f06ae6d0641 diff --git a/nemea-framework b/nemea-framework index e73fe76..56492b0 160000 --- a/nemea-framework +++ b/nemea-framework @@ -1 +1 @@ -Subproject commit e73fe76c5f821fc13382c5c406d309da3d55e5c7 +Subproject commit 56492b0ccad2d8a0db226b1268e6a17b0581db11 diff --git a/nemea-supervisor b/nemea-supervisor index b3dfc25..19b893c 160000 --- a/nemea-supervisor +++ b/nemea-supervisor @@ -1 +1 @@ -Subproject commit b3dfc2587bf4315c7e457579da2cb33cf3f475f2 +Subproject commit 19b893c86171195dccbdc80c061e7381ec67bf97 From 74f98edc48ce91dd665e3a04649ac809c89c0d75 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Sun, 2 Aug 2015 04:04:13 +0200 Subject: [PATCH 008/169] use-cases: unirecfilter to split traffic for multiple flowcounters The script starts nfreader to replay flow records that are sent into unirecfilter and then via multiple output interfaces (with different conditions) to flowcounters. --- use-cases/traffic-filtering-stats.sh | 93 ++++++++++++++++++++++++++++ 1 file changed, 93 insertions(+) create mode 100755 use-cases/traffic-filtering-stats.sh diff --git a/use-cases/traffic-filtering-stats.sh b/use-cases/traffic-filtering-stats.sh new file mode 100755 index 0000000..01c37e9 --- /dev/null +++ b/use-cases/traffic-filtering-stats.sh @@ -0,0 +1,93 @@ +#!/bin/bash +# Author: Tomas Cejka +# Copyright (C) 2015 CESNET +# +# LICENSE TERMS +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in +# the documentation and/or other materials provided with the +# distribution. +# 3. Neither the name of the Company nor the names of its contributors +# may be used to endorse or promote products derived from this +# software without specific prior written permission. +# +# ALTERNATIVELY, provided that this notice is retained in full, this +# product may be distributed under the terms of the GNU General Public +# License (GPL) version 2 or later, in which case the provisions +# of the GPL apply INSTEAD OF those given above. +# +# This software is provided ``as is'', and any express or implied +# warranties, including, but not limited to, the implied warranties of +# merchantability and fitness for a particular purpose are disclaimed. +# In no event shall the company or contributors be liable for any +# direct, indirect, incidental, special, exemplary, or consequential +# damages (including, but not limited to, procurement of substitute +# goods or services; loss of use, data, or profits; or business +# interruption) however caused and on any theory of liability, whether +# in contract, strict liability, or tort (including negligence or +# otherwise) arising in any way out of the use of this software, even +# if advised of the possibility of such damage. +# + +if [ $# -eq 0 ]; then + echo "$0 nfdump_file... + +This script expects one or more NFDUMP files. It replays the flows +and sends them into unirecfilter. Unirecfilter has 4 output IFCs +that are connected with 4 flowcounters. + +As a result, 4 statistics are computed: + # of flows with src or dst port 25 + # of flows with src or dst port 80 + # of flows with src or dst port 22 + # of flows that don'ลง have ports 22, 25, or 80 +These numbers are summed. +" + exit 0 +fi + +# Prepare files and filenames +services="ssh web smtp other" +conffile=`mktemp` + +nfifc="u:cejkat2" +urifc=$nfifc +for i in $services; do + urifc="$urifc,u:$i" + flcnt="$flcnt $i" +done + +cat > $conffile < /dev/null& +../modules/unirecfilter/unirecfilter -i $urifc -f $conffile > /dev/null& +for i in $services; do + ( ../modules/flowcounter/flowcounter -i "u:$i" | sed -n 's/Flows:\s*\([0-1]*\)/\1/p' > ${i}; )& + pids="$pids $!" +done + +echo "Running, wait a moment please..." + +# Wait until children die +for i in $pids; do + wait $i +done + +# Statistics: +awk '{s+=$1; sub(".cnt", "", FILENAME); print FILENAME":", $1;} END{print "Total:", s;}' $flcnt + +# Cleanup +rm $flcnt $conffile + From 4baea479705e8477cec843d175ea9cab8e7229d7 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Fri, 9 Oct 2015 10:31:34 +0200 Subject: [PATCH 009/169] use-cases: updated logger-repeater example Input UniRec specifier is no more needed by logger - it is currently handled by negotiation. --- use-cases/logger-repeater.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/use-cases/logger-repeater.sh b/use-cases/logger-repeater.sh index b4135ff..d49e956 100755 --- a/use-cases/logger-repeater.sh +++ b/use-cases/logger-repeater.sh @@ -67,7 +67,7 @@ fi # Start replaying ../modules/logreplay/logreplay -i "u:my_socket" -f "$file"& -../modules/logger/logger -i "u:my_socket" -t `head -1 "$file"` +../modules/logger/logger -i "u:my_socket" -t # Cleanup if [ "$1" = "generate" ]; then From 1dfdbd9c1723dfe14598e706829d870a32a05614 Mon Sep 17 00:00:00 2001 From: Marek Svepes Date: Fri, 9 Oct 2015 10:44:04 +0200 Subject: [PATCH 010/169] use-cases: added new use-case (test of basic modules) - testing connection of all basic modules (nfreader, merger, logger, logreplay and flowcounter) - added netflow data file - random generated 6000 flows --- use-cases/basic_modules.sh | 81 +++++++++++++++++++++++++++ use-cases/nfcap_6000_gener_flows.dat | Bin 0 -> 92139 bytes 2 files changed, 81 insertions(+) create mode 100755 use-cases/basic_modules.sh create mode 100644 use-cases/nfcap_6000_gener_flows.dat diff --git a/use-cases/basic_modules.sh b/use-cases/basic_modules.sh new file mode 100755 index 0000000..cc42186 --- /dev/null +++ b/use-cases/basic_modules.sh @@ -0,0 +1,81 @@ +#!/bin/bash +# Author: Marek Svepes +# Copyright (C) 2015 CESNET +# +# LICENSE TERMS +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in +# the documentation and/or other materials provided with the +# distribution. +# 3. Neither the name of the Company nor the names of its contributors +# may be used to endorse or promote products derived from this +# software without specific prior written permission. +# +# ALTERNATIVELY, provided that this notice is retained in full, this +# product may be distributed under the terms of the GNU General Public +# License (GPL) version 2 or later, in which case the provisions +# of the GPL apply INSTEAD OF those given above. +# +# This software is provided ``as is'', and any express or implied +# warranties, including, but not limited to, the implied warranties of +# merchantability and fitness for a particular purpose are disclaimed. +# In no event shall the company or contributors be liable for any +# direct, indirect, incidental, special, exemplary, or consequential +# damages (including, but not limited to, procurement of substitute +# goods or services; loss of use, data, or profits; or business +# interruption) however caused and on any theory of liability, whether +# in contract, strict liability, or tort (including negligence or +# otherwise) arising in any way out of the use of this software, even +# if advised of the possibility of such damage. +# + + +# This script shows connection of the basic Nemea modules +# (nfreader, merger, logger, logreplay and flowcounter). Three nfreader +# modules read netflow data from input file and send them in unirec format +# to merger module which sends incoming data from all input interfaces +# to one output interface. The data are stored into csv file by logger module. +# The csv file can be read by logreplay module which sends them again +# in unirec format to flowcounter module. Result of this module is number +# of received flows (it should be number of flows from nfreader input file x 3). + +# ---------- +# netflow.data ---> | nfreader | ---------- +# ---------- | +# v +# ---------- -------- -------- +# netflow.data ---> | nfreader | ---> | merger | ---> | logger | ---> file.csv +# ---------- -------- -------- +# ^ +# ---------- | +# netflow.data ---> | nfreader | ---------- +# ---------- + +# ----------- ------------- +# file.csv ---> | logreplay | ---> | flowcounter | ---> Result (number of flows) +# ----------- ------------- + +# Input file for nfreader modules (netflow data) +INPUT_FILE="./nfcap_6000_gener_flows.dat" +# Logger output file (csv format) +LOGGER_OUTPUT_FILE="./logger_test_out" + +printf ">>> Starting 3 nfreaders, merger and logger...\n>Nfreaders sent:\n" +../modules/nfreader/nfdump_reader -i u:nfr1_test_out $INPUT_FILE & +../modules/nfreader/nfdump_reader -i u:nfr2_test_out $INPUT_FILE & +../modules/nfreader/nfdump_reader -i u:nfr3_test_out $INPUT_FILE & +../modules/merger/merger -n 3 -i u:nfr1_test_out,u:nfr2_test_out,u:nfr3_test_out,u:merger_test_out & +../modules/logger/logger -i u:merger_test_out -w $LOGGER_OUTPUT_FILE -t + +printf ">>> Starting logreplay and flowcounter...\n>Flowcounter received:\n" +../modules/logreplay/logreplay -i u:logrep_test_out -f $LOGGER_OUTPUT_FILE & +../modules/flowcounter/flowcounter -i u:logrep_test_out + +# Cleanup +rm -f ./logger_test_out diff --git a/use-cases/nfcap_6000_gener_flows.dat b/use-cases/nfcap_6000_gener_flows.dat new file mode 100644 index 0000000000000000000000000000000000000000..96490f28ef7da7a4b50fa1da3847af34934e0de3 GIT binary patch literal 92139 zcmc$H_kR>s_y4^!lWYhJyUBzsgblmwgzUlw5=sa?^xj+Oy|V#CI$3&=B333 zx49O{MKTBb@bCo5!kDQTDUn0Jnxj-Q8f|$`1Ajh$tXt``twfSYPRP zziGKRO-OHMk3sy-Yx2%{0#TSf0ipohIfDh_UHK0n6d(d#f#@dZ0r3S8QLO}Gf|L)$ z_ds;oFAyKde*)1Ch^rd~B9lJ_q9YK+whM&8o&m8Eh`GxJqOJTKh`vCyZ%$5LWiNu6 zHO-MvZVGaD=`WDi!OadS0?|Tx34{;)lamD^$o>Z6IuQ342}C6O2Z$ITo@SE9{?aSI z$-ciQh^M4~K`iYx)iYlT#8=X5AROTSVXZ*yXK#RL>NVy4@d8m!{tt-T;AqxfAezb{ zAQHT$bhDU1bm0aNFVGVw&=ZA}dy)zG5+te*f(JZSE(i<;`{dVx{V8L}rAKJf_%Z^a zaSp^;ufaBGOFYO2m$E>TfVv13-;DqdS57h+h_>MQ)?L($Tq|dvFXuIsaxiF9wn`Bo zzJkWl<-si}i98aB-VhHaxr?A}%#)uq9>O&toOoaIJCPLvx65lPP0tI5 z{^HRz%wDM<)u_PDCLGtn;@G65PXGwaS^bzfBbK%efom&tRd^ZGk9YrGZHGnwE6~1fm)90Fefci<<W8N( z_Ac3zSJ`LQdEpk?8cAirJjZKDL!d29`B*9kxEWel0NAHIWq!bZIQZfc1SBPervT9$ z=F`AXTB**<15Ss3(`S%*K1Z$qYYm@I7Wz*~sUUv@{dOdyXDNiu)j1>kS@eB~1@W=N;AWqBGfT)fZRfUl%x8&+MNE5bXs?ZgbYJj@IYewI>F4*_7 znn274`)IT;OBpBC0^A+e%YP#zhRC&ncozY<4(Fam8xuD^+5a67vd013ZPY~y}U-mEV$KpD{J64%bamQiOfgxh6rI+>|eqo zFKYy`50UGI+fffTf?(|?01wY5@K22I{)=Gn#aRN2z@Jt=Bhn8W1H19;S0g~0KaXNM zPRf2d15F>%nLLY-TKLV1Ih}-!=Da0rtO9HCy8x9b z0T)4xY8(XvS7PJ=K-_@Df@`9IPuM^pMk2ND35kW$Aix?J?u`@@%jCg8yayHY(uIUm z9sSNcj{`MH znJAk zN+CWKhy}2XqzYA3R`6+n&jU_CxXLeN)BQ%>vj|X`dT3*Y&uDxRd@Yr&Y$o`2V$|k> z*sTYK;_xky`UX-%e&w@0p)r6qf>v)lJnvBz&|E;JVvvYsW&nx;XOoNkJ-<=58&uX& zTFLXEvM|E74~$K+L65W@Ufb*c&u)Pc0b58K3o)D5Q;*Jkwu3VCr zfxHi9T8YF(yC}8zQar zn=!{WK!dUe8d~^F%k4je{T6&R44g(EK5rlpo#iz^j6omY9zxz;k=9b*MQwxD#t&g} z$A7TV9L;Q~Tw?3NTN7hsdnM?WcEW}Jn-Hv-u$uNe+vo{RgzL3>QV^C)*|sAPJqJYx zRzT4^69BCRRJ1nt7^k}dLP8V_iDg?nq0)d>f>vcZIOoyi_U$CNqda5V{6@`(Fh5!; z#6E`kC9szPI9};1ZwEXIl2+*PO_O$D*7^1bnk6e^l!&4%1H@NFs# zzU99IiUyyiNyjkbmIYzd8U%AYZS^wCim05Fb?B$$4;(5bmy@oNx8|DS<-jS8fxB6W5PYw%7!VERYalOz2h`2elp4~vfXe}ngS$ED zk|%Gc&q#~`u;3=vsCzzR$L|1AFNY(fB8>~mCdfBEA*^NcaVU|L_VO(#83ZMi4Ni>K z{5v79SzN0H7cA9rr1%H4e;_$IOa8$V!bBrgPX&!{L%UvQpwY{)gDPN+*&V;}$x<*r zk>$Id5HgrQfC)uW*gcr|7iuQCZK0MjyASX+1g~|WzK{4({s{=FPO_Qbu&HS20qJL8 zu0cZ&Xy~p?We)(4he*O3*y0QMFMi{*JkYwxaq>gZd`6e~@c-d$w7Z7S>=|*6BDe?< z%qfCtcqeEBo1ksKtwj=T0MrFLvi$NdpmO(CVs!&7GZtX24*{|-01kiVHSB$1aC3D`5+Gm{0CH@&g9wWzk;f}Kau8LP<4&Q_ifP9 z=1755pRtfOna2{O=UAp5v>>i7;ChJ@rWCz}>~}^x=3;_B3jKchn*36IV}z3YfK*O0m!5 zq5!pr);-Ez&T40O>H?UyBAu0@N;- zps#Lmty_XE535G7C*@eK<-bpI3KM3H+opIor|ok^G)S zr%+GI6Wx)cIja#*$*|h2Tub@YFcUFY7EXMoTdHf$1>oR|NK3LSFP*Jl_mfbwn9*U> zlQK!SVX`-(+H2IZp1S2*%{jzf2zz39UKh(*Rn0k=jO-38U8dXM>NCRhl+pGY$e+cU z^Fu;phNHPB*H-@o{ICoP`_)0WU~w>%(l8OPMWr+N-5DmN?LZ_uzeGnh&j-KcA}>8D zH*+21s!+HvcoN@q!e%8Ml(t z?h}X4i1({*(Rnk;(PY;r>1>7SZb}@Z$qAn!*VLRVNJE^k`Kj*B)SL^60rMZl>4a`+ zi@36mf_?y53Mfv4Jq-WI*P62`n57%xpgzmBmGvMaqp1ZrcFp}B0P8J8|H!r78b(1X zMT+CKO6lwy%{dg(^4l)mtJ^MV&hcctblBhD)7e)Tpk>O3)i=>?Nt!bR1};$plU)td z8BPW!UlMMw>wxC`oyaT<$Mw{lS)^|m3$*d149#_|{0c5uZin@4%(d*@NghrU9=@wv zW@^sKlr$8LWY>mthP{Vbsxd| zKCulnGQSWWZq2ndsZAsP7vbOJboMFcEVul<)LA6i^<3M)e;~^nV@C6&tjM)&uS}}W zhgG-IEjG>B70yIq>q;%$lFoia3q4}az>XYCCVHNN=Sdlx>*!e((sGAzsw91?x@$vL z4yTT3U$m4=wSk-EeMYIXnzI9_{1yePnb(Z%l}qFW;Z`ol_0Bp&u4tI38?P$kd9z4T!)G;D>f{DQBkr6WYcb=~$BzbuI z{F-wRHFSeW>dm?ZE4x|tE*Wo$?J^cqL&j7A-8XV=b#=5e`XNA{!D-EpF9<7|pxeM{ z*4;s%&n&n8Q)*E+>>bMZj1C($=M=O!vJD1$Jp?me3=HHsEk#4H7VcEtN_dW!=$z|G zIi-7#XwF|LOk(sKRj-Ff3%i0XK*z4|tf%U(1IO8z@aUAPyq(hDU^q36*W%L|T`BcH zf~Ys~CBC~Gz>s8WRxM0zw>9Tjis?fVj@M?P4>ac@QrC%EknH*}oqZ08qCbYg57LaoJV;>jv!lU0XK2>)nE)Uq}d}&!%D4k)H zi234FxD_?i*=W@**0tAA+BeyCE1fpXrhiD-&z!vgB9Bp%;x%_VgOhjRf>h>hrqbD@ zRT)y|GkVe*YpVihaWfmO^hR@wij*9N{;I1vFH?IjlVH47GM$CMJ^dOIBVMbT&S25}HE%dDoM@g4Lx2Q;*7*zGz0s_vffrBD_4(&>Hd8Onh=c?nxs z0M1<1-IyHB4oA+1%Lk)ntZ4q;bT&eD)8>nRMXq{M&ghv3F|!Vr_ws$n?s%<#I-3E3 z3N6s=o7j=QFOtQO0)TNWU^cS!V_5jtT-W_86#VO9zlL2_-ISJydNX9X|fA*4i@`uP#d9w zp(!q!_+icY6%g38h(_GjQ*n`FIzK~4wvX59r?Z{_?N6X!piqzxuzEf0qu1?2c4M>{ z)4HNPCD5LL>aKuJS2~d+rq=Z`Oj|q@^&eqqHCRVh11Z_{PdZD1npS!^U;EL5sUE~R zwXM(eIcku{Dm6P97Le-Ski&f_F3GNw=?r(KMnwl41y=fu>O)nx6Cmq|=>azt=j*EOc!CR|+tN2c zRRDT@51{u`H0%SYioyjJ4QkAXf2rmGja`SJvId(Cm zktgO1JOkwA;O@Mv>YfcMzX$51Z@@kr)YQl1SiGlAI&Kr_~5 z{>txs=(+Tumia&@83somscsk-t5n_rpLx(R69Q5t2*e>Or&RY9a&0KA$7`wSY?112 zKn*P_2ESSNqiV$7P>>s^vjeJoG4azGCSGfiPM3*>ZJ_Y|+tzS)_s7((cx_2K!`p{h z6SHvQo6oQ@ucEpeL9vY87&Uar5Y_!J8A96Rm5J9nrL$7t?|71D+a@82a8qHfcu9SQ z`!CiVR(OiA;=(PUS@SnUdiR%T@f%RaG$4xUDc_o6@vi^^k)NYOSp~%DhaJ#&t)x2^ z<}AgKr8ka4C5@28u~X^cnEJqR%M06F|gPw7V;=Wu@-{t+@thc>~Ci2gN49+1d0K zPm9seC^);9o}GWB!4sJcZ*lc7s$O`YMk_oa#(EclHo>emf}*>1aPF|G?)}(oaULnV zYZvDl249rwrn3`!B_-H3pP|M=AO>SG|6w#1nBKHCk3i?=Rq`2MQqZ!$$F!f~GfMo1 zb*-#2mX$%{oNyT@2=m9WAohvZDuyTX<~tC4dM4wOK%5o?wC6XxaLItw4-ki1J~L4L zJ!(LCgdx*swy#lwI_*3hzJZ%B3GWW(;8yUa*?P1bw~C>A{Cl~4Z98}Oh4Y1Ofm>P( z_lEk60hD6LZ%eWE=P%ysq@%3>bKQDNAk(YedC4qJIv}_uP zv-6k~rdi*3oXz({wX<8(ss$_omS(a7?jh_e-LeJPm2a`Q_OiZ-t$RwhY}Bmp$x+PMzV=<$$6!LOa&^r_6zYb);yb-xdO?&Ba zp3!X+fgJYMbv$7ZYo(x#c9MnuBUN!}^@5f>%}Oi0Je0+f*fQO*9%6k14vL+$SBkCp z63^1nH&3C5q8Ni1&OdJ!UVw~rg+PyUvhG-|Syz#ZCm0&hf(Ec=#rfD^>B5=Wx^1pz zeU~`;O5hlXX136*;yC|axK&BIttJc~5{)n;&xBRK)-Cax^#cgCO2+?u8cj}2*%Fo@m9RLzPt0&nfq(H`eT-Lh7*{z!t@%n+unZo!$|C{a;J zG{l)6_ICta)Nr|1I00@3r=r_DXo-}9SjVNE30h8QR;=I#j!l$6M|DSA%{rG5zX(OY z=@z<_E&ecU_n>aM4802jUdj!{#)ml4t_NMMReKz1{ZT9OX1~`c*-Eq0J1z5syJ3*- z=%HCFl2)roln1yldYd^9gqh37E%qX58@lSw_1Wc?>-DW}@IlhgHtiQRf?Z4n!kJB53>Q?8{+8m$U^ggl{E zd|DvrID}xi5~M(u&n&s{S1g76eKat(uC6;~Yu1U-FMksj9;I8JfSDFU>c6GBr2#sA zeqbu~m~Brua;daN;Ui__eO%h8ppA5= zMo@Z=^BT$7svWP@ru1Fd*zdZ7W`gl=v#hgF^_Onhs@gHa4L(71%30mgQ?-l9v`RQ? z6|0M=8SDudlC1rMspVlN?kq(N*S%VihVRoR;YT4pQ+EYL)*4a>2IA881s&bOoyJZG zj?TIbd5Dv%!78d1UpB{L(iSl&7HEPP7*X9JCs`KQbz;g(*6miF4C+6DY7@hS#vySajSN^Eo5Qs z&vowr)n1$sv5@f@>0>qPMgp@$43_FPAG}LAz++j0$2lxK-df{4n%}AiZh5wA*5joA zC^at0nj1|08|;-?I374A76I4>d*;0A9_JL@vQV|#i67U=2S|lhQt3= z(1r1VJ3W(~Mo1dRrF|E)OofgTgR!l^fh6?`fL;}8V#mvW1eRFzl_}vt2GI&hadzC# zn+(@M`Ge`m@l>-uqx&r0l6_XIRNDTaH%7JN^~GQ{Lz}!i80P6Ke8J;q7MKu?)OTbvTypabhZ6is%pe4ZKO#ox#+c;?~MLP$R5aC!`tn z0wME(Zj&$~HdZqkZh|Q2lSOV`g_lZ6%2wPrk-o1^aakWTA;M)&8M z^&@g2MW{QVyNZ&#vq2r6WW6xOvE7T25_XkP zNwt@SGNq(I?9?qB%6d8w*>N5x7O8(!yA6)<=Ggvu;?j-=Qzxr-O#3FDa^Y%h-IKb= zv9i9fJuCyb-!Vrtq0Pd5yc>R@+VM1HNGpW{Y6Cd%3=ZT1jI$Td@fI(V=C6j`80^Q{ z(}I=_kgh&Sj^&Y!u+gFodFMrPU~rQ4SkU$>ARdW^`h13^IhqxVF^zDQq)VC3tusjU1R+&9qOaxW%RY9kkJXTAM@Rkrp#UvwjTq z(l6mf;(pL3zn##$a`p+l#78H=o!K8@Onrhz(gad!2dua88Lr-%^(EQrfeH92GM*N& ze$~R66)_e-&#E+7@YOr30$ zvC|%Re{m{<|6d(D70$=uAL$ZyrlM{hrR=D$mx0s7i}*)4fP^K}?)3>*t*_;IP#J~e zQOVnMC{(;MJ&yMQqS?shaI$(Et3PcI^42WkyOl~C*L-}(c zP(;DxG6K+s{r35YThy`e7v!ck8krc3mQjzEs#^gyaH3(IbE0cYCX4x!+nL{I8CA@Xk51Y!Y`fIz7>Z;d?+Y&Ml;AW*Hqj^mI9 zL=IDcKn*kd`+Y*lU&#?bU}JXmKg6P_a)pQA)^V)?*rG(r7SQn?&EA~{7o?Uv`+j#o ziI^~prK9=!= zyh!bGW=u4SFF;OaMM1WCO>6oVfjA@EfcOV<^q~m?QG(lnsD#AE>=24oUa%Ozs3PIJ zE`Wh6KeJdM*1*D&JRxzPsX$PH%Ha|8Dtu6i^P3S}*9zj_tQd&hAfA&f5I-}zDHsXv zbEx)#OWR}z5D7q>z#|wCF|0Tc>wtKWDG*m!2_Pa-lC~XVE%6JU?HCS)l~L~sf4rI^GTE6M$1h zzSb9)#}A4N=7+pAn9D&^pH2cXO7;MO0(8Fkh(OGjG$2~zwA6?c++*42QOd{C+6n3s zPWJ{>7_Ckfh2EYf!p? z$c$#?fXD&D(U;_Z$C{bpGi!P9&I$4imI88nL;}fGP^FMu-V?%dZSf#3naVP$0;tX5 z{H}FimvCp33dGmY)|l#Nm=9MFzQF+d3?PsyEmM4E(IL}>@?ml%aCe1x8I%&h+IG1z z5Qo5@iI>j;mdLB%3l}T)>h;aJ}UG@mKo!QBsd*Yc)-S3|f*c;d}q&48!?^*aWWv4wKrzRxW6Q*XgugSP;c zc2adm3dCgA5{QFnaTe6qS2jqk02f7OeRm8DTpla82Eu2=)C0X6f5F?JA#J}(A)?}9 zZ9%*U?z82Dx^cW65aXeab{=J@Ag>IbrImTh1^*|k1IT`i6WSNi<9vQwnqtn+rgj#R zJ9$D>3bhcjL-CxKpS1$A!;6Jwr7Xzig8SfH62_HSej2Vl8Lmgo_ARmACi_hOK}XPd z7V^2F&+He>AWj<+u)WVHg#AWn2+B8mK+mV}`Q~3j@wdDu5ZK{ZDBH_+;=TNac;YXr zEM~nynu(rB+YU_US<%X0E zPF%prw0~>e237_PgPy{Ix>i(nPh97fBUxK^yVg_}Dy+27tf)iSOY}L70uRO(vb4}F zWr9p4-w!=SCb21&yKBl}g|cDu@vz%&OCTzZAbC6(JVmnEdP@^6)F)(t>d#s)C+PiLW$TFhnR~&ehEKdafFhV%$LAj7LrPx5ZCfKD(z;4E+;Q}p`8nSWv zdeBohBgc;Ww?a9EeW7`Bf;?Gh?5aB&X`u!o3vTE_^WWakVbmOwa%yFl3H1r44%0%_ z#S{8mMz!RDA-Zk&y6uEf)^n;Rrw=j)zskWu1*V&Y-`TBwa&5PhL`PU;swhY45^pt0 zAbydi1A*#6OD10Zp=KJJ0mK9J-5)_h@NeXqwUR^cOvzZ%pZeohX_hCn7zzqE7yOmw z+2G%X-W!}K_^Y!y;9n7R)Lgd`URW?g&IQNE5cv`JzZjGyr1yaESS#vHR-@+>xiq6< zbC31CT+6`G#G>(6XRqoffJh+FzSd z>G=l;{|?mX7fAK_BEK1R|0p@#SX!Kug&{J`A9CcZuN6||v!eXmV_l|a;GBTZU=H%7 z5I=+5s;!0aq=-V&tD*+|3k-o(T4<^;(wHp=7p4rpq#FEE_%*fye$5PKR@Xu}{@|-E zybfsA)f=9cDKA>GoPP)joL{7>TBswGaCxY-5-5*#zMgRkwz+&#S_MQ>sOA*cH%}lX zDO(s-r{mEwauJH7&@HPNRj2E4ubLLB2{kgxuGa#!489C7&`91(TIV;NFM3gfx5(@L zMyX6Kgi9r;JH$7DbroXsav^yoAD1=);jvE8GY3u#GT~N;ZxXmcy5+bQLU|rCr~>~; z;9BdJSz2f_;gmu0X5g^QSZ;?~#N@)#7QwbixAj2+3(+0&R)JfNVS-kc;%lXC2-U(V zgIhI*i;>slkNsxk(-1X}zh>J(n-#SE1lD+b@wx+G=P8!;-wSt(Gb&>DSQqQwE?_9H zR25b1N4;iYQCZ06$=OZ5$Id8L3*mf^q`Sj*Ljo@ls2B_N7Jf&{dw}`|s4iM)i$IO% zdx64xjXXdL)e)#kj9%~0gUh9baC<;2`hIWd( z1#Bm@P$%e+loaV8SgvAvEKbdlf8vJ#d#vMfv;0^S!Es6Y3>aL#ahwIsQnfLi)|vsE zcRd&CxT8_hA7Gz@;WjQg>S>|wl<>!-Bc4!sNZ=6)MY%iJ7eZ%?T?kmM z;F$gq<-kaW^7lfx0SY`;`vf}Ik&Cgys(;%&1)N@AyTP%It&q8T*Pr+oPp zA7H*i5*-rZ=qjCsz!)g6`v*Mb%3O&m;r9WtaSVCtk5{gMsvM?@T)n4(Gv%tJwd0t3T$iV zg3>mLU-KLFYHA@AOyEg*}rDXqytxxJ{B_gGPB`MXNJ*ABalraq&`J@{K&4)C9Z_Pe?b-A~hbgmOj{%SULT zK+qMVg?@%fwt!_jObkD~{S_4bTK>fw%9~<~UkruH0&Fv~eMZyUP#7AtpQL{3D%9F4QeTU;I`vU}cl9I{7=YM*R z8d&&wna~_JHv$8NkB;COXj8D+Bum|DT_W8Zg;R!_2xV$HTwlFLO@fTT{7#+onrhZj zhQR1bsXBO#*Vs=M>GuYrGCuksx321KN`cx7CC2#+sbXXgV(dMs8L#7^X$D9Y_KLXKX}wPUT+6$4Yc50rH(l4OMqX3JH7>pdaPgPX573&Vf%oZ zVtj!7y9EcM;}EE7D7VD^-;8a=py@KUBIi#*u_XM%ogUq9wM>RwQfSkZ%(9P>Q(WmF z(E)!0mc+Y1P#o~qonN;E7PSuG9$r~kS(*#2?|(_nObVS2x^Q`67NYM2hOLBqXmqHH z@`pItKSGEk2qwo1!4j45cNDpr6e^hF+Ut0CsRo7fc2c`$R>BRIUp5AH~j}AsUR0_BxO6!VfNhm1tjIU)JKOws}7^i z35ffL0KNfZalFwRufGDcQAIgLAv10xtWHk~-3YeP!Mv z1_2UA&9m_u`x#}$0RsOdZhY`VAGsRcL{gbW4}T02$J01PPECLr&dtP&4B>ru#Uync?9`5aIpCU@iY0PNBmtp}$ROAMvOhe)`+G!n z6(#>zrYzy4v;7J7jh1k;uC4=+hzBw9W<72xj8ED?3>9|~v;Coam_5}(h!zUJLSVdf z90PG$Ll7}!jKOX}NuitYGG&EwGwIb|aN1fADVu_u1gRBhGcdS~*VxUoz#;0VMlkR` zYD21mRt{e~QAWPdU*UPhjQR-%22hdBG(cOkDZm*B8%?9V^YCQJ7wRW}CrS!cB_=4wuiUVF!DAETH){X2W1v%%Ew?O8zcbt0Fq|QxW*w52@1h z9e776X72{?lF|UZQdw!S0f~{vf!_-hU30bQ$VI`o>1Guq=hG!!e( z<5L9ZSSvukvYt%^SRP|FuQQgC2wX=`0|HBexX_5=#rX8v<%|b2RhEOSEBp*zeC;!W zub_F>5@?YhWw#4TNtXi4CpFu96RF{{7yc5bPwX}zF_UFi0PCYfD z1*+wR8=5vsLmtUmP=WI7mj6f^mGF71wu z-ES$_#N?M17*p78Mm1VVsL}HNEuQ#J?TM$l3JPva z+#LdwY-{Pjw|>?P+Q6cg0*GD?)>WlfXM+_3A}39E;1O{ViC~f>B|A_VqFEmh2VTd4 zSea}2X-H0GLY%~tUi{Vl4i-Q(B1M@|vhB8m9oMY0K7pSFF3PZn>{n+mhM!;dtEBEqLz6n>e=7VGK&5j;MAEVH(R+ z67>!~1DyB)t}DbRi=-EyJZ|>E5eq5@$=eyhHow3ueuP7qEk~b!S<65`niO`VK0f-> ztT-s)hltRApBcBbE97N#IXwVJpspba?D%RQaI!UrJ6P?SVBm3KjU#kdbIm%BSc->R zif`(!Y1W72)YCAgk8VLd&j`ZYVfduWSzWhyG;1m$I*^~p?J<~AW3ok;eWKgeXjYml zctfIkoD+3RifTtEne_cOWx~4-CaHESVeq70tC0?X(*pExP?FY?D zQw_(7f!cP|fp1i-^GV`udL2G)OQP~FlkQ4U8{i&;FP_3Vx+<*YAKh|SvwlV__{4zP zFE1Cx7vg&(>zlG6)MwGgi2xV}Ks#F5P=VwUb9uQA)j7 zHx8@~RC_h*uTg?!k#3jIqms)BnE}!II zxZ<#X9qfGxwrg|+D}IRKChSl>GR3yNgQ5Pb9TdqvP?K#RIM^i3ibIdV{!{HQlWh|n z>}!#P2J0bAjnXrUK%0a~9NN?(n)MKNMOYk4p)wOm^2^2rIhBPmv& zLXm7ehhX;gBUI`bcvTA%em78S&Sim&IQ!n9t1=*`hgzD9P3I0k_7<>HE6)BfXv0;G zQL+r&k99xSGn)V^aR5-9{Y22_2J7g%;k@4jBdtC|nntb%8P$-BRXcrXROr6QLZkP5 z&ANedDOHf|HC4MZ(*_ri? z)2;+FpWzP}V1J=Y2FI%<9ITXTKj|(U3Tr&&UGSNKLQ^LiK(%pa6mGK zpT)A&6Gw@*00vXYJkH$*^t*RPsc+DTvLB-n@hUbK*8vSH4Udzp-y*+KXq#6U zpLFF-K*b>KTGEkKuv#5&SLQr7%RbQ&uM}5QJ1qc_QJ{I8U+PUNf;#kp9C#XMf95gD zXaL_$<*~dw9$*UH3O7h{iohJx9gm=Q;Q=)7Db_@$+8a_J?NoSo0$Xqe)TL#SEjT?y z4udB5TJZy6YbI*e^ROymiiGpA4n|jfQ5A%L#lO?6v;?5GL1gdz490|J2dNGB+w6TCN=@W4(dF7Vx2#$G`uJe-4P!_x6@uZIC3N)e|YDW zMAv7N7eVQWWZSn6_EfcF1~-+TfSHdEqbX4j93`jB{eIR;XMFSa0(Q6HNo$d&p^vtnqPQIecJxRuu^ zOm|??lyG`7gv#tah6l3ZW9vIuTzFx&hAnoZTa`(_A$KRns}2;N1N^8A4a_AN)meaA zV`rW}a3VT@^7Q;5Vg64Cqjj|6h49qS93d8OBjn6n9D$9fctq@7j1{`GZIM8kgyIJF zX%>Q8{0V|P*=J;21}*#TuH$zHTObNd&1h5uQxku4uyd+?Dh*(ojp9|s!Qxdr_UZU` zS2Vl-jkkMBe8g0QzJH9sYnqvGAL^@koWJL8&%lF$5g8sY#b_>5Hc_+V)#46D7rkjY zNUnOL;O39vT3DqpVqY=dULT1te>!}X^I7)&c^DK}Cyi+jgdblxs1D9-bvE3cV^DcZ zm9=sY8F#H_uUR`u?pQd!b!ajukE^k~S?Jyws(lWnTRHN#GW=aDK4LH#ezhRKLq!B= zavc(W!m<&R9ouqX+r>SC1oHrodpC7)H3 z0*jsY;FKm?`{Ra+#gW6UMzt%!!k{wDPLEL7<;V^<+u?Nxg+ z-h}1y{6d0#4qDt>wQHp6HobeA*Hat9r$VdI51$EDzd^d!3|#LO!3%>F-w#y&2thdR zv>yn*LSC6A<{`32@%F>-1N!_Cg0eXP#diVq#Mk}#hZX>$TdN`6;r`foduI&K=2S_c zD6gbz$SXYS@H$|aUJbuMfOp6Z?nv`uQHFf?x`T3~9-PdPL%2H9`o9B)Dkudck|$+f zu4TkTw1w>n|AGMS9PVgN+$I&ECgrXx?H;ae;#dte4L9Eg!_QLS>-l#+svzEb< z)U=m@>Ga)^Q=E$NHc49ZbxT(G2cuTfSHPYWFMev~I3_V{eDHfv_=K>L<{SkD{17R? zcS#=AZKvpW54(XI8XR^^K9@cViLHz4sh4V69vJwpu!ZxwrHh&-j+1S%=*gaxM!Mxc z%}LiExET{tKj;?RY8y&5*bqLgp`W?JA!j+KcV16Qk6g=AOhzb1Xv^rA(!|G&*xZaH z&#shA`_pF@dig2!^eG+~>`6hH6dFpA;2(hMNx}D3txBeqC7ZbDqu6{F$0lk{Boe+H zM^im1gLPX|&3TFt_o=O4>6U&a)5N58FWftKbc?Auaa~7GEwT1eo)laK*)=E1HSmjS z;`3~ySTQst;)F2zShwLfQs@}VSKvbgPYSL|@GDk=J&wM@E-2%w702FH)94F))->D$ z_))Hn_) z2aCb;*@!<=#>iAWegcSYxdJgxre9>EN|Fhp9!%N6I1s4GWQ+e49FIBGkBl2V%!;v$3iV5j%EwFAF*BEs79433)sNGQU^Co}!;O4S1>{s> zvUQ(8Y-CYD-~yc0LWv1DW{clwqcYz?SmJ<~CyL0I08u<75X(dnc^e>J;eHq#$HnL6 zsEuQdux$Y16pF~{SC52JIAQs?J z5AxX(6_KX{kzQLM{*|bRyfYA^Xq(M&W#aOg_AWs|-6q9>S_Q3qpK4o}@(!mea@xlv z;~)XVB~e9A<^M<11!9`0B1fHOOhRvgc=Nw1a{N}OKr|OsrBzEycAg;nM`cA=Qtx^4v0_Y{4NI^a& zxj?3RKZeaN5NY@VJ-bs~XuL5@AQnrdfuQ=I1iXENV?Cpaavu=RQUY;?QAK$ZAj;kl zh_X@=5DK0e2Ne^DClXba?}C-4e+a}vPF3Y7I_1;X2*fe&1>ztO_qURpGo|cQyfX3T zDDi;J{t}gy6XG-;FM(JmQCWEqfmnt>l*G*L2mAwkm@@q$8cyxYNByOz+lR;~y{2<&x>3vFLZ zR9YT`MXI_X5V4#}%V%L}xrlVD6oE}yJpi=VEz%t;nC3I3-(SJ7^gS|B0|_e@mZZ@< z19FYv=hvSJQ@3QQD<1(<@8O-KfYp+!OhR5Q2GfO)xe@SC8*N z#HMmBs-4HRTYCbB^4cin4&j0cC0VSF-z=VpN;Al%Fgj_Y)?8XcyAd`Eu1-NsX=Ds(jar?Bi0mTRDiNLoS~quf<)Ei7I1vsR3MzJIS^~m z2^*^rBBGzDD9^2(Y&M#Sar7%i^OtDkpCac`v;Q zNIzi{)_|VFHfnv^V})v`tdrY;Mk!}?|9f_#v70|GzE(*v*jCL534TdR@K{UfY)x+L{L@t(nU zKsFvf&q~$gLy!Rda7l|=ygRHH5aXb1*LT9&C{a|7N(Fvyq(BUk`+x(#bi!vHC-r#$ z$!{?e8nJ|j`lBF;3d<2udcrQKu~Y8vH@oW((Mah7HbDHcC;e_~fn}*Y&~HSogisZw zE~k3(%P0XD^@VUFSsn}om2;xV#jMp7zki#Eu&)BQUy0{KL9`?08&{IvS!@`7_ZJ7I zf|zJ&xZl8+)kV=Yt)&3iPT^RY1UOy!L{yX0L-Qu+%)$>`=BIZ+%NwtNNkxg{Bf&lo z?J84(+O-AS!XEhORt(14rSOX2Gdg0!7#hkqNTc!KI|e6Ggnu-n=j_SI;oUbOhkdFi zKQIGU7Q;$UJox5!!wR4rlJS0(|FZ}`5-Z?P%?q?7j4@g3N zQl1+YOQBh#OR!0v5b7?J03FHX<`OOh%<c$j`rK3@jRd! z*tg`T(P8TbJdIYq=k$<0959X`1u=K|G{4aiFQ)~*bQ!-i?x)j3$!0uz6Gz@JR{H^}D*G0YzHM^F5(q083sIVQIz}fcZA^8@C??MRxLq_-_)> z-D&~1v-k0f|Ij-QQaP}F*Y~(5ezd=#fkWc&5)RGNTpwR8d;*3E}5Yq%C2sYy*_w7o(Ncc|;z~Hu}x?PUBpH51i53 zjVL^o*24W(_`2*Pu$}|_Ip7M)$80lTs`9_M9HP=2zQu1$-T+#E<$_Fy>~3gFmRR@X z2(}FfpJ`j(g;e8%{`@&lkzw>apXoqCli;2?f7xiaiEXiVMISw8MJvchxqJg&oZ zZ=@M!OEYFOJR2PapXnf4Q~`7%8!C%v&?4ixIlnyB`C+t~b#Z@&$}i(6ElkUlKc&;q z(+@WO$pwN6C@Sf{fEMKMt5HQT$85PXOiilIYD7%SeYEk@JV2A-SU>!CT)u&0coJd1 zYDd1qiaHJ7ie3YX?w?M)LHI1ArEfhU9US){QBQHo-+@fq)jkc-n_Q{Ot^?5w47dsj z&6mI9Hvs$01``hndUfe0;9v0*Nj2fX;Q4T_!vnZVH`HzMcAnqzHk4JQdje@9GT}#j zf3_=!+AD!|W&&dT+4uiP)OmnMRW%R)mQ8LFHf+c)S;}IT-6aVLu)qR|BtWD{5dlF& zkg5U-2~9!3ETFz3Dt561uwX#}#R>>)P_QF{ir5f4Scsrv0r%c~zd0NKAJ3DAJ#*&F z%$ZZ}DKm2<$x&7PIo~j+jibu#Z`Ti(I1gWdMNk8#0$-Nc9qxktPS+>;5!gM&aPi{Z z*o|DbkMSY(uXa^axlU!lrJ1{u`SFyJD zKW2O%N`8T)2k%1|>pHFa8ae*?oRU{9q%D?UzWf0NA9kHGj!|$BayN8D1BRnu`M#*G-)TnPM5*^{`*B zHTw6g@q6UOHwhcw`c_>V{@TB$uH`N!T2YNwW9H~aCU?7HqEs{8Rcm0LH~?Rm5!pDt zJ(RaLJw3;5WO3$)WolW%x@gTVGGA+VQC;%q!pF&YfHu_>6nW`EKOb$#uroSk{y zb%!HG#6|)I;^^{0Y$`DS z+2MxVU)Fi%J}{>cqAVXlg8?NGU+UnmxoA@@~WDunR3jAV9(lhXkW1P_Y}0lt(FhrLa>^o1%1)>L-0Gp^vt0@ce1rLy$0_$7u zcyOwe!r0-o$NfmjTv29c7z&jms(3hg0Mwf({tvJ`(_d@6Dz&q`pOTf!pjo=T~S+)p<4`cgxrq_>zt^aPIt7z zDae-z>o~4hREu%Ni9DUGJ&tzm@9Jc`Zh#bF&7>f~pxfc=2mMb_(E;YkaLAof_gAV_ z=ak9Smq-_#c{x4e9GD(VX>xeN^P*QPqihSRZ-G?Ma9ypjCY;_t9KXU_^JuY*Sedg7E^fUD}P z;mgqaW@Py{RgYKdtkJ`m2TG~zH6mU?!-87ln{aY@N&^NPI4Qbbtn`vq@LfU!eVVGs zZ3*kys9kYexot2Kz*>{A7@^k|C-qR}v@*xN#jLuc$ZM%AGcM@@3{`*ccGCz1L8~_QEaC>{x3&@72!1C%MAu*D_TmZ&}nnYj(Mlm(;56 z2)U0YhG&J76A@_u%I}m?)}M9Oh~b^=%&U=-J5jl}Y0V(n4Axkc+;ZD}5rZefa^j`sOffG&JeTiX&yag= z!gHTj>jwGD5FVEo`!u_A{o~NK^LVYUHL#ykO))v)>EzYAfH=S0$vjBu4tZvJtuZB> ztU)zY!N4)XK7D6l(ugE+#^z&CSmyX{P1U_sNjP~2cu$qv8HZG>{h7!=DHEn3-dg5h z!CiGixrIQiH{rNeXYRf3PO+ZEVu-#Fi z_F|c1-pK2vm;qcJwR?@GaR<^$gx?(bQ#2W^aQe12sva(I=yE>oiefwMXQrQ2r#@I$ zc4l&>?cB;mqNwlx4Du2w=& z!KXsoN=xjVF$~9}DJ50Z6N2njYAhejg5+a#owI+W>oh~GEz}IA9KVAvV3v7(`-UU6#skr0 zlM1KnuoUxaa0OyP;ku>V7DqtZtjACpy0*3gGRw5;G2FYSkB-{o8K&AEQTOev5zda< zBOasTPm4D2=DYYRmK8H-_`g%VtKHWNS^c{gQu8)S6V3W|p@G`aiYrLxnSE=GPXvWC zL|gxzhMmq1{=H|xc^5u|M4v@Y)+=K>N&mU7%=Y<|aQXqS#sJOej=FBA)EzY8_fdPs zUfPt+uzmVLgnKfYEDKeZl{rR0)W>%CY|$TgyP)BrT7r&gH__WGFvFC3 zjfU1%uhxUQ4}?5!ooMjA#2wFiwOfHv-R$k6w1S2QYK=Ri_EqChJ=stDDyMl%dwFYjHZ&OqzZmx@EQOdeC;(YMOD9 zbY0Kyp>5qt?51Uudw~h&VfI&i?j9(%&7qW=#NKo{hBI1q)HYem86U{!iKAvMvj;0qVSmIDdOklWwDE`K|lm%$H# z)jMj>dY|=KTy(>>Li;9a8_dgM6f2zN}Q)|2zwXfY+ZhJPRn68f6cQQlk!PGE&Gco&$XtHN+|Dk1$#g;=l2DqVz(qmZm;hx0E^QquA$6IG4TF-BG*4=jgOl zQOePy_65usMsv9FAX>qRnVphWg)_Ips2;w7j&O*f5v5i=Q)E9*6f#WbWx%L~8XHd8 z6Vo~+jZo$EGAGTF4*CkEPSc-uP^yQ*v2SY@wVUoMw_C{vmD~S~_@U74e?t77QiL-( zV`J0~b*F)F=@AP7U-M|Pd#LiUGRJj+QDqg`qpi@}8%ylqgOI&6MK;EydXQf93v?K| z@^P@ui$dG(U?47MY&4+ds;zXSJ$*VQGeVWYGJLb=n04%4_z+*~)gI^jncF{?2y@RU z!7k@}-H*PM+uzUTNqR~PBs&sL+9;dvlJ^(1*zr61#-ecYH(-0-9nYEbvGV$4xDdTYBliH{~ znKiS4UA;hlN>~fM+N5GTeO|epJ5Xxkv_JL-b3C85nLVMii*`5^O?J-hpHBNdnd+fi z#d(VA-wW*-)TN-H;mcZMp)3Yv)_Q!IUbVT%&S0T)OCIA4t8n}DwGbK~O+FPOB)Vf_ zA}gBC;oBEwH(MEEfRAF9*~UTnkU^c2=@riWzVu_BtGH{iSDV3ypthH7epX^%M3|Ph zLY0e|L}#kTaXQakguwLCtXZ^a>|RDjk7)9;$@5Uf<*IQeJQLbhQDQecRBmUF1rl=q znV7vZntZy#S)mq{7-pY0ozKxa6p90O{e2wWnEyP)x|8`^n`&0y^af2)8rpVSiEXY1 zR4vVu4y>5I{yTu}Mpa=!!?(4@JE3ih=(L}f+bw>BRi5UewQ@tO|0|q@PcR}r3c0^Z zlrCR5AFO@lPP0N_FJM3YVbop#C1Vo`T~uV>R_oOU7Tei3q2np3`S=D_h1Y)rv(!ZoFp~?qY$lf76d^v4?a5vw(WqbhDy12+m8~g~hc&*%SR!M6n=_doDc7)}r zcC}W0VhuHTo4NW2T1jo6^R%ZBx3mU@u0aXZj<6q39^?0D@}3Ip!jOdsA6gHuc9_o3hcbOORp`gW zlC{gL9if^dSXA?hY;LaA(m0#SGYe~tKr}f#RQU%} zgTzOjcb_;qxOJl@Qt9kd-BXkt&xb@=Y0vQAMwDuD$nd$ zYs`(>_g9w_4EZ@Nt9OoWwyib3jM}%qP@YUPuhW~rj#)d6@9vUvLfe$soAkj?q?k@!sE_?@>+P(6-(@Ejpd{ z97~5fn8S-`w|ljgeBvsS?OZSD5`*$f5dV!PcUL&?+)C7Ucb>Vr)^JDd4O{u59+i!o zoii+&T$0=W`Z6c`O6u}Wp4qC_=oL+-hbqHNDECtAay}2t#Ji`kMK^J?%q_C7`a863 zIy(f~IEzaXlY1J*~AcUCw#Hz3ZKJo7TvVAOVLIgv#0m6w`0o|Er&O8P6DQ{DL% ztzhh9uwak48C4Ia&_C26>-VVr=som7O{3?7Wy@3V19yOI*^^USd_W7-G! zHZ@rT$}0uj;~#jNZ(@bhAp&4GCWyvg(d7LV&M%#rS$5}{J!*~NUTslv(i^J$wu~>7 z7Cz3G#TXFUHm*bpp3|3x8NM43b5Q$pVD=uGiWb@ThS-E$O_(g#NuvlQV3(rr+|ntT z7OL#WBrfK5NAt{=+1h!v2a9D3{r00M=NF8FbbV?kTGP1$W7S<}(=ob)wpF8yuC&7; zt<_1E0gF*alU6iBTRy7M^Jwm=p>30y6&bSQ-$A=~^T|NR6Ze;6@6p|iB0(Rp*gpAg z5uyBAXFvu+awQA4UeYzAS{FcaWyO-tWX5WXv!Yy5^`9TLr+&b2G>ocUc|-xPHT1JP z*%|ap{drLM@MY$n&!RrJ|8Jak$)KIWTk_Af);bm2O;}cC@6uZRWxL`I=Es9{6s2~F-xr=6Ix)Ekkocr^^0aT|wFF?d^ple1MRH3oOezk4q3MJ#dZ`YDytruv@(If^gssDKsYa8qOyP&qwMtGBl)6?uvW5 zhXZ>AWors$MxEzi-C9HeH0p%-UdxNK{eiH+>Al7_@zY|+KU$8Wue_1#{ zh$e1{_1qw4fo&6>pB6dFpG8ZF`$xh$s2(r0wHu)l>hOHRa=bw?`@cs9JXplq zX`d*PZzSYpO2Q3b^C$&yM4Y$gq{ykKr0Reh7V9fYezJ z=|zDv@hI;kisz5cn;*C)`OkQR5kYT3GPm<^ju5$8@TF^24WSO4Vf_{k%oX}vic1aJ zVC1Q+bH}9k5gq8jXe7$uu+-fU3A`DP(q*n!CYjF}V&CBlmc^~z;Xs2_e7{f$b$Bk} z-y9AM70BEaU9TPb^e94RVrDEDPb56NThl=}4@^Nu)mg`PiMi=41dRl$f#NG>xwZ)HP67fmFo=-7G=Fofl!BmiTukc-hKwzzF^0=2U}WN&(Ysb zb%(JD4;MammnRhVfdtQ91TZ3JWuf@}yTpG3rXG&_8{8p79XM_uXgm}U_ zHwDqSOBeM=?}eV{q!NAvC#B)Q4xvXIB2GoZDroG}XDf+%Er~9_00wDaV1qg>5_lnw z8+BlkYMh}e#zCkRxJ`z|TFU9m$?B=z6X_VZ~gbIHFb|Fq;kC*3m z{vMq`BKj317#@r`CIj2R=oeXLBs@dGwdRUwxt;G%SeJ$a*uUC56d=<0usFwoP5oA$ zq?s#la|i^rcpov_v1CnO=?miIf0H*@K{*qvUD&v=cDGyeOcXrEB%(A?L+jzjZMkjl z>y;ZM1~+5vN<=nln1{*V_7I zRkdg@Z*V4R)y$>l{YtGL#tX&dpf@pIsgE=G@HOH)CcN3#@wy~lX^t^9CF_nvA@*+JxWkguMA+hwoRSe;$u=gK77D3f7Up)FsySU&%eGk)}P|tGZ3_ zvbZ&#?3ODO^4z#}CiLl4^pGQ_U4zSTnfx{Ns$tqWDfT-P(GiH+LiK2zQrA(s2i+FN zoSLsv53~}iEMkfsNhDAoFDwFGo|HM>o!0{I2R+tYsX_OI1Gu)aww5GDBp9<0=U>S= zKc3H(zmtgpfz+_e$Kk+NqJx{|4XTehh!#^C?MFsIUL^2&+<(j)TuQ#~h0S1jYjNPm z-e4ObT8UP*p4dE=82FEPO)RhRSu&HMZF8t)(|x8I6ekiMx#8~50$JFd;|&KEN%xwL zFrg0DB|KSby5oq8ieeH%KXpcQ5#&&Z7ZM)vGV!($+E21J`K)#DY>^d@X+getUF+Zi zk>qZiP+NV#V&*k*+G)yn_jo^Fu*H%|wVSB8c3P31g(ZRAZ#2IHK_Y%k3I}cwK?WNc8!pbx_5Ks7y(7D`6Dq{@KTjy8PhNaerFsxn7+q@Ho+IJD%kY zJ|I!{_7dqY@XZp>6;HxjKBWx5g?2cw5#nk#19vl`jNj~Sd+H!gEsImnJn9gnQY{!` zPFs$p>pR}VBI-Q#)S#{R5jsv2*DRT%ew11KQF5^@am;n838w9Q_4Jo*q@Hq2UqD`T zS1PZa7-?jm%OJ0c1b&E*k(vC0qr8pwE(e3(c$HSo9HVM>sKeWdr6$N3-=#_#ElHfs zmQQ4}uugLNf5#h4fk1Fcys#ByF4+s2e;{*7=+gr>UVNanGZhdTwc zY|rELspl9eENCtkjN^=BPOt`#mr*YM#mAS0I{cdOW4r0x%W zc%<(Mikd5NBnt$~pB3$BV=y~BY+0>Rj$e)ei=?rwaF^GvGC_P_|# z&iz2qo7lZ|upDI0+@%su=-Ah2wfTF}z@ZKY5@XW5!J#rry$XFF!BWNRnyHu$vc zUj_Q#wngW+dhvn(E&gisrKWoGK@xk6Op29oHglr9(fuS~WC8jN(5!rAL)6@mql1G0 zUi?h~OjAw{b_1AOp#Tr)a&YiCfY(!2^#|0s!C(O2{i!gz>K-r-0O*62JG;K^dJcfm z02Y0u02@s?F1QRpf3YFcTn`$#04e}nc)0>xVR`{@k)y5at^i{-9{>sY^|P{1Ov^Nz z1IX;-O#fr2!Z6G{0GL(j^TaGmi24EK185#lfF4E*051bLg+VJAHM$%W+ze3ylndZ; zT|9bP12|XKbJ{#^OnxENQ4GH|*JEaY><5`bUR=1Au(Dp)Yg!v1rJ&qb0E+HYYaM(b(GN+jBfxenXUl2MhpNxFl1tn*I$(3( zgFL=F`hJEM9^2LX)2Qf&cTke&35+sw&rq@k*9w?DVV(_OJIuC@Q-BG2PXH6B|KT=5 z+i#SYI9X{}rAbvn_3b|)EAhO-Z7_O)i!G}0?9YOGrQW;dZ%7@fQ`ugl57{`180Gbn zozN=98-lYIu`}0R(eVLw(hH_4(0k}3O!Do>bt;RpZcgIYs~6~`@z2Mh{BGUgTUSfAkbN|S%}s5#Bs!o zW0{8{Hkm`n$BtJ!EWQew%WIwoK<-6vN1z_A<=RlvayfW$%9E*5J0HL(5X64BR|!j% zPH)2gqZ=r%yPnmClf4oA{reQbs6GO~djJlWDZota0suP!?Ch-ox0@pYV1wm)NW2C# zEZau`xD%rPD-@x3(*Q-BvS}B<(RhS8m&pDd?tXzhUY)OQz!ku>epf~JnPVu*Le|g_ zKkRx-znHWbb-qM8=(=7TOPb41<9pH}*Z2B3(qGVT#0I#PYms&d=}8E8R|JAC*In9p z0Ig`vLwgm6QQ8CmgZ{`anvUB9T;MYAI7#`k%m!z?bw>l zmTu&4634~!iMeL^mbfIYKLL)qx~I4v*XMwHe_>O7zwmN^aR!X8L%*6mUP{cJ_0Ro1^C}e*?h&EMZv{?h7N+WtTX1~zbV8j80 z0<$?dnXJl;RM85VAB4f6|axgs2`D;&NR4Bd517k7~RaPRr{A0^_KL^BlLJXFy7VFhWc0vd(_v4mBb zk}%yoqe)Oh>YA|L47>ZumgQ#SR&HPjPt!*U_m;L2j6WET<3o@!%?j-{RpiP9Mq~1p zCEQ=s#7|^BU$h%{DRJI0?*Q;C1B)m-VTH3=yA#k_>hO8k-C5CoS-%UA9BcOvyU!Ko zCHmbsBvA2vj|nr^WEJj^a0lAYVRxB$Vjt7*Eg_c2Bf>`Ct*xT{XVLzDEt8QlPp`fP zmyon$XG`iOb`S+bxT_of^5dXuxF3qo$ir+1?g_h>L(TQC_F#$K`evShQv$8gYC*V# zsba07G@X;sYDmatQVLm8a%&!dbA(5be z9-J(a>E-}A0{}24VX>P^wlyErA5nn2>a3e~3m?}4O`J*I<4)tI5*~-uiQ(xr)&b%& z$n|5`-3`v^u06(Mfaal|?HiPMBUSK*P+)i>pM^H}9w!Ys4+sUuCoJATql(mFh54j{ z^-EYML27~D?s@=+&{OAcAY;02RURhqK=(4t)f=?$%%@9i*Y{z!oWYuG8;?ij^}&3i z^59vGBEL5_LV-(L>vt79u|d1o*i>R0ABWvl3gJQX84zAZ_}d$GtIyP)rLES`R#&Zs zYnmA`HY>UQmni(1*|7UY?YR=CS>;ADb#u4&yvm%G@N6No$zGgI?8rdTkI zn?p-f7uUqq7 zPkIs&h97(tpFfSVrnz3*rHHRfL??jZF*_QsDgdF<`iQvZ zg~n?N@Ial_W;kUG^J#Opf-I@ChH`L2_gZ1@QIH$!tnn`k#MQ}6xuQ5}*Zw8Vca8Q& zi9Phvn{QEvTE8{}riLqKz74@E`C>%Bk}C7LIUWoJ zme)n6+$JjG0H!{+i81kEm14Ko+zb9mble1mcdev3ifc%zwIOkS_Q6e}y4KFXMWaFQboF<(TYj&@o7TTt8?Z zg7hc@tkp!3-*vwx{wd;6@X(7Q;KfGO{sIp{IVXW%=$fdBcS?eZ_!i{L{DfJcQ-S9t zzjj!4MJMM=BYgbQcJ7(TIJOHEP1gYJQ;N)h#Y209VlDg6Fs~=q4eWb~scBMVv(>#KTO^___cpx7>-2_y3b^LK^t3=vm;5QyuHE?z5`#k!cMpQqO8F8x#qk2AhWw(i=XiQCE% z>YNLQx#l?iFVfuP$`~s%*C@x80?#30hlx(iy@q(MaJg8dg1qwJOsRRAF8dMPq16gV zy3BR@8Bhv5x23w^&8}kQ!txX+3RFMYMCa}gZTv)FN0L)rQPT#$8W9>&?c%!5a7yg# z)#@2aD)pWwjx3?T;kxO~WmBD|6Z*Dyv17e zl4W<4$DhpJ#db%j;286M-KCIuy8!h+i$c<_)Y7ZPhr^8iZx9XY6%zZy?me7lxQ3BF4(^_3z%{VmAmEexQv~_=w4A$+CW=vk z=krvMrgHjT{pxENZ_h45O5MClm)(CTaJp{xck>1PIjDI#55*nXx$ruPdKC(MTjv>u z(_DkTPix-ZqH$FnDti_ZQm(rWhhl;V46f3gy*Hdv#vs#N(xE>t_ zwM#29zoyM*L8ant)G#L$I9OM@;{oJ1s{~U$8e2kkxRR)A60gwuja2W24DmZd0j&Bz zAsH!=$fL#F>3{w|DH?;+3PKY7PTmGCFyZLr|9(s~h#%nb2aBAt7sis(X7FL1lIOMj z8o`X^#xx6ySi!bhUL@FJTRJ}!cr8K9tESEiCxldiJBdn9-Xi&ROqQLS(^$AaIsO+# zifapMoGH+g_yZFA_)muAxF@3w2*y;Q8LK?IF{`(?cp=bkr}ITqR4Y>cL^s6}nTCB0Jm} zZaeOW8~$MFFO!(S7Y;#^e(|-ocRxW^7R||svAtncCVw@w`&}T4=}L~IGG14&CoED2|7t@feA{E-CKJfBXQ_WS);bgKXJ)QDpQSI_^4gARYRnNII4# z;@RK)gDU!-lmETcgK?hN%HqUXe-YRvHx=4GRGUpvjw?` zh8?sI-8>I&*`F!hWZd+mpyITVeP$3t;%oAJpHhcM_EHBgDbK@@xobI89~wZ7Iet05 zugK{+_^{BtPY)koi2Bb1u}uxdX0L()pG|C$32fH>D4&BjNOgV(=F?bw>l}|eb8aQ| za|W0P`8u4V4>smv4CW2^HBs7?uTZP^^Snd++Iu9&w3M(0w&yv1pLN=(I#y)A-IL$H zOhlcym1b3pXFATrPGbSnG0Tv&YR>ZKL1QZK4!pHos<)FsXuY}8UhK`0L+>^Qkp_0L zap@2Hxa(nUF(o;B*DUDXaWBJsWRVj&(Vn6vkCGh6#`Jtzuwj8_#)+_8?AIzl9KvG( zdWXyC7X_q7Vyz{^N;?G2b>`2;GHB*`+xa#596XzcZdP*zn7*6TZQoP>9!*fU+!o%0 zN0Wr~Kj9)#{Vldt&8DO6S60J5V=n3*&gHv&+j6kgt-tLs3;U|Oq*n6q$T=@Ca~&Qb zi>pSHcyxrj{O};_EYR1;D`&A!2C86OS4Z;Rk&3`3!GP=c zVLPj{>T=$DnAC=4ApbB%koO_)=B?CpqgO@7GpY%)*ZUhtOMfY@Uj5X9UB z>sf?hTN6xAF3Zd9utba;cjg-s$^Q18v(tXQHcQ-S&-S@HSPiML{hF4Ua0GR#&zqae}Wktp{3?6wnK>syI>$=6jA^e)ODLi z2w;UwCN-}ntQ$AYku;;0G=^7$BkuMBz;H?CzIS(8&2#dC8MY>&Z9{=0?7btzrv`&A zB9QiV)_qs3yjUQ^Q(XQ|SS1nn0x2{`6~b-y%LoS(0Nzo68^wg{UheLr^ z){aS{K0|%LYCcVP=K69%HAMkTDbBJS-1!N)`-xhr9f^afW* zH+wBr3j3jc5%&NX>r0uW9$EQR{HDx^dy*8oPUg1_^oRjIsi2A(ATyjkbJMGm>?_8# zH77CIi4Zs)0GDaPI38gio8cHNRHV!^ zbymig(hcz(5*|%niMU@AsWMQ9SeAIEMBI-F6JC_bKC_V->ZJ&W6#%Z2+D6=C<72M$ z@!SF`%%vuH1nb_2yHGIvQsf~j@^i#pDF7}7h3RF9!uulbQBs7XKmfal!>9OiK9Q=+ zwFzr+#NAN}-Jw@~6$)I4xlP2~P5>AmNTE9tRtsN_YN|t`F*z2R&!LjtWC}#-Eb)Oa z(r|jSl$@jE7V*ZHLckyfg#?CfAD5P^7LvnLTn{G-KZp?d7YLyug~?DPV;=VwD>+Bj zS$jT4TWRN}MA)6Mnnv9B3QhdT1piT1j1jjjRl7tLxxLPMeK0~99aM5vDtvhU8g{gD zY-nwXa285=TpFbOxdaD{xQ9yl*6r!{!`rz(5plLiHl_q|glW}F)o;KO&!cli7_3yK z=mbu%BJP!n7;|LQ7pz|5`SvL=^x3J>flDI1IzZR;q=a2s=l}Fm$-hYScc_r}ks|IH zg0P?Ixg)_4-uCg51hN#-vhUNfn|wI|5r=h*sQAZtl+iF!FqW$7J)S7c_vQEn1<+NyaWuN&LW0e>?YAARF9<39`05!b=KJYpZH_S=_%S!l^3M1_}bJ z_k>uetl`w7#Pz!_TVI>|^}8ePM<}JAOQ|Bea%{x?gp}zd!+>KW{Ukj5-$GQ)P~a+F zqKLR(AX_JrwUDIm{SjA#t?eS9VwHU3~#VR=t#;pyIXtq|wE^-EKW^v)< z=A?SaFNypwd^vP)+dQpwFg9VmLMt^XA?3>{j_0%BbeeV)74JY;I@oTQ87~XK$I}OK z&pi?MQQ?nyo)noLw^%&d5n26)0=)W1eD<*-v6a&L>bU2WM9!xKKCjXar@0x2Nh_kj zOOb_GVfpx~QDnZ5%@T*dM-i?eRTi0VmmqE z@8}I4ktyq}RBQcFXZ4&34Rf=4p5s?#3S`TvDLN_gejp33E9fUKUWkAFDiF2xsa6d$ z?mj}8G+tH{X%ELsnN(gEUS}vAaeooFRzx^gq(T7|>%Dp08W-WA3ILfYo%?R**v59v zQnJmg>+?xe7+~6YyfhT}m^cR!_dTE+ucjIW$fYP`;PrgshCWtk=j|kw)``VvDDYLn zb4$d1M6lH&mp3xvrCAa8iz3jQa)FQW+Gfa$!=;F~EbdtyaqkjkJ*W6TmdJ1G%V{Oz zUBiM0lk7Cg-yr3EDBvR&F0#V(XQT`dntb~l)LfUR+NvgAc%zzwZ5)inTA(*;Am;+? zR*x5;r?}^TlEmJ)zMv2LiXIX7HW9UBsu9*E`p63DqQ)h6x9;8`dvm9i*Q`E~$Kqga zgjn;SzoG200xJ^!-4XYfBAM9DVv#kC(w%1^H78gb5*}=NoM{sJgcE{355&-M)(%z2 zn-ZQYco~M0=AT%Z6fwE3yi}T)BM)@)QhW>>0jKS55z80+HE#XsnT<$z(o9o>9cAb>L|F6q9~iD7n64$+PAy=F?+jkHAk}y*QyO z%`8*BYvEifGqjHqAu}G8HeS1c6zo%$o+B1<2xQ;v%UOsbOnMys zy=Rs$=Uh<()>WdICzceB{2FfQr|~aWV#(h6)@Ic8i8d^SADtk5T)Go+uGyK{T{u~y zgZ~rv-|izEH)_BUQZ^ZPo=dLPQennKzGaw$Nd;*BQ6$TrVST>%5_VXXr1ZOZ;z@A&b?4@6MBWPwn;P%#tRZM>7m%`Sue9BYWAGwB65JrDJ_OD8n2y zRk1vq#UaZuTf=5G)m^yXaB{sV9i2+tFWaog-l4Z|_vPFW_lUxq|CCZf>$t^d*j_S7 zsi^CdWc8SqYM8c9dxO8z6~c15#By*gc}3ruRm^eMT+Q!@_>Nx`2Zc$$yeRt} zIlCDo#?S5WQEbgPNOR%6$Bw3qF1UqatKX;Cl|@O7-*;;K9s`M}Qkj#E6}WV>58`7? zU(Tb_;60c@mlx1m$3s}(NTU%6u&9_s-#H}4N8F#q{T)bpAD5ndGh9Zt4puTrHIo(| z7jZYlJ=@{sx*lHdAp6wRXE;q0UPX3SGI@Gd#_=Dp;XK}HHD0;^4n(p57`{cd@{xGq zw21o$L^8)wRb1^Z$zTPC$~OxHXgH z3iU1Y$2v$Ys_JK5I=U>vpJ zUIt33*6z`ji3Yw_7s(X^jC(l&usi&uTGiyZ*_j}h2q^3CCDFVyw2F>0us1QL%dSD= z0JHuPop!i3H5<96kv)?1d98yN(2XqV=|%S5Exw#m_~<-5Diu0EUPxb8Yo3#$F<;KD zaZ478=@%;9IaAs6+vn{QOK^5m#=WCkDhr37Jb`g!YMJL;GI4Ps7Y zf&4VNH)f~46x{=Qh!Urwgf4g94H z<37HeJ|r~{0oa;i+m=2)kkd>6hu}SH61-)r^bDcf>MN#^+V9KBQpJtxum0r&&7%HF zK^LE_tBdRxKLb1WR#ekJ5F8gTUF*yFSI`O9C8O*zlk9@`_*6|}$W0F9G?7eMT_0pt zUFPHXA)`UNQ+qZy=RRcl9_&^Hg!{W2&P))F{tc+aVjJe>+(TahovB6kd+o{jw@9zP zpCdG58;R-yaR{0OZ8UG?ka(5bIzlhPcyc(3UaEZ z4WV#XFKrN>Pl~f;=NVi^kB{)>bc)X&MDnEuD$)zt{~^)Gfy(@|VLIEFBcIeXabA1J zm$NADXBl`v7zI#V@isWKaCZ)KDqcVFWk~0cy5CPv7{Dn^8tW-0aL2fvgO*C3KJt+3 zeg)i1JP@BiYS|>jxT?rrI?u-=IG`ReS~c5n1$3n^99m~o7rqJE`6Rl#srrCBpC^H zdHH_tp#0EPC$fpV#2JO(tGie^q$4f%f-k77kVrjXR9j?&XsBB*)9=8Pz zPwvpuOOmf&X|-;3YU~_|w$`b)ln%MOhZ^SX&{6uJ!=89{%T}&&rH-~noQ6-eYbe^G z-^0{-*lP9s_#<;Pa#SdhhWmHunNfTB`?;s0z*s?uUpX&SRq?rOPtahzI{Dn%r_;Xb zvqO&ta(suan*4C(|4JQwvIvwLd@A92H)=2K{GPQ?tI4dJ9W`b`vWS!JohKZBVY!~!ZUmV92p)Sg->PGEl(OP*>3 zrprlT$c=|x_gHdXW9dh7jGR*(9`4Xj&~>sn*p&Ca@@B`96B@Y^z3--w`@DqzeVBG` zq(z_xq17>AZA4Fv!0XlPPz@({=%ZrE7aJLDQ0kx`oEuBt-3WUbXYk)yE6qYu z{Jhq2vRi@ZhHM=<4QHp);jB*C)db+Pg_Ne2v2d(30V(xHLLqz0Ol1n zw6Dq%Zszlf@ScSKz5l8#9<0)}Rwu0QN|Ldfv}GgbSTU!VyEUn(Cd+5LTFx(FokH$mb=KiNqAe$r zRjELD#G)lUvRVB|@cwI<)Sg-xC@l~<$bZ_6OFCY1VXt%JknP7Otx%-n{4Wz z@)=mBdA>Kqru{1ZG);!wb|sY`ll3z)X3kVxe*y*kHB>{Q+(*HcW5y z6j-l|={uHy+B=iEQqWwV8Dja)rHS_IuL{sX7t43CPusXx0Wvi)eg7K3E!=1m9DboD zrtj`PPV_e}o}qDtCZ_LPo@@7wQULBQ0dSyTEN!U(rKVWEi>H7O0|tuBP?qmM0od@Y z0<1B_@}0X5&2xtWv{shyD*&Y5rvN|bV)^dll)@;Gj<`^-j@GcAeH#NODDKeOll?6C zSwASiUQO)ZF^o3eXs!VL%n|_8C{lV_0iMvs1U>^m#W)4nr-=#tH~^y$D!?*j0{<&S zBdk{8@~|$>@MQo7U`~Nix!#%h$=`8XPv#e<_`qMpeN^O41<29G0G>N0WBoJ*=%9%K zyjWul=&t}-h8Vz~1W;}Zy=O6icl;OEt4yD=fEPEoO~)1B3$qk#F*1Gm0#QLPy?S6L zF7;2mt+MAU6L=f^ZtWDHqcVY?2w+&g0_@YvAs|No%Q`7QiBSO{2f#KlHNh&-6ifI4 zEMw1N&7l#{uQzG2HgCbrGp0H>nqmuoDF9zvRbrM=2>`PyEjmd7iuH2<_*sjOghZC> zb5jiBZ$^r3SBd4v<9fd;i_{`9t z#AaO$;^wuIB~_N|NmFd$zvWn9d<0y>wMQ3Q_*3Ar{!BJ?1r(eY#k~ z6Zv0jc8Q|?y&=}{ud>`?^VHDhIqiZHr(5%&Lf)#09sDEIrP;R%`Fu_6;QxaBe#nPh zW3>xO_oU1Gb+#%o#25`=86~FQEp?k|UR2^3%al!rWmYfUOHM8qmQ<^`GK3$7XnAtu ztGPZ@mhj^CvPDcVv8k%D2!H?@c7!8 zw{8&bcbOAQ?1D5zjkq$kNtEVNUT?2#NQxPMpR&awv(ojmK84H#lsd>gxL(83HB{sj z4th@nxtrBAk@$_bFf)M5wff~CvuIbAQQcha&8eh6gX@r1OsP66?Vh7pg1!prT-U4m zbaKCdFUO?P0u%Hr0I){Yeg&b(Y@%IB8uDjzH`|~e-Y?PPkp|BK!|>&&yhasdXE!N zYVfr=7u;IuMWkDyvWcfC zV3=)mxwEg*BF?1RzoqIW`n5I3AoxO^w7_F@g;81XKek#jf7atAPLCsxDqbh_B^14h ziM2kU0JDsx05a(~!!hLLDJ?2jyq>}y8(-9pi`0UYk3gnmH36+j{Qmq5Fn>p6WTX>KaC z0aqfmzFH@QRQ46*wQ}_~Zzqo$Wt1I3R)Cw$RRB1E(H5={wJk=e z;r*!Q3m6o-J~Hno`yLpaUqiP32}1_o%kgc<9p|dkA0+n)=9tS-#%wO$>Wd_-5*y}Z zKa6WvliQ3rd#9*sJCysp38R08LdnIkNqyu9MPp>P>26fd?gE$evye)6y<|L0Q4HU; z_;(`J4NyKGQ!tGqH7q?ZHXbD#ALcko!}YqpjwELZ`W9&2a0N2X;l<4-$gFYYn2(c* zHDS7(z_lN(S5JBoLL5dhc|4#$NhXKkCg*03?>4>qEe>ns3Cv{7)n0pw%<%}3`!iBy zxW<`J1HkRo#5yMVKiBR02GTej>G@xX_U|+|mN@5q@hO?OKW!qf$fAQpV%_UCv(b!Pq8mU#6hS7@%ah?8_`8>v)Lnr=DmOhv> zlY8IbDo+OYWF9S;U1VQ+Fa7(j9_C9W_D!^kV{#r>KkxvIvZg}X9Hwt6ac(WVMM$%- ztiOcX^X}_5t}>m~6Om$3k$v+53jS{jfvPN&xDv*G*ED@Q0)LD)_#`+(dZ5&PMb4dl zUWBMi)3HpS*Po2eJ0WpNk<;qD>!juMNAx<(Nguoj8UyG(yP(mO3FX@JB-hL^UKOp_ zEijpCxVWGB8omJI_&Mi0eK%3B5&DInpl{R}dqPPug8A`~(q1e5b;{j>FfMrJ^19*u zMb4ZDpHf68YHtcrr{d9S(Pba)ErL1S0^UfBFX}Hi$~fM5ji_%DM-HosoW*~gwb^-#xqVPfp#D(4+GRPDs&6XG9Rrofpv^}7U0PWK}|j*F#=5hJSL-6YK|*t6htY!_egYBb_Jvkb#55`ipnLGrymR zeuiOJ$p=syzfd%?%lt|`fTT5p(v+UyzPgXhF4vQZztlG+c3ajO&V)A9c-3nV{U@O$ zpJILo7x5xv<<;O@gkibUZO-kI$GPke^zYc>-b$@6nn%H0M?WaSz<>$we&ZN`?r^DK zo7bSt)qV^mQM<;-cOL462(O6ru0UBTC22QO6;XTla=O|=5a`{RT@i? z05JmVr*~rrixO{n6K!;7gL^TU%glSt6JYYOvaeoC?)BIV9p535CpcGaIPWauH-^~F zWcUX|WC$ zSwK{$y<_|hx2(zn`%rHHov^6?2S7T6xh&1TuYE25=GvfYDG56#Dv1@0zRoP;WaANMJ zid}-S1sxE&* z_X8=%j24mG)D$R@c{?*(YoRc=)_L~*sOY=Q^Np4Y_F|pY@>&iHw0!Of`Z6m`j=BBE z{WVfs+jxr0f|>&fk9<*bSWL@aJC_=r9dq9)D(S$*Dk!+3)p<7DETkQmGNK6uK22Cn zV(wd{DIn#TM^g72>4#$OUP?h&!O9Je$%wjm(R?xaGTd?-5eif#{JmoC1*#Q!9b5{A z0#g&#pLEKW+>1!E`%bGHeL`e#^g!w+ZPJpZFN{?}m>W}+E~xWNlY4n>tz3B#FwnOx z=6>yCzSykYkjH{Gq@TJRd+6 zy$_{?xVO&w{h=D3`*h6qa@~g`Uh0;+Pb&Xt!qYqEe*btr8uk+K;sYfl!Hc@b+?9T^$wgyAvKW<{tlF_c0d>lHFdet6SmsD0SqO(=IW0 zePhG@Ekq;k-{QOOh`C=-W5JP!Zw2$agvW}xZ*F8i)2Q04Izf*dcTS5&%n>P>suI?q z|6gTnMvu3Rxa0BsJK>uiP2ucJc>X}{qFN>BhB|BNvKlX{B_gUk;FRgRL7JyD#d>?f zvj*fIhZXYag!MF(%0ASptWaPPhC5QnQncQh2Ln?$V>p0|xsNsq+e>;IcM`4nIyhZ7 zq$C)e@Z`nZTN-;c(MP0`?_s-1h4NKFTdRN}#-8yp+hgvB8Y{U`Wb);-i(B%EPUp)d z1&7!9KOUhvM^dCyXC*A7!8oKa?ymD(vL>aAhf}pW z6rauncg=sgz{XtyiRx#?+*dU!k*O;C3>Hoq$(Z|k)ta{UFw^XHeB=8aQ2b4tY~VQL zQZO248^`pddf}CI(VbT)mb#KU6!?sL7V38Poq|y0bXoMhC}m1Yo-g8kx})VzYCez| zH=Fe}mS$Ji`8Ss-GA3>Z*=L%gFxC-H=2xsmCY{6JzkyT%_o$+Y-3fnZsli!HO|2nv zG}TX;5c@(r*w`m2nti4-i>)i~QPpr2QjLgvXT0{ZD z}-&m3yBVnF$@A7LxH1-KJUY& zdE=J=V;V8JFCfU2eHz0HmqBWdPpX5BZ+xIEp5+NQ5%BrA^;pdP`SHRU=(&O^#r?Cy z8gZ$rMw6bjPFGeu*;{2cxInKyF%tbWMTVjOb>1dF$xz^Fj~k&okR4<8nT4#TMnA23 zuX!fbzq(x5MJO;nt_cP1tQ&q?8%ZvpMfybCd*Y>=DV(d!Df=-OFN8ttcvQ{fPTEz( zybcBSC;V(fopY2yUy*&0>=uUeZOuNjn6Gp-C9)gULL@l%83`2-nXPJJ*-CX+)Kj7o z*OvO|v$WJLBjrlqB`R1%l`bJ~z|X0gw9YSa-&|D?s;rjviF`_|rBDz<>%!gZRL^m> zO`*07#@rwMUytvT8e%8wJlXFnH2tHLn)k-1bKh&1_E%(fBs}Mn8ubvVh&vhgd=B&M z35udK>LV*=IPA z;2eR;WSsQij*L@tm-7+$5Z;`l+;S1ip%+Agh!OKt5eaSaqB>e3(JQ}theOH+%2rx?4eZ4WeR zN{v8Y&e?I#-Ee;%)8Fhf1k}(kX&h#Bi~#~$M#uONYDQzZDbh0{?vruQ>+%SB`X5Xr{a;58*}3+>%B%jiRiu`ZdhHHI?~?yV)OmnMSv(E= zEtg6l;qDS3xg>Aiw1Wf)y@e121f`=CkrFA=E`W+4n1l|3pkPBHO;J&LQ7n)Hu`3{A z1EnbnmPA1j6?2#GH+%8_<$3bl?(FRB?Ck8mTV`kTiKW7$qjG3yYE*BO62#on{?W36 z3hDH3y051i{W!ItC^g7(+t-L8C=HJo?7SMshevrtBxm*_U{2n#n zMb;cc`@>~&^CGNy#Q^D%XLh{(|tT7l<)y36>|?oY*H&=vTQOs0&C z-oTUWIt2T7BhOK~`FBJTho~2Y+OvxghCw^+-`fdQ4?$EOX_+ z$6`T?<@RLK-kSquszh*jvoVQ!OOxW#&Hg&guyYq8B$l= z5NeUM`scOZIi--DQPzG_RjW5jh1mfPM6!`QYu6KN!PdM!n3zRtR;_9T1uwByoZnWC z^#*%!Q-h7o-rB!Z3yI{u0JZ(N1i62Qr| zs@xT#m{j#IoplS)leNPt-}tK5kHdz{v68;WlSh!FG>th;aA7yp^a}%qKOmNfU2)ZS zkAnFp+3U!RD>rCPz;f(fZ{R~If081}?#2}@tV{7=wr_FIh3^(edn259f5`p?A?rBC zS-rTnvVuI#YK64~!{;yAyVg&GF|`I(A9lyJD((Lp(WEvM@(@OuWf950s3F2N3C`p( zZv$hdxKIC^Le@>g@Tw`hDpBJA53j9vYp&-`gR=CR0d3T6zwp;d?^)Y}6H%Iz?zlar z+0vFz%!0e)?zoX<5wG=7T_#K>eVs8SG~XuuAA_Q|vLe-XLE{cJ@kHd|Eez+?=+6M( z1JcZ&sm^5#TGj4d4in_6E%Ns8^)-rpd@$LS8?eH-8(hyMjMq*ub!5X0hbJfXhRCWH zRog&fvt+ZlhJARAt?J-lj5n%o`i9uQpf=(^fTZ&L=oA zE=!9y4{FU-o$@$q2o^j}5ziqGqp1~MGq9HyKDLp(uFJENd2#wfxl!yZ*82SVGU#^Z z9{KU0=Dd)LeMySrgz3z~9j~vYM=uFut3+%}O7sU}y{QSi^bXFvrFL$6*XvDZm|l-j z5|&@16`LKMd4sHmoLz{YO=scjR(!yif_KXd&&nC`+#ohiDOZ`hta#aX$Mxrgb%mBI zs4M67&cge_*ZaDp)V`o-?}%$tw`E(dfH49;n72dQ{8xY(crJC(;lXtl9s$>U77M$2 zzCBRTHdBc2st}0Qs6vM4Udk{rZxlD3KU(oMdQan)1{ge3@;LEsYUg$kj<~+t;@U9E zh`geFp5{#k!(f9#Fxpu0)kcPd@`ds@Le2N76juln?mSh-B3+4Wsnlbys>gCc-XzXM ztwzCUcAbR6CsNwzQ23&d7^-l;6I^!)e5ZiVDrpT9Fn1TF)~n$taw!&p&cXvQq`O5{ zlLa^QBEf@#duPaZX`zI_4%K>zpeztZt#C+$y@ZzlJGT`WdSe5gVNN?AYVRTeW`#&> zLReavIj%w82jpTW8z$U&iwJ9PX$Y$e!b%(}LUvoJK=ofk#UY}AV-Lk;cpj8?ics}i zEtI)oE+XhD46Oo8$>H3871$O@Kf-pM)hN*Nd?-zSEL8E^Arsy%1Z!AfQ1)W0VW8dk z5G09tyNG8bJecJnYTKa}v6;Ty!p>E#aM|?rv~#aZ!Lt#pQqQ2qYm@(#tu2+D6y7e= z)#BP1>gLABprqabEdw9Hsuf$#4r$du3X9^o*2*S!?#oa$Ho#1VXN^?&Zi3E2^nl~W zkSJ*`UQ`IN`4lKde-wHnb%?A|*$zmya8;c^<5yL~PY@|y04+iEUM+%=mY$5cT@r5# zNRg2sx-AV(!V0httOxTg?pK+8!tw*6kIq7xQS3ye&R+@}Yowm;ybToTxJZ$nytYu# zj!0cHc-Ne8Qw}x~!1jNaGh?5DKD(7)H4#O!u z%mur!@us-E#Rr%7S`BL)ZL}S!c}@z7ZW7|R$sXa?lV?ixilv}iq)EQjo%QQ}O-Q>_ z((T;u;V6=iLWuBq01vr8&DE>u{fd4lLHd>aPLzkp?Uo+a6MD^!ll5MDAoOMvNP zRhGcLydVMSCn@?B#L~xY!3Kw`aJvJU*7=RVH^Kx4=P@;iJ5&6byDc3ov#BByZ2uB7 zglYJd7AhG?xv!mD4zn@4fZvN0;wRO%RXZs*!*dBl@ii^sZ=^UWvo zfW9__nbrdCZcoqMZ@H_VH5ch}n3|D%LC?6d(LQ=H)APbOBft7NeXDV{Aj|XVjIfs? zvpg>X23NUNL#;V0^AoC)z(caHeM{tJjcIiv~g>eAHf-Byw1s&RZ|{^GPm&%*Gw zkbGk^A(N4|vb&voNi^<5rXjxHfyy&o!s{T|ao}J=>0ursYH`gY#chJP+Zrm&GQz8Y zB@iLL+Sf~Jm13rPj^hL4I>LEh*um?%^x)JUs+vEOGYl6mitgTiOe!C`4wkt-gq8Ft zq#luMc>wI(KWL~}8Pj-_Lvn_TKH0gS!?V6Lq!yQ@g>EI=FR+h`R}j>&fWu=!uya2H z*{sA_4|??sFL+ip&jqu-`u^Ivmq|64A_=DY7@MkK^(D;>Db81*Xe_csF5TcF;*_XX z4Md{q>At0qtvj|>QvFzCOZnBHnKy;9$ozy?P7&5l;qVP{zy2K|?Gw~VnCg@+#k;LG z(y(FFq>5DITgff7dCINwc2C|2$QZ+Ev$g;~Hl#pLUVDK0S>3k=*k`NJp1y8tt-!da zRy8;uI`QlyRW-SlP(&;}brVftbf%0UK=dR?ck|?ZM8S>$ss)05QF7H_-#rrowA(?M zqoF^Mz1yn(9mp5?4JBo|t*$Mr!+5^_KPTaG*sNpZh3W4m4w`S(vzSKq<6qORnK+C6 zZ=N{L;5l7QQ-;Dt5nQx$7ezeQMHsd!f|;yPpY06B6DaL3cDV zatO~;88+&9kVH6dJcptjb?-kWH>G}nwRucz+x>AU^f+RrnMm4m$2!WskbEj zfr2M#tqA`?M(tg#bxF1YCYo&k4i_L^?@F30V1m&O;Nt?Eiiw8@Th5hQ2S6P~x)V5x zj|DFZ$9|mvhO0c!8u^45kjLn3bS6)jW4KWOhz|m_e8%iTc(NoHn1v;DA*$QN>VF(~NF}Q6_MnG`kZXtHR-W55hqeepI`e@HWC4rf)q7zYTM^i?*vQCs5O| z!ng(K1%(}E+)8++!k%aLCj5X3e`)q1{FUTVlJ6iK?)Xz5 zKzIUSJeV5;3C~bCy^TSHPl&L_X}3{vuOr&L9niOc@Gd+Ukcq?aA%N;AN(0TIgz2rY zey2H%@P~w9SightYz42Q4<|g7u;I9>-AVXe!n)&CeFWj9!Y5aGs+ylv*kkljK-*HF zxzZSIS7$0{j8O#iS4AVmxQlS5f`4U7!Ct1(#j*j9eH_M0wdo{tr@uIcclJnMDj z$EP);Mw}e8;_-B*`6iRTtW9XeQ}DkPkEg(VN}EEGuR}*q=-LC7>Z>lEo})0`aaI>o zP_z!ifk!p50=08H%96qHk}-|gCc)x$+37-LtxVk=>3C>j`P$hN?Q2f)Xwn+}UdgDq zKW2*gCl8iT&@+aZey&vE&BpzN`QC${t4ux*EBGE=tUVVIHXKbgvGjae!FL*B<+(wH zCo2Qb7YUn=uEvAF`IJC^y;(w-4=~IhF-i&ZkP$q_nCnfk>$G!iVw&S6O^iBe6)ZwN zH^mu~o!eH`B~PDE>^v#Dqo=lja0KB<$35mk!X-l4@vJVEoKJ}cE!P&8fKbD@vZSOP zt*qymzAlPbFnpI*JUUun=gs23R;#S5jOAo~m9WFytcj7PoqIb4n~uiHL~|`Ey7{rW zQl;D?ESWbMVxVc~_ExO_ripdte(=H^)0JVSj8UeejxI)-pNOI*uo2bxkgzvJe;jRg zIFghBCX=ih#}NHVK#d*07*Bz}PV(yQwKWBn?wP`9D(#o)IBGsk;y8$z^*H0U8db+T zY`q-V>%yS!GM?-ern&TG+ z@jN@11p%$w+7yGzm*7hO+{hcR0^XZQsDd2%N>rsyw#C5gsojQ2SOp5eZs z!e+E%w7!L;QenyQt1fnvGV9eYnJ?Sb9e`@)DrGEb=Z=A&sAk$WHT*_6ju>JmSs!F$ zy}5&88k*;{oq+7zV$~YA8M}zZK*MkxGIkS|uIO-NVi+m+kfg-=`d-2xN!Tpb_Yt;p z?6Ml!VW^U2nP$XF4(zM@c zVhDLqVU=nJ2+xOHcvsyQYvsH9oXF!5$NMXmOUXq)#?Jma^vh`U@XXy%9w7x{_kf zH^i(_Eqmx$1I^>au2Z;PN&9wIyasjIl4WL(ZuHVVwLCRpL-mvRRTaQ(`e$}ELv4+A zK>M5u^m06JirJz}EcHn|lgoOK$+rF#X=CwEeu}iYlJO1WG$1Ed@m~vTvwgFKwR*S% zsv3WZ%tl{ASuew+=6KyaOSXwXHJN$bW9P18{#8%xB}axv%Fm4pU>p!^^Ct6K!aVAv zTIPB4J7QI;vRTRu(atR+MRzPRzb9p{q&UL$9|(V;N{chZ1hJ6{f2@o3;dT{XV*W^Y ziEuFvE{0i+YQmGupOJKD5ooL9!u1Mx>QqeyvsP(Uh^kc!<5zxC2XhtCQ|&P?7*`-d z)(M*peA9O6>{;e}O?ps*qd@W3vX&-e$#298zQ4H8{~Xnv#&2Gu%;dpz0-8i84e*9?G>D4B-p zLA&}v2^o4#$pn%ej-`gi*X|j@n&W0oCoDsY#_bS;a3rjnpCO9X1)d$gN2M0^c_Yd} z5)T*ALXoGDOV4IxF&r7ZWI|bBk5jBF)yILgJ)VVrbzgv&$VkHF|Hr4S@mCI_n zChV9|$1*%yd|gC0B7Q(6N7%Wt2cu7>D-|*WeS9Q=I}|#4ep!$0f->z>VzR5V zy@Bw!;6YxEqx3G9nMbq~0oOP8Yl)zdqm#p{HlX(bc9>6SviYot)oG*spsOq%3OvVaZ{8-zYN)_-s`hfBJH*bwM9nhU`-~-TK;HoI^OO?7lT@sCswX?v zX&tE|%FP`)8fgVfmizo*wFeR{R}ywo)XbwK?I!TyU$XLjjWoxtQq6Tz@hzc}NXpfTCEbL z$wQ*VnmhT%R*=IV3DF7GT>-~ksA>B1i219~Zkc0YNLo>je{`7`^EC=aJ{1!8Uy4*9 z{4Kcl3#Dgi^oJpEAWlS8L>0}3q9MHpK zRcSRJEY`*{1omO8r|RRysJvl%web{>AozZX&eqW15rnpqh1*$SjM3r9Brr_f$?!PH)HI7AbaxN)3W-%#A|J_B-)~1FscV-8_vIXO+ zGgX_;Eg%XpOJTart-|yQD1X>fLIs-a1PAXpZaV8H_X45^sN}e(CCx`@{{s@Liv+fV zc9|z+>t~M_w0>;MB{r4BQnUDdnO^eJ2_C-QB$QBJ^L;{nJJx>0#FzCK%c-62Sgn=8 zU;;?yn=o z#HxM=0h#79^ARP&n)Y+dN1YZ6<)HZ?*SANJwa-s55dmNAe=r`SmFr#8ob`uHp&`u1 z#uMy$WhO976SoMiHq{aM>&w+K9+!1ba$U7GJYZ5sPhsugi@R3O4Olg67?WgN3F_o~~t6p3r1COZ!2wJBWH1 zt1Jg?CH2D-oB}tN@)t|_5Kn0%d=_{%)Y9$~s?JexjJ>iE#+*Kw%Ih0aF_wt|{RqPm zOR%8M!Lk5l`%RyX#VIPJ*EW6agL<7L>7h_f7fS;zRt&IH7}P34Bw04gVyyV9Cm|Wm zs!UFBWE)U_Pn3e?uIfut&}^9+Bg)OF2QPp$Bztk%T`fI||dz%3d^PZ$W7hFyuq@JPG zl?S0ExL8Voflt*q9IT_7l+s4=DM`Mu5PrjkhkC#lwGzPqTnLF;J8lhi=oLZ;*Gt@>j)R}1)g(i5*T#6h5in=bN7K`+$VXR14Ng_7m%uJi$JKZ>E}X(KS5WF z?>N^kM@Gu)JIVKNTvGH5#}0i9#ats=-j*)# zT&x|5hKtc0?Hd~J0vx`IEP`&`^ktKA%)AiW{c1akcu&8167`AtT?s&xl~-DP8L@tp3ejrUhxuKv`NG(TOrPukp?bMgpxJN;=^>3O{Hyje!bDy8`>b{}<4aPN zJC7X3j!<6|bBZY83N9z(GDkJp-L)HTf7JH5#=LwhYU-~2MkW$%*q|`1mgr2_xS4fT zFg!e@LBZ5A5g9pVt4ain`$9Qd*XC#hy9YwkF|&9J8#w{(mrxP0wY6qOnS5iFRFZ?Y z%9e1qS{IrHodQM1{n~kQQk4CJHu{iK4MYFX1b6r_#YdBv0K7 z-SiJo)|Ut*Os?%uJnENx!xUB+bE-<7mFmhHwgsMGZ7Urh%Y(4kqE!hpcKnft++VRjc5%SUTBGNJQ5PPN%sZeO!p|rP!5l zItLfbmE#E9&x*FHaG9iGM^Y)vi5^2mkkbL_TOiaG(1lH`G-&@WwMu^%WnSGUndXCW z0t^jCW2a;4P%Q!|ok85J-De zaQM7dU0}1UMtjLzkGQjIm6Hb|Dj$IGO+BeaF@bRGcq-RYQKzaX8#7t@vy3==q1f-) zrawoR1tMEB?-`p3uNLZ8pkDZrf|eOC0R0%~EsN=wM@|XUEHt(Ng?!B00AKx4n9DKL zN-HV{b_f0~kkc5G$TvLmOI8tw?gJF@2eOy~H_dC8-Zz8tGx7gCXbqqn?|%wRL$)49 zvZSxkva~%76AMdf8|nlSTRvCF%h`Vy$Tt>SyT=K9NP+d&?DUNvH4 zBH3}kI7H3wl=3fAeq(rFRXg0?gD7qpBPpWn&qL}NOhqg6$k)U1g7FUdHj!$)3|{-z zgtU1K`E#xMHBsHUnb7oS9^V!pTHMT)cMzUE{(uqwpI@a8p44GHgfK%c@rG&MC;EEp z{n9;TmosW-9iKBIL&nKQ^@5^#CuOlG#o=s-5nQJmioib zVmrN$!};y6mqo1O_Dw*$ih=Wo!G+pPhujG}GNP5ubOD|t)BT00}=>#_!0@dr}N zYFutv#J+}-Tu+j1PuoKczU`-#`hLa>h8~C+g$ecVJl6a4Xu-kA7$fCicwBplnG!46 z?Qd`$7a;*HMV0<77df-7*lJ}|7N?apKZ4I3Oz{;jK7VZCV9BZ*z6rLchd<($UnIIm zS!Bg*DQocb@9L&*tR@@Awr9ORwsN?F+{E2=u|5B?G`2T}kx^Yjg4*Ygov?ud^j|35 zGhk&|?E84{z^%S2ueCom3a2~FvV>LJ^P)fEOu58U#gN+e^!7)@arr)=-3NL`OuMqw z*?2e#YELLTK+gz&Y+`?jM@x2R;XHrDBd-hk^Ps!)?kH^_cQ5LyX9Y51x|T(R;ZTA1 zyI{o|jA^GXFm()xb+|t@=rHRpyH<)*}i^LX$ z+HHeBc2*)3AGO6I5h#jVjnP?%V$rky*j`NJ#B^NpxFDup9OH&apiQU&&sQkd|806IPLBB_UcE~=xtC~0%yQl( zfL3~Li0hgD*rsWus$1jUpd%_tO3jfPaz}%@2kU)^ZxVOj<2nT)1T9`gQ-1>gv@R+#O%&p(XG;O+6)M(7Z1~W2yPqrap!F-YyRR} z5?7cM0|P#Ug9dTB@6inLr|%-xuL<_hqj?;~-~8O4 zkTJ(64fxeF;8I!aes#^94H{hQ2kQ@dS<1MDL~gVD8*IY8NI>hT6o78Gc7;Ui!NHwe zmfhJzVq4K~Jd8z2DfuJJ!~wtJkbYfrVtt;$Fvy*^u`J@TV8asf@oo-ilw4Pu5U3ToJ9DTatX{SHpulJ-_k&5kk$saNN zkVJo1EME6VjQl~V&;6QMs@R^#>B8cBM~kKYTs3G}2QiKR6>KeLIT)cYO{ZP#OKAUn zYLp8+N?dc--XwI|cv|I4^&UXiIwJ}Zm~#2H=8UM^$a|NS80!VzW4 zCO+PcwDt`I5O#;MfvH;gs|Lzus~tn{XMQ_>tG%+3JrBFpRCy9aQ;E_N|I zC#MZZSpfKSF^)M0VC@GA(90+U;Nsd^0ylZU_}l0TU@RDmPAPz8h`G!p02y-?;BixI zX7IPC&A+GsOLQ@u=>;H_uM{-$4Y8iVYf@N%VGKY=Q%q?3!fAaz763*oJDME;Hgr~i zzIrb(_CjMuYXz98i%rc%0L>X0$o_XQ&eAbXv(V)BgSn5+=U*2Ls@$lp~vK zIAC}UvCk2AFO5D?fY%H$(y1a#_%#JMr4A&L=%;&7KeDVh#9U`Ig>dnWQ_g9cnCx%? zS9?HQ@8~V{JMks+G-*!98-|$eaFxs<*KIs4u;ds6Vh6??rmqp2nC~>=7SLsGnll$Q zMiXBIGxyI|MZKvkd3KSbn$I|A0Zb&*#nWN`$0Yg#j*W4JVRA{A>0FI5mfXDkrt`sO z`+lH4jyN|xwC$wlIKI;5Xan~&TC9v?`d<)hdY0%5s-roIv@AhEdP3Q*rD2K!qm z|MR&5G}Ptj<3|94nkm4C<}?7}Meh|p3J5txn+|}hAYoG}&~^+q?;*}b6>Spn1jmEM zy~O1vR=a7!z<%>SUcYX{XN}CZF@wZPq)sa^S78az_D@jvBue`{V$RG7M!qmaq28&_ z0@X$#{^c7;-l_Tn06yk|2!lU6Mjz|5i9bS{R560q=m)epJV(D_l0q)h9whN^YWkR5 zUDNJ2ifhCV)QhuKvZa zo}1h;_zHRyWV}O}kxV9Q^cS>MIl&HNs#Q^6>Z?h7RkUZ5WL+mOpX2AsumTdjTYKCW z3*E1lN-R!$A}7%PSEv>^V)ZA#hYKDMHoSI#R#n3f)#KHrPgA zZ&!0)%jgLmdy-!K$pX0h_ixHKMr#{$0`W|lYP5akCYmmKn4&*JEnD$wW!y!kR?L8^ z^2J@;<`;zPht17)bt|GaKyuU=Nfhnw4} z+FXe94iFVzgc5NXx7S&jzj83kS+U5=$Pg@ za}NM+oyrxrSdOTxCgI3TpOmJmf6~}T>Q|`4J7iCD^wnP>{xx;{n<*6+p;%O=FDJP@ zx!udjJxIomLw`sj#uLgxoEE2?5;@xFuami&zRq3jnx-qYH*$ib=6oZl@yKIF9Ibfb z6{*aJL?>oI=;yCRB2A2gb~X3mHRcg$_(81#I@cHoZjwnhx}zR2=rI$j88yZsyZR0& zjX0ocP;MLs`52kYVX^rJSe(oqIOS}vabL6e(G5h>p&QHT)7zkmU#vyM6C7JKSv)@l z8yhmA<#6yQIRLpy*s3i6F+O|`0Qc}Cx$Rp$(A=TDPuv@DkD{z8!+Gl`8&0yW!==I2 zcGZM&URq-m8ple`(;$g6REd$s zaY_)+X+ND1GV7tbfOL%q3y{=!{X|Z%*?Ws5Nsg-1yuqpcpHVr>^poT~gKwd-jS6tc z_zb{gRBFW($=gBu+^*(}ru|c@(%YL~kUj*!cbkQt=xm2Sh)!N9(K(#Z-w)4RU9KrS zZJx>rB+W+%H{qJ{H2FI40g}#cJ4WeW6aSTrksTpy;@8vP8#%JNw`4K>RpJH8QibpCIK8OzbF>!zLO(6OHeh71-GqKm(rJ{sq83 z_+TIn?jBF>S$uu8SKC0$f%loJ+Y``@7g~wvM{B=gq(!aIkvH0rssBb^H*p_%_bfvu zK4xcn%y9A=T$ruu(;K1e0@*=9zk?jc2sMlNLpQ!*Q&RAVch zh4(UAbKSM3QL%A7C-`dROcL}#u=FOLc@0L8pz#l}5*Od}4DMb!u|Y115995G8ZqNq z7n?QXt?2)^s;@OiUaQrNbCiUaXb(hqQ;#f?)8_})t-8h)OMRSC^hb%-njXVz7jW04 z4c9KiJM+?|fz_Hmm3!r$H`wAc%uj0Vy7qaWc+aYXvb<%6k-^K3oVnEuw>`On=IEkF z0A(kXFZFaojJs^M(&KB)Ax2cTXXlL0GkRNfY8(gj=xom@%LUf=dL4zeUYYAPF=B|d zCBMUr(Cey{o5-*4)$3(@xRt=j_`VUV;By7OREsO&^tL8?pIJX!?#aRH3#L;cv{EE* zQ_J0k;DjHh&BeMt)`$lo8<2jhnUL-2D;Hu`>J73zi{)mZyct z2uGQVG4vAIU~^CtzTZr+HgBoh3Xb^#v1hUM5-c%T)Etp|1~K-?Yr+m`nY54V z4l^s;(+`%Tu4}$W?OZ>2rn%hos$9FFjWJJS+tZ6Y5jk3uY|l}U%@Vwcu?rc4v0kpi zJS+Jek(%6;kVC#m#|*6*;RfWxh_$)xxnD{hspr`q4n`2fRK11D$#uCJM{lDg+|<9_ zXoXiQk`1$w(OM;6hp=Hb)Z3`oYEEvnJJ<|utSmWdv`noXRwYJIoui7Khn)S&f!$2O zd{V-pOS!S{a}=O%m(}R4jeIgCt81?r9=SbagoSe5OfF+aD7;-LtdZ?~WeLiVCR_Ak zx8v*`I;N-l)6Xr z#b$Ws64dfF-(_WS95CV(IxT_oYWnKUVj333;d1hgX0pfIGsMyyC>z~DWm~w(R|0ce zTr3NQW4b0K%cVbV7?2BdyC63?e3)Wj(ScGl(q(~W=W?>fxpSy44@o#WRP)Cr%wEiY zWV9n8oaq#)?N&twVoNz~=?~?I@8x{5P&nfalH?m<66zu4a!^Kv6ZDZ329xQ1LsaCP zIUHZG|D%2*RO&9F{!gev&W|KL!?TnMIpx@G|M94&BgUHvfGF8Vb zlMAtS)*ZR}L`v-nFQy@qV}D(Cj-^bgwGs2b8U?jKcvS8#Fxeajv$0^x@t&Q#Ofdfv z?lL@Y!AT6~0#y^SmI&sb2|-^3iUBg)^m5GMXdDtf7b${{2Eyq&p!y{fH%{tGoL(r| z=r|p5DIiOp2PrK4&;Qtx+qY8IR;Whs0js<#!}Bk?q^(jIuL?WuLoMA3upTB53z%XM0>rG#T)n5;>M7hE(rL&Z{hBTu@ zWFL}gB(;<9o1)+vRNUC-abcdrS6*}UR1(&fK;eOq?Szr370)V#MwrZgyM`2B$LLgO z$dDu5G-P>e9G2R;t+9{@Q$rPEaoikY)b(+wSusWqIKHJ8??cnkQaJ1`Z6l}6pzjms z2UH^GKB3CVUC=l$!pTr0edNovf?6qB)e-!-X^{F50%m&x9MA@}KS>%LYTanAG$-Hq z0I1$ZN_tn)WoF*}9tm+Lvhq$h&wWvS^yYs$@pz~nqk-$nW{1CD%ed^Itg(xWq+qbF=jwFLjz?6ulifXkARoOfP=h&eK z4K7*N+Baimqr_lfMO)Q#vov_8kYF~$zPbe))K|lP5k)Ri9i2cJm8|TV;rSEBqb7-B z9E7YHU#l2CF$8(f0;H?qpq?-^UeLaf(A3ay@hc4!-z`*F8)t3SESj@w`g=mHq!!ew zl;LODTA>zE%WcYj5gd&4ItY4J4QXLMslVTUUDMtHjCH}K51Kwrx6Tt}MPi%4-RgdA14 za&jww7)oZLoB!I=pzd>9Ub1PIXb#>LL}{KQ(@kX3rt8I*BP1{v?dgVMt?Wk<=d)}* zN{Ji+*Jx+Vf9z_kLu%?gY}{~K!z8sYC%koG%z2hW;DQtqjiXusqiG6?77PEw(lBc% zvGY*AKn}+hLo38zK6%ZjkzmfxKy^o7%>a5sI6#_}=iHWyxmTEZ$#4L7TMLBmy-;~M z85~DF2v2rf1wi#aOqD2O)D&9xVPArd~_U z7|31$IjT7o7Re5L6rs1uf}1dQKx0W(*1>gvHa-lZ*^1NL8Ey+748bs*-&TI)wz7q* zL=MD{G14;Q@@a1Jy(!pYklatGX^z*l1fZG1*^4mLoi9$R{;J*(ZiE1i1w%J}cln@{ zB&9meQkQ;AahWx**FEHh!8t#H_Z^vAna#|U5NvikL^%9k$+8*JH@mIVP>f)>t87h{ zdZVC|^)__45vHe;XCtUu8_a>nlAJ_`tD5;0ApH@ecTf(>~U@CTu`EyL^?0zv>%~6 zhU%^OD7RUcRhH1<_K7YlZIu4EW_SL#ZT2YrvoEa7(QI3`i8BuG(%ssDN-J}uJ~zGk zUvIMGbC=c5N=xDW4|_zlZ%Rd5k89q~R@z8ib6vP@AMH{Ry~%aq525!W<7t42OmT2Ris;*1e48oaP17Dx<6QMwMRdMv-g?0Zx-R@B^^Y4(atfArT)saH%1N%KshKhba= z#u9vIh4s1X!pFkGW3Ix0otx*6UUpLC&`Wb}3b^M*mFDbqZ8~kGRT#@%-(t?SK6R2y zgXdA~1vv{H8Tnt8#=qezdQ3?4cWrXm+gDfQoN*mqBq(2NPOHWnj89l$Wu6P?@!+B` z+c(c2|L!a+bCe#ZIS+?<*QYMBvNl8wG@MpArsoy$TU~`@E)BcIH9ve0PWI1MWimk}jl3J6<;u z3lTzpfAo6=(vEFh^J453)fLgxU7KiVztP@sUWjqV9jSz5TpD{>CXsEjmyS<$ozmasIhseB{nOGQW=Z=RfE6Z;@XgcS|&qm8S!Idl5aGq%7Jv;t! z1k{@@QJ7%&xmaP%v$9e~G}Y{*+4lCi716n_!%tdi=fc}-ypHY6d%hz2P!eA+S|=%K ze*J~n=fayTwldGvf00htzO0Ck93Y~ZmyECbf!7AC&)HSc6dtPj5{P?6z z-6eM$*M)}oDfGAfJJHHaadgE_v60>9kUu&lLt2w(**7(^x9|5ySEdNL8kd%6#~iGP z-s`gdveL@JuIq{O+}@Ghes#^G!;I9|x(+9L3sTnIBh)7IsC$yP^Q|vY>ki`?Zj$U3 zXZ<-puD3G%#$L`L6JDV6?WLxPlc=~SBmeob;txkiY7^bLYO=lkY=t$#br>z|9BCz4 z4cuB;S$yBdg7AXwyes+H?6R=>Il?IGxXM1>QFh1sBqlvQ1xHY&mOH7?mY%-TH9w^y zJK3>{=IMXf^=-;S*(3FiR#vdjTC8eQ-GvX9T1S(L>Pd5*(4Cu7>9nVYY2K)8EE0XQeFc>DC6(ALd{lblCECPHAUl&CM#;*ETe|HFI-7nYH1r&eS-~ zJF0!~tf=OE-Ff2Xj5C)?`&=QPeu-l3grZ-ed&4Ci@!6!q9_Q}xie0ZK9gaf9VtV7K zFWs#*FSX#aVDLtc{zurpS1aOwPMX(IddIg$;)Udti*4Q71}gH%-&$f}3bx@D@g+%x zqXa?Mobxg=O8zd(`D}>=>j?QmhWo;urP0qPX{`k#oA%E1rX=3{sjyI)bT}0QkR?fn z<770xk(6dF%T7+*krevKjAn4nvVFh$yMA^^nsni$F6nTs3T-DiI zmQ?zqm3h!Gw;B8C&u(p8Y1d*at2FHEqTYFqo;kyHxVg9VFgme5 zbzo9q6X46Jp$oTj^YgZ3ua6o5zZ)}M7xKKpw)gI|GK0}9F!~%!DSC>wSoEhw|9G30 zgXso&R#sr>L6_cgel{ONYBS^Nx@KKQ&Ne9*?x&2NT_o2^-I><*GPQaU?k0TXn%6dE zb8EMDC~4C+D{Xz$tF8-e-4{BPUYcb&&YZLKQD?a|d2IhVdirz(^!1da!!6vK8kWUZ z@3WX5U~PHq=(X$$gLVw=Dn_5%yNgDb#SeQx)c?BcaC`URp{3D}!s5&lCKesMXYq=a zm6F%quvhGK&oj#6e;g=sVTicU0Raw6(k3(P#eCx`?C2cO)PL!ROQK$_bm!{hIdFZ% z%JOgF63zAp-P*>|oGplHhL>r5ALsOJzqKk)l)Ying*M)^Pv#|EKpW0+$-wThaJs^r=ku;T~l2o z8-7j{lS8&K$Fu#$`FADOLi2s&ywcR)_UU#i(MT-noHDitqNH*kT;s!Ox;Ncgn!^~9 z{EO42b@#6C{W4u>RTs@UV7a?!Xjy#S_eG1IXY$(JJ7SJj_x;l>5w!mn4`QYyfB#!S zOxN*4g!7^QcSaO(MxSD`h*)82tSFkB|1d0k${I(kp4{5r7fa0lEk#NqN_49}Yl^3g z8(^8#vO(XHNGna28QQ;q76Dqt1MmPYY1II}05Jb21^Cto0GJM-+wTfc-v|P@A3%#? z3b0T$afmCw->79 zL%J+{-viL5g#twCVE`@zSi*#KgdUb@gadGO4Lrgy>WP)38sZIUqTY|lK*=d;B!FS$ zX!^AxF;$BKa2`N3Js2*}n9%@c1DO1w0t{x2Ea!Hk^iP?2fpNDX3*}<~X8IN2Tca)j z=4SeBv>zDX81(=&0Pt~|0u0h+@q7n>$C-+Q@s<_`U=skWQw4CJULU{*09K4p0A?cq z_5&zkYy;yn%?03R0G$I0@T6K(Z|a4I2<$dBmmEneS9xP zeYhd3@P}dOhl2{x(ntm{1HcW&70TbD*5nD$SjIpO;B_MvjOEaHcD(|0(JcTyq?T$b zwAU!Ux|rCNK`MEghO7UjyXQm5<2P^bc;g(n<#D3ypS#O_CGK zY4*0fEZUy*LT2Q@HB-&3n;igLL129u!Qr6F=m?+}1v*&=kJ9mcxT9GU($796Q7(cP z4_XC(Bi1PNZ;Z~MHwN&=vkGuYF8~lnbr)D!(7U2{A^s->KJKqryrLBXNGHddNh(K_ z-W9+a0H-D@z;D`30Pcf@w+XSF+_)1Blk*A!rmF#^D70AFVbAnaLX zR(QQj#>QFY#uMoW`-i`pRki5a)J_3&dQA4Y<%0tDy5$p%utj{AuJ_Y%F%a46%yQg3 ziS^;cGx2)4;m9ZnFQ66;_@M1-sC6LdH^mt71q6F?-CEMjT+*62I+FCcE>^iepjS2N zBW%*_;L3qvlCs#GK#DZ!f>9fk)FztLLjm`dqW8XsC+ZUn8!v*Gcb zKrG>csI;Zu@LrZuOWNiGou-LR<9l!!T=%?XCOZ;4A>8+jsa?D!anyNozDV0NG%;+% zI-;V_?DYI8!ht>Fnf9niiYXS3OA++WnO4L>Lx{esip zfXBQKzk80Q**ZR+of5l+Nj5YJ&HKT43dt@?&u80?qK0cT0r>#!PhWSJOa%0D z4gtLzSC$)N(n|&j#O$aHAMM-?6=PDZ$b46Rb+p;g5aUOC`vQOTw{xvb#F=l-0dk5} zN6++w&8#%OA1jm*DS190;5%jsc+wXapI5`r2%{9hQLykpP^vP%r2I=9 z2jo*x;U0yUZ*%q7=L9qHv0~m^`*`m49I+TSW{`MzOUXHMk=^f3U0< zR+`1tTVbjPOj(Y;=0l)QVF7pAK9xxY8|R;?Z_Y56DI(qcImfSBnRCN_G?v?*JalB< zEy5{RsQWg36~-Uxq4+vutN?!;fa`ezFc0f10c4fDN@YgAB3V*Gn@l?@+MZ88!@9X9 zdb|E;&bjb=rpjpZu(qo4+{5KY4ou~kxrW$C+P;H+tNaB?o`R9&!DcYII(@_(D{XGr zYV&c7_3p4D&$P_<#F{6xCnQ7eM-|rUbatN74jEf`?z5x?l4^U3S$UXg_i37y`f|BJ zEH!quzQ(r;eR;)ll=alLj1ec>SGU!#Xism=EjOaK zTbU(cSh<%2-3{TZ&q%$>*xW7jp6j*nE+vVlO|hQbgS@Y#S1+{Eg3-5YzG}PAj*2li zrLS9{RI!h?LAX6S-5*`*RhqEK+z4bKy}0MiN`7aIO@gvwnLpn9kPLv&YR~2*-@Jq` zQG3T#xK=f7^Hoe$49H|JC|{MmA>8)E5Yaf{jRZ)^KbR^+r$vi2JfaCk8E zE4W&1WtHXQ5dK)NF?@SZryu;xO5<}oMcV?&ziHrs4_KM&qIlE&B>-p86D%Pf620Nn zsc-u-NaV9DXxN-vB6z5KsG_Txp3f#DV?lRgoA4ZSz#lznj>wA9VLK4-diNoF;uwqO zU|O&P$N?(ao4N5J<5O*C&e>jVWml)2wkv0S>K*Cp-mucngzK^9ZhA0d@`vdo&RQ(+ zZ!?N7ZRgXq^0+AEQf;rVE!@3g_nKtc`H^OhzE4W8{H|hXV*0w3mUP`{WqJ7+wR-ZX z$XU0|SG#yc&n8=08{LoT`%9vIx#{P!cNMFz*mv4%(D)XzkEXBNEUUNMb$dkxQPr{_J;k=goUDy+lpC+5SHG)Ta=r0B6l~ug6${U~tQf`Q zVEqG_^jxPyuf0>%e2MlUSX*dI{Y$Ai);%kHS?9kiH*R8bGYjWjACt}$uI}FS{I^A# zy)}EKuY|7i&|WJumA$HCIi06mbX{m9`UM|V#XAt}>-Vb0*rR_!_InU)aZlB?wwosa z90pMTdj(jheG1?=>b1(s!XGiw>gcLm+=uWUA}n9Pi{Wx&LGiKn_^4pcmUjg5r*uQ6}zUJhRwMUwg(I|K8*ooBLM zKXaS;sD2t2oF{TBEGEUH=d9Ad&KYIb>nzoC>)+&*CZXHG2aapDuV>b}ci`i%H>Gy^ zG3{&@Z_SBvqf2_pR+=PcxOpyTy_*v0;7QtfsGdaGePbIWaP-9&!V$Z6m22&z=lt=}k14ry&@Pf4i)5?l4*{6FbTQ#{?#}kdKhjp3>J{oV zzJ}@C{p?iBAm!v6#im7TDmBTxUAqiA(Q;I5Ykq!feZ2l7Qk&Nd{(pU1^ito3DQBGC zEw0>{OII3lLjO5u{g6k}tFMaK9fx!=4g{-+>35s<$~P9$jblJ;`Wc%kL%pSCJBaN0f$i_191B)h`|Q7u zTlNMYwy}Ml;UI+7)5vE|2%YUeRK&B`8#Qg3PsE#aBwm- zVd404;|15IURGMbN+8{NrDMe-HC9%^nvbQT&OF;6om*hBry4}nyYmEmbR9VC{g*DO zC!#CjC#&3LVT0IR`@%WB4M%xoFG>-f8!}&dn2pFXhFZJt`!S3UOJOqZKH=G!*R8_h zNTDF*m=wjfZnpjUO-MAAOQ6S|Y{I~r4RYCA!YEs(ZIEdDQ$n@}lfvC>{$-0e6W(6P zi~vcD!sEd9bqSlZ%Z(GRO*5=Cf8Eo%?_KAWjEX+@OV|HLc=n#n9!B+>?G&ocEA=Yk zh3+)2F+(bST)Dv}WLeK1s>zcxS!0b_%wZq-0y*zf@g@Ux7-+yZ<2*%HeQg$B+Q5+x z)09zjj%mK<6*q>(2I8;~#imM+OOxi%z84v9Q--qzns^s6nQJd3h=~9JA&v ziOdllZqHi(;d@|@ma1->U`uQkzP3IXc^kcG~$jq^nh)y!Yn!e$c3wJ^u*EI zq`|kDAp7YAJ(1V=U;Zbc;Z%Imr@GzrxJi8mEVJl_c40vm zfzay5OkaG0xuV?2qoEe0b5wMvfsXyn$KY0dno-2Q(xH=7V{kvrb{afH(n3_-KA=1A zF}6{~k95O^I9I)L&XE^aU__oXiobc3Z^F2^f(89C|ocAC~{*B9``FHEi>Eq+{XTvwg6^d#*?^~&-wV$5BUpuO!VH^zO$PJ(5p+`Eyx*n_q*G~NS7C61YP{1k<{U+k#9 zlC#aJ(!iz5_(T=V{DH5r26zYPSKBY z4DABZ#mUqE)pR9bQCvy5j~N)+QHD7Ja`w(3434;{5l4GKP@_ihKF}o7>yUf z=>fre#dt=IfJ9@=Vbqv49+@6-C2=K#D9|VN^AHc?-n$B0KIkpk~faH7kfPTEv~;wq{v?1if_Kys}3JPfa~T> z%tDNAVA&x>7)1X7WlHz$?&KaAVjR9sn>`HI&sR2xo!TsAeBpgqFqp=XaS~fXOvi-Y zG^Bs~3f@hUvd!Kw_$Nd9j=U^>k+BqNY99?j87!P}M47!|bU&Kh30(Odc<%U?w>VsG zRAGqZRa{zNC%{=S~hDKnGG@M%PK2qdD7uXxP+{UUxy5l@zQ~$g-mZZ zdlsu7IS@ryS6Pm9)J*aF-hGgNQT=$z4~o!+V4BiY`*Ua8@EcyHpL=kFj-fe_iQd!_|M8Hqk0>WLV$kzvX1#5F(?{m+)^=DBvmg95$ zy-o~9O_`=ofO|-Nn`-l}Q^a2aLuXjZ zsa<#av?c1yXY~vSga0JTp%PBTco`t>EFIfS`I9J@){p6fvpNyR*C)!t30v+IlEkN4 z@VbVam{mVh5nZO{^CItNJ7WAyLd{~hZ0Sq~4<53p>Edh%T0}gY8m?IG7HMNLGM)Yi z*|QrXu6W8toFe=>{g|k6vwNk+pu+@OPpu6IZz^JNRmiKr{;GOj11jO(wfPr{ysUjk zYP0NBnOHSS5z=jb8!_>3bc$O~wBKE)2s>=8IfQaRrxC4PHk`Cob|$P!Qn+kl3&}D| zJ#EtfYo&DERkhPoPZXiRhNnp|;nRGd*w9OAueXmW!f;#e2_k-33Pixo9LqUs^LCSq z!s(<7xK+x-`;^ovOjRsxHt%#oKLJV=WQZD2jQ7w~>mYQ69OLiyxSnO@xL? z)gd*iEf)?8SRTA92Fr$ZXrHf6A*Pc>)cHB%lzvWZ(CR?QgIQV*k{U-zKJ8c3p}BUl z?C4?2k0V)`r9Ax%Y8>xB=M#SFOqBDa*wA%qYyEgd{KbR~g;%&2pu~#+hoVl2 z*es>T-lk#9HG^dfj*yQnEf^WE)dP!#Qxr?FsV0$Dr3o5FZ6BeSklyB+PaXaQlU||< zAIT+QfT$yhWJ7pOs-X4-1%ylQ!}iTP!OvQikldO})VbLo&=x8xOt8Cj=H}U?-zKRc z=mks#Rn&6!m8j-+G=>dK55(EP`3O<;Rh1n#n*b(1WD%D=b}XSx9q1xp2+L?HcAuf3 zLJUsRnWXw4egSuZj+6QaN@l9f|Acg2B*kgwF&D#`xy6I^hKc< zo?Jz?oH^9i`W?x41w3FsuJAi^X?s~ngrgbmYABdVwpCjs3&Uvkm%t#Z`fp=bSSbs7 z%qtCA2pd9z{21r#1-8nYWR<@_Rdi@aj%Ass@h`Nx`|DuN6+BA4>}iYc*!-A?!Yu&P zB~0NFqd}+SEH^ceAU4_oj3>dE^EdlauYHTzg9Whh9Tnr=bORKl2yFrZRAJ|hrLCg5ut+M5MQIx2u>fBjM zH_rF-c-X}KWkVwU%kl=f4iO843uQ1~?7BWe`x0L;dP6p_u^x*V{wAofJN^UHLY8`UmFKpcH+$_DwCr75BYP(L|UvpVkb=FF@P@pWIkZ!68BTXbhP%bcM zX7c6CBz0m9K{7;D!xVmPcTedCPLlS)hC|@=M%jIXE{>%sOpqQ6e^N7X7_LH+#bCr5 z&8r}$V$vZ+fvInxrKu5fNW)Z*;}Fq=HMjIT3FjqDD!OL2Pu#Sg)=e0ef4l?<3WPmD-(+LBHeJGr*oUV;{Ng{BF)Xb|;cw>&?s%pSZF& zNo1x}9T!WYwC5!ceFdI|)niNFL5x9a9p59wfEmqKY0~gJeC~kXd}y=V<*m z`JQ6%FpGFlBDA!}?7;6Om`pqh+dqJnNn=TAjAwER0`G64n)^YZ`qx}(*l~{KL;}mk zjN8wE2-;CEG0R7o^0U+!aJmx*WH(C{9OjG-a^|?GTI16xj&ULa0kyfbw=A4Pa&)?} zWe%_ujN1dtdqq_3JX*JYs6ADkfU@*;@bVgiJ#hyOJQ8-WPhER{E^_f%7~f2^Wx>t@ z@{0pt8rNu|cDMe16tjXln+?Y>90#8hb~k$vc0Bk2CiWKfZq67aXK%p57}p8Lj;H^2 zcQuYkh<97f>Pn8*L^i(+rKHm0=!3(^XgXbDX1mBGA#qk6U0W)P22+N*lb^zJn@?6# zQy>c)N$hu^hm*A2aQwR*mC=>Bxh%B_2m_Dh495Bh!Pw>i1mC0@1B-lSCW+A4a^0D( zTaK5TU5L*ARCau6ji?kg-fo?9o$aXVi~gY43l(7bOz2#m3PVog@6+?lwzYG)|37Rp z3NKzIdi7jW&lU!=?eOf0m&J$C=^wRX>=dd8xaZM&3sOH76TQ4&=b{}Rx201UswwdT zzq5%>2Qt$K>Hh01RhCQwnz)S6Gj#W^P2hV0l``8L$4`(AencI-$5W9>SCEc{3Qca~sJ$kiKs`bNO&L$cCQh92$D66sI<61y3h%HI&>cVrB3viWiuT=D7r;<} zlWq{HPD5OMtEQZipyPA`H`2vFzNSSbD5EgcoHA;EoQ4|CQyt3rL^t~$IpQ7EXAn!J zC~tyMJj#c~F^jlwQOi*jfDZ;x>%9_Ky2VjR%Ig5H-y+A5uXR?MHH~Ur%5I?T)HQjD zI(?BH0Ma1uqIao-)Tj1NWI8Wv`xKwIG)b3`z627U` zMXg)8hh`F@FgLqLI@-QJpY4bZO&LtT=Sk|d7p1g3kn0zd2wX`rVEJJH$D(D?%LINS zMMrAp@Knw691;=&)>BYl3HP11)ryuGXx*cPBshm!f2mfrTtVyZ*k;}AIc&4%c+a(J zAPs&($|RJa{jQd_EKPK?!B`M+?MQfK%ovPu6NEn|P=5!ovd^%d?0nR?99T_Ff1?o^ zd8%`ni(zji5|~CBUclr4dVO)MYdC5(vj&z2AlFNx4hh+)&G4rlE1%A@b@srTQ?<0VWrOtC05m+(tbfCjCxk z-2k_Oa#+kWtpzc8z^GjDwd+JUo`fiH69JaN3sk}V3a?52_L}ulx2GX+ZvYn2-&U*Pyw{P6L^o=w?Sk0G-xJCE9EJbVnY0 zzLEMbB;#yiDdn~SDc2+9>552jm(-kFd}53S1tPN61UHMEmcElc(0gNllG*^G`jII_ z%S+(wS8TReu5izArnepTK*Xw6LjE9|aB-A>ON4N@;649twvk3H=3fO!m500c5SUCI zu3=^Y91d^}&NXiK3W1H>Y=HGx2L3bxkCSfB@syZ*3zUo35crkU6f~Ec5;i0)Tnw z-H4qZiAU(E2UFyT9a%S>ewV}Z;{m^ltXfQJyF`!{BpujdN1k)mdHQ{nCb^lX1Rm}u zw3i^-31v_cUg}&iX){>x=BTAWuIDxVc^OpOVHGztGww0(oP=|xS9s2 zV9NngvhAYPIT(Rw@1>-y&zZ%5Cjv&8?6&4f{s_%?{1RYP%=dm@F*sUdWnOYNc2CFa zcn6vQ=8UIK+hAM$xn+*V=$S|8w@hlf%26(mt~4G_BXFS9ls1-IfdY*@3RLb&N4w5s zRyrEBe2eJd5EezxX$W}UK!})Wuj;uQjWSCx_5Uyxj=Wcw|3RjB zm!=rXu12GGAlC)qG|C3GLofUR5%R=BGmx8ZYwU_z=F;x?Cl~x_YYy?>x zz_8G~n#JITpc_yR zK3_I;jSo=WA{y{(DK6B*f8_AF?ro&st>orQxIJjs9YoWACGZ+?^)1S*r>?HqBV4EQwJbsE(10!t9wt9EZV{?{6g0UoaiKquDd4 z7UREin#K=7M|>D}2p!@1lAVxObtv^+z#InjJDgv^eQNp=)PonIe`gQu|D%N(zEAqU z!G8uSH@uh=oGuN6iSuu=e(Ee%wm(M=&mwhLjq1}`wnS7OA|J5Onji0M%f{QH?ub-5 z6^SvYouqjqghk6{U^-}Iem|)(x-V*BCS?FQBx-Vtt*(DDoaq+NfRv%=_F0%5#xVZ_ D=%5oh literal 0 HcmV?d00001 From 994e506b650017fda3f18774f1558baae167e36e Mon Sep 17 00:00:00 2001 From: Marek Svepes Date: Fri, 9 Oct 2015 12:07:07 +0200 Subject: [PATCH 011/169] use-cases: basic_modules.sh: input file can be specified by program argument - note: in case of zero program arguments, script description is printed out --- use-cases/basic_modules.sh | 71 ++++++++++++++++++++++++-------------- 1 file changed, 46 insertions(+), 25 deletions(-) diff --git a/use-cases/basic_modules.sh b/use-cases/basic_modules.sh index cc42186..cb20580 100755 --- a/use-cases/basic_modules.sh +++ b/use-cases/basic_modules.sh @@ -35,34 +35,55 @@ # if advised of the possibility of such damage. # +if [ $# -eq 0 ] || [ $# -gt 1 ]; then + printf " Usage: + \t\"$0 netflow_input_file\" + \tor + \t\"$0 default\" default input file with 6000 flows is used -# This script shows connection of the basic Nemea modules -# (nfreader, merger, logger, logreplay and flowcounter). Three nfreader -# modules read netflow data from input file and send them in unirec format -# to merger module which sends incoming data from all input interfaces -# to one output interface. The data are stored into csv file by logger module. -# The csv file can be read by logreplay module which sends them again -# in unirec format to flowcounter module. Result of this module is number -# of received flows (it should be number of flows from nfreader input file x 3). + This script shows connection of the basic Nemea modules + (nfreader, merger, logger, logreplay and flowcounter). Three nfreader + modules read netflow data from input file (specified by program argument) + and send them in unirec format to merger module which sends incoming + data from all input interfaces to one output interface. The data from merger + are stored into csv file by logger module. The csv file can be read by logreplay + module which sends them again in unirec format to flowcounter module. + Result of this module is number of received flows (it should be + number of flows from nfreader input file x 3). -# ---------- -# netflow.data ---> | nfreader | ---------- -# ---------- | -# v -# ---------- -------- -------- -# netflow.data ---> | nfreader | ---> | merger | ---> | logger | ---> file.csv -# ---------- -------- -------- -# ^ -# ---------- | -# netflow.data ---> | nfreader | ---------- -# ---------- + Step 1: + ---------- + netflow_file ---> | nfreader | ---------- + ---------- | + v + ---------- -------- -------- + netflow_file ---> | nfreader | ---> | merger | ---> | logger | ---> file.csv + ---------- -------- -------- + ^ + ---------- | + netflow_file ---> | nfreader | ---------- + ---------- -# ----------- ------------- -# file.csv ---> | logreplay | ---> | flowcounter | ---> Result (number of flows) -# ----------- ------------- + Step 2: + ----------- ------------- + file.csv ---> | logreplay | ---> | flowcounter | ---> Result (number of flows) + ----------- -------------\n" + + exit 0 +fi + +# INPUT_FILE - Input file for nfreader modules (netflow data) +if [ "$1" = "default" ]; then + INPUT_FILE="./nfcap_6000_gener_flows.dat" +else + INPUT_FILE="$1" +fi + +if [ ! -r "$INPUT_FILE" ]; then + echo "Input file \"$INPUT_FILE\" cannot be opened. Exiting..." + exit 1 +fi -# Input file for nfreader modules (netflow data) -INPUT_FILE="./nfcap_6000_gener_flows.dat" # Logger output file (csv format) LOGGER_OUTPUT_FILE="./logger_test_out" @@ -78,4 +99,4 @@ printf ">>> Starting logreplay and flowcounter...\n>Flowcounter received:\n" ../modules/flowcounter/flowcounter -i u:logrep_test_out # Cleanup -rm -f ./logger_test_out +rm -f $LOGGER_OUTPUT_FILE From 0a19109d73a36c7b120b0c2ed6df95f5a7262dc8 Mon Sep 17 00:00:00 2001 From: Marek Svepes Date: Fri, 9 Oct 2015 14:55:14 +0200 Subject: [PATCH 012/169] use-cases: basic_modules.sh: added note with library dependencies --- use-cases/basic_modules.sh | 31 +++++++++++++++++-------------- 1 file changed, 17 insertions(+), 14 deletions(-) diff --git a/use-cases/basic_modules.sh b/use-cases/basic_modules.sh index cb20580..ab763b9 100755 --- a/use-cases/basic_modules.sh +++ b/use-cases/basic_modules.sh @@ -37,13 +37,13 @@ if [ $# -eq 0 ] || [ $# -gt 1 ]; then printf " Usage: - \t\"$0 netflow_input_file\" + \t\"$0 nfdump_file\" \tor \t\"$0 default\" default input file with 6000 flows is used This script shows connection of the basic Nemea modules (nfreader, merger, logger, logreplay and flowcounter). Three nfreader - modules read netflow data from input file (specified by program argument) + modules read netflow data from nfdump file (specified by program argument) and send them in unirec format to merger module which sends incoming data from all input interfaces to one output interface. The data from merger are stored into csv file by logger module. The csv file can be read by logreplay @@ -52,22 +52,25 @@ if [ $# -eq 0 ] || [ $# -gt 1 ]; then number of flows from nfreader input file x 3). Step 1: - ---------- - netflow_file ---> | nfreader | ---------- - ---------- | + +----------+ + nfdump_file ---> | nfreader |----------- + +----------+ | v - ---------- -------- -------- - netflow_file ---> | nfreader | ---> | merger | ---> | logger | ---> file.csv - ---------- -------- -------- + +----------+ +--------+ +--------+ + nfdump_file ---> | nfreader |----> | merger |----> | logger |---> file.csv + +----------+ +--------+ +--------+ ^ - ---------- | - netflow_file ---> | nfreader | ---------- - ---------- + +----------+ | + nfdump_file ---> | nfreader |----------- + +----------+ Step 2: - ----------- ------------- - file.csv ---> | logreplay | ---> | flowcounter | ---> Result (number of flows) - ----------- -------------\n" + +-----------+ +-------------+ + file.csv ---> | logreplay |---> | flowcounter |---> Result (number of flows) + +-----------+ +-------------+ + + Note: To run this script, ../modules/ repository has to be compiled. + \"libnf\" or \"libnfdump\" library is need for nfreader compilation.\n" exit 0 fi From 311f05813ef76e9a5ff6a5a2d82ef644026e8e39 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Fri, 9 Oct 2015 22:52:39 +0200 Subject: [PATCH 013/169] use-cases: add example script for flow_meter Flow_meter is a simple flow exporting module. It can read PCAP file or it can capture live traffic from NIC. Output of this module is UniRec. --- use-cases/Makefile.am | 2 +- use-cases/flow_meter.sh | 78 +++++++++++++++++++++++++++++++++++++++++ 2 files changed, 79 insertions(+), 1 deletion(-) create mode 100755 use-cases/flow_meter.sh diff --git a/use-cases/Makefile.am b/use-cases/Makefile.am index 629ef8f..7402818 100644 --- a/use-cases/Makefile.am +++ b/use-cases/Makefile.am @@ -1 +1 @@ -EXTRA_DIST=traffic-filtering-stats.sh logger-repeater.sh +EXTRA_DIST=traffic-filtering-stats.sh logger-repeater.sh flow_meter.sh diff --git a/use-cases/flow_meter.sh b/use-cases/flow_meter.sh new file mode 100755 index 0000000..dbc7ac8 --- /dev/null +++ b/use-cases/flow_meter.sh @@ -0,0 +1,78 @@ +#!/bin/bash + +# Author: Jiri Havranek +# Copyright (C) 2015 CESNET +# +# LICENSE TERMS +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in +# the documentation and/or other materials provided with the +# distribution. +# 3. Neither the name of the Company nor the names of its contributors +# may be used to endorse or promote products derived from this +# software without specific prior written permission. +# +# ALTERNATIVELY, provided that this notice is retained in full, this +# product may be distributed under the terms of the GNU General Public +# License (GPL) version 2 or later, in which case the provisions +# of the GPL apply INSTEAD OF those given above. +# +# This software is provided ``as is'', and any express or implied +# warranties, including, but not limited to, the implied warranties of +# merchantability and fitness for a particular purpose are disclaimed. +# In no event shall the company or contributors be liable for any +# direct, indirect, incidental, special, exemplary, or consequential +# damages (including, but not limited to, procurement of substitute +# goods or services; loss of use, data, or profits; or business +# interruption) however caused and on any theory of liability, whether +# in contract, strict liability, or tort (including negligence or +# otherwise) arising in any way out of the use of this software, even +# if advised of the possibility of such damage. + + +# The purpose of this script is to show how to execute nemea module +# flow_meter and send it's output to another module (logger in this +# case). flow_meter is able to capture from interface (-I option) or +# file (-r option). In case of capture from interface it needs to be +# executed with root permission otherwise it will not be able to run. +# If you want to capture specific number of packets you can use -c +# option. + +# Check if interface is specified. +if [ "$1" = "" ]; then + echo "Specify the network interface." + echo "Usage: ./flow_meter.sh interface-name" + exit 2 +fi + +if [ "$EUID" != 0 ]; then + echo "You should run this script as root." + exit 1 +fi + +flow_meter="../modules/flow_meter/flow_meter" +logger="../modules/logger/logger" + +# Check if modules are compiled. +if [ ! -e "$flow_meter" ]; then + echo "$flow_meter does not exist. Compile flow_meter first." + exit 3 +fi + +if [ ! -e "$logger" ]; then + echo "$logger does not exist. Compile logger first." + exit 3 +fi + +# Start capture from given interface. Quit after 10 packets are captured. +./"$flow_meter" -i u:my_socket -I "$1" -c 10 >/dev/null & + +# Start logger and quit when flow_meter exits. +./"$logger" -i u:my_socket -t + From 9c9a05cc8b205a1ab467c53cd69fdc97349327da Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Fri, 9 Oct 2015 23:01:46 +0200 Subject: [PATCH 014/169] add basic_modules.sh into EXTRA_DIST --- use-cases/Makefile.am | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/use-cases/Makefile.am b/use-cases/Makefile.am index 7402818..2fcba95 100644 --- a/use-cases/Makefile.am +++ b/use-cases/Makefile.am @@ -1 +1 @@ -EXTRA_DIST=traffic-filtering-stats.sh logger-repeater.sh flow_meter.sh +EXTRA_DIST=traffic-filtering-stats.sh logger-repeater.sh flow_meter.sh basic_modules.sh From 6d5544fce1ab344b99f3a45192f200f397e41374 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Fri, 9 Oct 2015 23:08:42 +0200 Subject: [PATCH 015/169] Revision update of submodules --- detectors | 2 +- modules | 2 +- nemea-framework | 2 +- nemea-supervisor | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detectors b/detectors index 3dd5b6e..96fdc05 160000 --- a/detectors +++ b/detectors @@ -1 +1 @@ -Subproject commit 3dd5b6ed902dfe96ffe39c4eb185ebaff9c06703 +Subproject commit 96fdc0570fdf907c03f1806cbfe97b72e5d442e1 diff --git a/modules b/modules index 0b96b57..5e4e901 160000 --- a/modules +++ b/modules @@ -1 +1 @@ -Subproject commit 0b96b57c3132ffa6b7db9ca57d816f06ae6d0641 +Subproject commit 5e4e901a87105833b8e52b30b23898867a34eef4 diff --git a/nemea-framework b/nemea-framework index 56492b0..24449d1 160000 --- a/nemea-framework +++ b/nemea-framework @@ -1 +1 @@ -Subproject commit 56492b0ccad2d8a0db226b1268e6a17b0581db11 +Subproject commit 24449d1cbf7678990590a49dc78160ca30b5db38 diff --git a/nemea-supervisor b/nemea-supervisor index 19b893c..d023697 160000 --- a/nemea-supervisor +++ b/nemea-supervisor @@ -1 +1 @@ -Subproject commit 19b893c86171195dccbdc80c061e7381ec67bf97 +Subproject commit d023697443522613249980031891a02ad165eb86 From c44273d3356bba1d87a02ea9c24bef8a559a01ff Mon Sep 17 00:00:00 2001 From: Marek Svepes Date: Sat, 10 Oct 2015 13:35:34 +0200 Subject: [PATCH 016/169] vagrant: README: fixed name of vagrant box for fedora22-cloud --- vagrant/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vagrant/README.md b/vagrant/README.md index dd08a81..46a0927 100644 --- a/vagrant/README.md +++ b/vagrant/README.md @@ -26,7 +26,7 @@ For installation of Fedora 22 Cloud, rename `Vagrantfile.Fedora22` to `Vagrantfi and use the following command to get Vagrant box: ``` -vagrant box add fedora22 https://download.fedoraproject.org/pub/fedora/linux/releases/22/Cloud/x86_64/Images/Fedora-Cloud-Base-Vagrant-22-20150521.x86_64.vagrant-virtualbox.box +vagrant box add fedora22-cloud https://download.fedoraproject.org/pub/fedora/linux/releases/22/Cloud/x86_64/Images/Fedora-Cloud-Base-Vagrant-22-20150521.x86_64.vagrant-virtualbox.box ``` Scientific Linux From 6823557697bab8afa54e8922b933fed4e960f141 Mon Sep 17 00:00:00 2001 From: Tomas Cejka Date: Thu, 19 Nov 2015 19:53:30 +0100 Subject: [PATCH 017/169] config-examples: add to build process, updated prepare_default_config.sh without argument prints out help, it expects one argument 'configonly' to generate XML from *.sup files or 'install' to prepare XML and create directories from *.mkdir. Changes reflected in vagrant, where it is used. --- Makefile.am | 2 +- config-examples/Makefile.am | 8 +++++ config-examples/prepare_default_config.sh | 44 ++++++++++++++--------- configure.ac | 2 +- vagrant/Vagrantfile.Fedora22 | 2 +- vagrant/Vagrantfile.SL6 | 2 +- 6 files changed, 40 insertions(+), 20 deletions(-) diff --git a/Makefile.am b/Makefile.am index 5380cb4..b37d89d 100644 --- a/Makefile.am +++ b/Makefile.am @@ -1,4 +1,4 @@ -SUBDIRS=nemea-framework nemea-supervisor modules detectors +SUBDIRS=nemea-framework nemea-supervisor modules detectors config-examples # because of supervisor, disable systemd checking and installation during # distcheck diff --git a/config-examples/Makefile.am b/config-examples/Makefile.am index 9c9c282..05c1f4d 100644 --- a/config-examples/Makefile.am +++ b/config-examples/Makefile.am @@ -10,3 +10,11 @@ EXTRA_DIST=amplification_detection.mkdir \ supervisor.mkdir \ traffic_repeater.sup +BUILT_SOURCES=supervisor_config.xml + +supervisor_config.xml: + ./prepare_default_config.sh configonly + +clean-local: + @rm ${BUILT_SOURCES} + diff --git a/config-examples/prepare_default_config.sh b/config-examples/prepare_default_config.sh index 022fa21..39df6dd 100755 --- a/config-examples/prepare_default_config.sh +++ b/config-examples/prepare_default_config.sh @@ -3,14 +3,22 @@ # name of the output file: conffile=supervisor_config.xml -cat > "$conffile" < "$conffile" < - - false - 4 - /var/log/nemea-supervisor/ - + + false + 4 + /var/log/nemea-supervisor/ + detection modules @@ -18,21 +26,25 @@ cat > "$conffile" <> "$conffile" + cat *.sup >> "$conffile" -cat >> "$conffile" <> "$conffile" < END -xmllint -format "$conffile" > "$conffile.tmp" && mv "$conffile.tmp" "$conffile" + xmllint -format "$conffile" > "$conffile.tmp" && mv "$conffile.tmp" "$conffile" + +fi # creation of needed directories and permissions setup -for f in *.mkdir; do - for d in `cat "$f"`; do - mkdir -p "$d" - # This is not secure enough! It grants full access to the directory: - chmod 777 "$d" - done -done +if [ "$1" == "install" ]; then + for f in *.mkdir; do + for d in `cat "$f"`; do + mkdir -p "$d" + # This is not secure enough! It grants full access to the directory: + chmod 777 "$d" + done + done +fi diff --git a/configure.ac b/configure.ac index 8511469..5bef412 100644 --- a/configure.ac +++ b/configure.ac @@ -15,6 +15,6 @@ AM_INIT_AUTOMAKE([foreign subdir-objects]) # Checks for library functions. -AC_CONFIG_FILES([Makefile]) +AC_CONFIG_FILES([Makefile config-examples/Makefile]) AC_CONFIG_SUBDIRS([nemea-framework nemea-supervisor modules detectors]) AC_OUTPUT diff --git a/vagrant/Vagrantfile.Fedora22 b/vagrant/Vagrantfile.Fedora22 index 0b9da54..3f1884f 100644 --- a/vagrant/Vagrantfile.Fedora22 +++ b/vagrant/Vagrantfile.Fedora22 @@ -31,7 +31,7 @@ SCRIPT $run_supervisor = <